chef 18.6.2-universal-mingw-ucrt

data/lib/chef/provider/powershell_script.rb

@@ -0,0 +1,300 @@
+#
+# Author:: Adam Edwards (<adamed@chef.io>)
+# Copyright:: Copyright (c) Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../platform/query_helpers"
+require_relative "windows_script"
+
+class Chef
+  class Provider
+    class PowershellScript < Chef::Provider::WindowsScript
+      # FIXME: use composition not inheritance
+
+      provides :powershell_script
+
+      action :run do
+        Chef::Log.debug("using inline impl: #{new_resource.use_inline_powershell}")
+        if new_resource.use_inline_powershell
+          run_using_powershell_exec
+        else
+          validate_script_syntax!
+          super()
+        end
+      end
+
+      # Set InputFormat to None as PowerShell will hang if STDIN is redirected
+      # http://connect.microsoft.com/PowerShell/feedback/details/572313/powershell-exe-can-hang-if-stdin-is-redirected
+      DEFAULT_FLAGS = "-NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -InputFormat None".freeze
+
+      def command
+        # Must use -File rather than -Command to launch the script
+        # file created by the base class that contains the script
+
+        # code -- otherwise, powershell.exe does not propagate the
+        # error status of a failed Windows process that ran at the
+        # end of the script, it gets changed to '1'.
+        #
+        [
+          %Q{"#{interpreter_path}"},
+          DEFAULT_FLAGS,
+          new_resource.flags,
+          %Q{-File "#{script_file_path}"},
+        ].join(" ")
+      end
+
+      protected
+
+      # Run the inline version of powershell, using powershell_exec rather than powershell_out - this should
+      # hopefully
+      def run_using_powershell_exec
+        # Because of the nature of powershell_exec, we can't easily stream data to the shell, so we just flat out
+        # disallow this combination
+        if new_resource.live_stream
+          raise "powershell_script does not support live_stream when inline powershell is enabled - please choose one or the other"
+        end
+
+        # This comes from the execute super resource - since we want to limit the scope of this to powershell,
+        # we use this here
+        if creates && sentinel_file.exist?
+          logger.debug("#{new_resource} sentinel file #{sentinel_file} exists - nothing to do")
+          return false
+        end
+
+        converge_by("execute direct powershell #{new_resource.name}") do
+          # For scoping - otherwise, we lose return_code/stdout/stderr when the timeout block is over
+          return_code = nil
+          stdout = nil
+          stderr = nil
+
+          r = powershell_exec!(powershell_wrapper_script, new_resource.interpreter.to_sym, timeout: new_resource.timeout)
+          # Split out the stdout/return code format if needed
+          return_code = r.result
+
+          # The script returns an array if there is stdout, or just a plain return value if
+          # there is not - we need to handle both of these cases for full coverage
+          if return_code.is_a?(Array)
+            # Why to_s?  Because if the only powershell output is an object,
+            # it'll be returned here
+            stdout = return_code[0].to_s
+            stderr = r.errors.join("\n")
+            return_code = return_code[-1]
+          else
+            stdout = ""
+            stderr = r.errors.join("\n")
+          end
+
+          Chef::Log.info("Powershell output: #{stdout}") unless stdout.empty?
+          Chef::Log.info("Powershell error: #{stderr}") unless stderr.empty?
+
+          # Check the return code, and validate.  This code is cribbed from execute.rb, and does exactly the same
+          # thing as it does there
+          valid_returns = new_resource.returns
+          valid_returns = [valid_returns] if valid_returns.is_a?(Integer)
+          unless valid_returns.include?(return_code)
+            # Handle sensitive results
+            if sensitive?
+              ex = ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed.new("Command execution failed. STDOUT/STDERR suppressed for sensitive resource")
+              # Forcibly hide the exception cause chain here so we don't log the unredacted version
+              def ex.cause
+                nil
+              end
+              raise ex
+            else
+              raise ChefPowerShell::PowerShellExceptions::PowerShellCommandFailed.new("Powershell command returned #{return_code} - output was \"#{stdout}\", error output  was \"#{stderr}\"")
+            end
+          end
+          true
+        end
+      end
+
+      def interpreter_path
+        # Powershell.exe is always in "v1.0" folder (for backwards compatibility)
+        # pwsh is the other interpreter and we will assume that it is on the path.
+        # It will exist in different folders depending on the installed version.
+        # There can also be multiple versions installed. Depending on how it was installed,
+        # there might be a registry entry pointing to the installation path. The key will
+        # differ depending on version and architecture. It seems best to let the PATH
+        # determine the file path to use since that will provide the same pwsh.exe one
+        # would invoke from any shell.
+        if interpreter == "powershell"
+          Chef::Util::PathHelper.join(basepath, "WindowsPowerShell", "v1.0", "#{interpreter}.exe")
+        else
+          interpreter
+        end
+      end
+
+      def code
+        code = powershell_wrapper_script
+        logger.trace("powershell_script provider called with script code:\n\n#{new_resource.code}\n")
+        logger.trace("powershell_script provider will execute transformed code:\n\n#{code}\n")
+        code
+      end
+
+      def validate_script_syntax!
+        Tempfile.open(["chef_powershell_script-user-code", ".ps1"]) do |user_script_file|
+          # Wrap the user's code in a PowerShell script block so that
+          # it isn't executed. However, syntactically invalid script
+          # in that block will still trigger a syntax error which is
+          # exactly what we want here -- verify the syntax without
+          # actually running the script.
+          user_code_wrapped_in_powershell_script_block = <<~EOH
+            {
+              #{new_resource.code}
+            }
+          EOH
+          user_script_file.puts user_code_wrapped_in_powershell_script_block
+
+          # A .close or explicit .flush required to ensure the file is
+          # written to the file system at this point, which is required since
+          # the intent is to execute the code just written to it.
+          user_script_file.close
+          validation_command = [
+            %Q{"#{interpreter_path}"},
+            DEFAULT_FLAGS,
+            new_resource.flags,
+            %Q{-Command ". '#{user_script_file.path}'"},
+          ].join(" ")
+
+          # Note that other script providers like bash allow syntax errors
+          # to be suppressed by setting 'returns' to a value that the
+          # interpreter would return as a status code in the syntax
+          # error case. We explicitly don't do this here -- syntax
+          # errors will not be suppressed, since doing so could make
+          # it harder for users to detect / debug invalid scripts.
+
+          # Therefore, the only return value for a syntactically valid
+          # script is 0. If an exception is raised by shellout, this
+          # means a non-zero return and thus a syntactically invalid script.
+
+          with_os_architecture(node, architecture: new_resource.architecture) do
+            shell_out!(validation_command, returns: [0])
+          end
+        end
+      end
+
+      # Process exit codes are strange with PowerShell and require
+      # special handling to cover common use cases.
+      # A wrapper script is used to launch user-supplied script while
+      # still obtaining useful process exit codes. Unless you
+      # explicitly call exit in PowerShell, the powershell.exe
+      # interpreter returns only 0 for success or 1 for failure. Since
+      # we'd like to get specific exit codes from executable tools run
+      # with PowerShell, we do some work using the automatic variables
+      # $? and $LASTEXITCODE to return the process exit code of the
+      # last process run in the script if it is the last command
+      # executed, otherwise 0 or 1 based on whether $? is set to true
+      # (success, where we return 0) or false (where we return 1).
+      #
+      # This is the regular powershell version of the above script - the difference
+      # is that regular powershell allows for hidden visibility variables, due to the
+      # very slightly different semantics.
+      def powershell_wrapper_script
+        <<~EOH
+          # Chef Client wrapper for powershell_script resources
+
+          # In rare cases, such as when PowerShell is executed
+          # as an alternate user, the new-variable cmdlet is not
+          # available, so import it just in case
+          if ( get-module -ListAvailable Microsoft.PowerShell.Utility )
+          {
+              Import-Module Microsoft.PowerShell.Utility
+          }
+
+          # LASTEXITCODE can be uninitialized -- make it explicitly 0
+          # to avoid incorrect detection of failure (non-zero) codes
+          $global:LASTEXITCODE = 0
+
+          # Catch any exceptions -- without this, exceptions will result
+          # In a zero return code instead of the desired non-zero code
+          # that indicates a failure
+
+#{if new_resource.use_inline_powershell
+    # Inline powershell doesn't allow for private visibility variables,
+    # and uses return instead of exit
+    <<-EOI
+          trap [Exception] {write-error ($_.Exception.Message);return 1}
+          $interpolatedexitcode = $#{new_resource.convert_boolean_return}
+    EOI
+  else
+    <<-EOI
+          trap [Exception] {write-error ($_.Exception.Message);exit 1}
+
+          # Variable state that should not be accessible to the user code
+          new-variable -name interpolatedexitcode -visibility private -value $#{new_resource.convert_boolean_return}
+          new-variable -name chefscriptresult -visibility private
+    EOI
+  end}
+          # Initialize a variable we use to capture $? inside a block
+          $global:lastcmdlet = $null
+
+          # Execute the user's code in a script block --
+          $chefscriptresult =
+          {
+           #{new_resource.code}
+
+           # This assignment doesn't affect the block's return value
+           $global:lastcmdlet = $?
+          }.invokereturnasis()
+
+          # Assume failure status of 1 -- success cases
+          # will have to override this
+          $exitstatus = 1
+
+          # If convert_boolean_return is enabled, the block's return value
+          # gets precedence in determining our exit status
+          if ($interpolatedexitcode -and $chefscriptresult -ne $null -and $chefscriptresult.gettype().name -eq 'boolean')
+          {
+            $exitstatus = [int32](!$chefscriptresult)
+          }
+          elseif ($lastcmdlet)
+          {
+            # Otherwise, a successful cmdlet execution defines the status
+            $exitstatus = 0
+          }
+          elseif ( $LASTEXITCODE -ne $null -and $LASTEXITCODE -ne 0 )
+          {
+            # If the cmdlet status is failed, allow the Win32 status
+            # in $LASTEXITCODE to define exit status. This handles the case
+            # where no cmdlets, only Win32 processes have run since $?
+            # will be set to $false whenever a Win32 process returns a non-zero
+            # status.
+            $exitstatus = $LASTEXITCODE
+          }
+
+          # Print STDOUT for the script execution
+          Write-Output $chefscriptresult
+
+          # If this script is launched with -File, the process exit
+          # status of PowerShell.exe will be $exitstatus. If it was
+          # launched with -Command, it will be 0 if $exitstatus was 0,
+          # 1 (i.e. failed) otherwise.
+#{if new_resource.use_inline_powershell
+    # Inline powershell needs return, not exit
+    "return $exitstatus\n"
+  else
+    "exit $exitstatus\n"
+  end
+}
+        EOH
+      end
+
+      def script_extension
+        ".ps1"
+      end
+    end
+  end
+end

data/lib/chef/provider/registry_key.rb

@@ -0,0 +1,201 @@
+#
+# Author:: Prajakta Purohit (<prajakta@chef.io>)
+# Author:: Lamont Granquist (<lamont@chef.io>)
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../config"
+require_relative "../log"
+require_relative "../resource/registry_key"
+require_relative "../mixin/checksum"
+require_relative "../provider"
+require "etc" unless defined?(Etc)
+require "fileutils" unless defined?(FileUtils)
+require_relative "../scan_access_control"
+require_relative "../win32/registry"
+
+class Chef
+
+  class Provider
+    class RegistryKey < Chef::Provider
+      provides :registry_key
+
+      include Chef::Mixin::Checksum
+
+      WORD_TYPES = %i{dword dword_big_endian qword}.freeze
+
+      def running_on_windows!
+        unless ChefUtils.windows?
+          raise Chef::Exceptions::Win32NotWindows, "Attempt to manipulate the windows registry on a non-windows node"
+        end
+      end
+
+      def load_current_resource
+        running_on_windows!
+        @current_resource ||= Chef::Resource::RegistryKey.new(new_resource.key, run_context)
+        current_resource.key(new_resource.key)
+        current_resource.architecture(new_resource.architecture)
+        current_resource.recursive(new_resource.recursive)
+        if registry.key_exists?(new_resource.key)
+          current_registry_values = registry.get_values(new_resource.key) || []
+          current_resource.values(current_registry_values)
+        end
+        values_to_hash(current_resource.unscrubbed_values)
+        current_resource
+      end
+
+      def registry
+        @registry ||= Chef::Win32::Registry.new(@run_context, new_resource.architecture)
+      end
+
+      def values_to_hash(values)
+        if values
+          @name_hash = Hash[values.map { |val| [val[:name].downcase, val] }]
+        else
+          @name_hash = {}
+        end
+      end
+
+      def key_missing?(values, name)
+        values.each do |v|
+          return true unless v.key?(name)
+        end
+        false
+      end
+
+      def define_resource_requirements
+        requirements.assert(:create, :create_if_missing, :delete, :delete_key) do |a|
+          a.assertion { registry.hive_exists?(new_resource.key) }
+          a.failure_message(Chef::Exceptions::Win32RegHiveMissing, "Hive #{new_resource.key.split("\\").shift} does not exist")
+        end
+
+        requirements.assert(:create) do |a|
+          a.assertion { registry.key_exists?(new_resource.key) }
+          a.whyrun("Key #{new_resource.key} does not exist. Unless it would have been created before, attempt to modify its values would fail.")
+        end
+
+        requirements.assert(:create, :create_if_missing) do |a|
+          # If keys missing in the path and recursive == false
+          a.assertion { !registry.keys_missing?(current_resource.key) || new_resource.recursive }
+          a.failure_message(Chef::Exceptions::Win32RegNoRecursive, "Intermediate keys missing but recursive is set to false")
+          a.whyrun("Intermediate keys in #{new_resource.key} do not exist. Unless they would have been created earlier, attempt to modify them would fail.")
+        end
+
+        requirements.assert(:delete_key) do |a|
+          # If key to be deleted has subkeys but recursive == false
+          a.assertion { !registry.key_exists?(new_resource.key) || !registry.has_subkeys?(new_resource.key) || new_resource.recursive }
+          a.failure_message(Chef::Exceptions::Win32RegNoRecursive, "#{new_resource.key} has subkeys but recursive is set to false.")
+          a.whyrun("#{current_resource.key} has subkeys, but recursive is set to false. attempt to delete would fails unless subkeys were deleted prior to this action.")
+        end
+
+        requirements.assert(:create, :create_if_missing) do |a|
+          # If type key missing in the RegistryKey values hash
+          a.assertion { !key_missing?(new_resource.values, :type) }
+          a.failure_message(Chef::Exceptions::RegKeyValuesTypeMissing, "Missing type key in RegistryKey values hash")
+          a.whyrun("Type key does not exist. Attempt would fail unless the complete values hash containing all the keys does not exist for registry_key resource's create action.")
+        end
+
+        requirements.assert(:create, :create_if_missing) do |a|
+          # If data key missing in the RegistryKey values hash
+          a.assertion { !key_missing?(new_resource.values, :data) }
+          a.failure_message(Chef::Exceptions::RegKeyValuesDataMissing, "Missing data key in RegistryKey values hash")
+          a.whyrun("Data key does not exist. Attempt would fail unless the complete values hash containing all the keys does not exist for registry_key resource's create action.")
+        end
+      end
+
+      action :create do
+        unless registry.key_exists?(current_resource.key)
+          converge_by("create key #{new_resource.key}") do
+            registry.create_key(new_resource.key, new_resource.recursive)
+          end
+        end
+        new_resource.unscrubbed_values.each do |value|
+          if @name_hash.key?(value[:name].downcase)
+            current_value = @name_hash[value[:name].downcase]
+            value[:data] = value[:data].to_i if WORD_TYPES.include?(value[:type])
+
+            unless current_value[:type] == value[:type] && current_value[:data] == value[:data]
+              converge_by_value = if new_resource.sensitive
+                                    value.merge(data: "*sensitive value suppressed*")
+                                  else
+                                    value
+                                  end
+
+              converge_by("set value #{converge_by_value}") do
+                registry.set_value(new_resource.key, value)
+              end
+            end
+          else
+            converge_by_value = if new_resource.sensitive
+                                  value.merge(data: "*sensitive value suppressed*")
+                                else
+                                  value
+                                end
+
+            converge_by("set value #{converge_by_value}") do
+              registry.set_value(new_resource.key, value)
+            end
+          end
+        end
+      end
+
+      action :create_if_missing do
+        unless registry.key_exists?(new_resource.key)
+          converge_by("create key #{new_resource.key}") do
+            registry.create_key(new_resource.key, new_resource.recursive)
+          end
+        end
+        new_resource.unscrubbed_values.each do |value|
+          unless @name_hash.key?(value[:name].downcase)
+            converge_by_value = if new_resource.sensitive
+                                  value.merge(data: "*sensitive value suppressed*")
+                                else
+                                  value
+                                end
+
+            converge_by("create value #{converge_by_value}") do
+              registry.set_value(new_resource.key, value)
+            end
+          end
+        end
+      end
+
+      action :delete do
+        if registry.key_exists?(new_resource.key)
+          new_resource.unscrubbed_values.each do |value|
+            if @name_hash.key?(value[:name].downcase)
+              converge_by_value = value
+              converge_by_value[:data] = "*sensitive value suppressed*" if new_resource.sensitive
+
+              converge_by("delete value #{converge_by_value}") do
+                registry.delete_value(new_resource.key, value)
+              end
+            end
+          end
+        end
+      end
+
+      action :delete_key do
+        if registry.key_exists?(new_resource.key)
+          converge_by("delete key #{new_resource.key}") do
+            registry.delete_key(new_resource.key, new_resource.recursive)
+          end
+        end
+      end
+
+    end
+  end
+end