chef 18.7.10 → 18.8.46

data/spec/support/shared/functional/securable_resource_with_reporting.rb

@@ -1,393 +0,0 @@
-
-
-ALL_EXPANDED_PERMISSIONS = ["generic read",
-                            "generic write",
-                            "generic execute",
-                            "generic all",
-                            "delete",
-                            "read permissions",
-                            "change permissions",
-                            "take ownership",
-                            "synchronize",
-                            "access system security",
-                            "read data / list directory",
-                            "write data / add file",
-                            "append data / add subdirectory",
-                            "read extended attributes",
-                            "write extended attributes",
-                            "execute / traverse",
-                            "delete child",
-                            "read attributes",
-                            "write attributes"].freeze
-
-shared_examples_for "a securable resource with reporting" do
-
-  include_context "diff disabled"
-
-  let(:current_resource) do
-    provider = resource.provider_for_action(resource.action)
-    provider.load_current_resource
-    provider.current_resource
-  end
-
-  # Default mode varies based on implementation. Providers that use a tempfile
-  # will default to 0600. Providers that use File.open will default to 0666 -
-  # umask
-  # let(:default_mode) { (0666 & ~File.umask).to_s(8) }
-
-  describe "reading file security metadata for reporting on unix", unix_only: true do
-    # According to POSIX standard created files get either the
-    # effective gid of the process or inherits the gid of the parent
-    # directory based on file system. Since it's hard to guess what
-    # would happen on each platform we create a dummy file and see
-    # what the group name should be.
-    before do
-      FileUtils.touch(path)
-      @expected_gid = File.stat(path).gid
-      @expected_group_name = Etc.getgrgid(@expected_gid).name
-      FileUtils.rm_rf(path)
-    end
-
-    context "when the target file doesn't exist" do
-      before do
-        resource.action(:create)
-      end
-
-      it "has empty values for file metadata in 'current_resource'" do
-        expect(current_resource.owner).to be_nil
-        expect(current_resource.group).to be_nil
-        expect(current_resource.mode).to be_nil
-      end
-
-      context "and no security metadata is specified in new_resource" do
-        it "sets the metadata values on the new_resource as strings after creating" do
-          resource.run_action(:create)
-          # TODO: most stable way to specify?
-          expect(resource.owner).to eq(Etc.getpwuid(Process.uid).name)
-          expect(resource.group).to eq(@expected_group_name)
-          expect(resource.mode).to eq("0#{default_mode}")
-        end
-      end
-
-      context "and owner is specified with a String (username) in new_resource", requires_root: true do
-
-        # TODO/bug: duplicated from the "securable resource" tests
-
-        if ohai[:platform] == "aix"
-          let(:expected_user_name) { "guest" }
-        else
-          let(:expected_user_name) { "nobody" }
-        end
-
-        before do
-          resource.owner(expected_user_name)
-          resource.run_action(:create)
-        end
-
-        it "sets the owner on new_resource to the username (String) of the desired owner" do
-          expect(resource.owner).to eq(expected_user_name)
-        end
-
-      end
-
-      context "and owner is specified with an Integer (uid) in new_resource", requires_root: true do
-
-        # TODO: duplicated from "securable resource"
-        if ohai[:platform] == "aix"
-          let(:expected_user_name) { "guest" }
-        else
-          let(:expected_user_name) { "nobody" }
-        end
-        let(:expected_uid) { Etc.getpwnam(expected_user_name).uid }
-        let(:desired_gid) { 1337 }
-        let(:expected_gid) { 1337 }
-
-        before do
-          resource.owner(expected_uid)
-          resource.run_action(:create)
-        end
-
-        it "sets the owner on new_resource to the uid (Integer) of the desired owner" do
-          expect(resource.owner).to eq(expected_uid)
-        end
-      end
-
-      context "and group is specified with a String (group name)", requires_root: true do
-
-        let(:expected_group_name) { Etc.getgrent.name }
-
-        before do
-          resource.group(expected_group_name)
-          resource.run_action(:create)
-        end
-
-        it "sets the group on new_resource to the group name (String) of the group" do
-          expect(resource.group).to eq(expected_group_name)
-        end
-
-      end
-
-      context "and group is specified with an Integer (gid)", requires_root: true do
-        let(:expected_gid) { Etc.getgrent.gid }
-
-        before do
-          resource.group(expected_gid)
-          resource.run_action(:create)
-        end
-
-        it "sets the group on new_resource to the gid (Integer)" do
-          expect(resource.group).to eq(expected_gid)
-        end
-
-      end
-
-      context "and mode is specified as a String" do
-        # Need full permission for owner here or else remote directory gets
-        # into trouble trying to manage nested directories
-        let(:set_mode) { "0740" }
-        let(:expected_mode) { "0740" }
-
-        before do
-          resource.mode(set_mode)
-          resource.run_action(:create)
-        end
-
-        it "sets mode on the new_resource as a String" do
-          expect(resource.mode).to eq(expected_mode)
-        end
-      end
-
-      context "and mode is specified as an Integer" do
-        let(:set_mode) { 00740 }
-
-        let(:expected_mode) { "0740" }
-        before do
-          resource.mode(set_mode)
-          resource.run_action(:create)
-        end
-
-        it "sets mode on the new resource as a String" do
-          expect(resource.mode).to eq(expected_mode)
-        end
-      end
-    end
-
-    context "when the target file exists" do
-      before do
-        FileUtils.touch(resource.path)
-        resource.action(:create)
-      end
-
-      context "and no security metadata is specified in new_resource" do
-        it "sets the current values on current resource as strings" do
-          # TODO: most stable way to specify?
-          expect(current_resource.owner).to eq(Etc.getpwuid(Process.uid).name)
-          expect(current_resource.group).to eq(@expected_group_name)
-          expect(current_resource.mode).to eq("0#{(0666 & ~File.umask).to_s(8)}")
-        end
-      end
-
-      context "and owner is specified with a String (username) in new_resource" do
-
-        let(:expected_user_name) { Etc.getpwuid(Process.uid).name }
-
-        before do
-          resource.owner(expected_user_name)
-        end
-
-        it "sets the owner on new_resource to the username (String) of the desired owner" do
-          expect(current_resource.owner).to eq(expected_user_name)
-        end
-
-      end
-
-      context "and owner is specified with an Integer (uid) in new_resource" do
-
-        let(:expected_uid) { Process.uid }
-
-        before do
-          resource.owner(expected_uid)
-        end
-
-        it "sets the owner on new_resource to the uid (Integer) of the desired owner" do
-          expect(current_resource.owner).to eq(expected_uid)
-        end
-      end
-
-      context "and group is specified with a String (group name)" do
-        before do
-          resource.group(@expected_group_name)
-        end
-
-        it "sets the group on new_resource to the group name (String) of the group" do
-          expect(current_resource.group).to eq(@expected_group_name)
-        end
-
-      end
-
-      context "and group is specified with an Integer (gid)" do
-        before do
-          resource.group(@expected_gid)
-        end
-
-        it "sets the group on new_resource to the gid (Integer)" do
-          expect(current_resource.group).to eq(@expected_gid)
-        end
-
-      end
-
-      context "and mode is specified as a String" do
-        let(:default_create_mode) { 0666 & ~File.umask }
-        let(:expected_mode) { "0#{default_create_mode.to_s(8)}" }
-
-        before do
-          resource.mode(expected_mode)
-        end
-
-        it "sets mode on the new_resource as a String" do
-          expect(current_resource.mode).to eq(expected_mode)
-        end
-      end
-
-      context "and mode is specified as an Integer" do
-        let(:set_mode) { 0666 & ~File.umask }
-        let(:expected_mode) { "0#{set_mode.to_s(8)}" }
-
-        before do
-          resource.mode(set_mode)
-        end
-
-        it "sets mode on the new resource as a String" do
-          expect(current_resource.mode).to eq(expected_mode)
-        end
-      end
-    end
-  end
-
-  describe "reading file security metadata for reporting on windows", :windows_only do
-
-    context "when the target file doesn't exist" do
-
-      # Windows reporting data should look like this (+/- ish):
-      # { "owner" => "bob", "checksum" => "ffff", "access control" => { "bob" => { "permissions" => ["perm1", "perm2", ...], "flags" => [] }}}
-
-      before do
-        resource.action(:create)
-      end
-
-      it "has empty values for file metadata in 'current_resource'" do
-        skip "windows reporting not yet fully supported"
-        expect(current_resource.owner).to be_nil
-        expect(current_resource.expanded_rights).to be_nil
-      end
-
-      context "and no security metadata is specified in new_resource" do
-        before do
-          skip "windows reporting not yet fully supported"
-        end
-
-        it "sets the metadata values on the new_resource as strings after creating" do
-          resource.run_action(:create)
-          # TODO: most stable way to specify?
-          expect(resource.owner).to eq(etc.getpwuid(process.uid).name)
-          expect(resource.state[:expanded_rights]).to eq({ "CURRENTUSER" => { "permissions" => ALL_EXPANDED_PERMISSIONS, "flags" => [] } })
-          expect(resource.state[:expanded_deny_rights]).to eq({})
-          expect(resource.state[:inherits]).to be_truthy
-        end
-      end
-
-      context "and owner is specified with a string (username) in new_resource" do
-
-        # TODO/bug: duplicated from the "securable resource" tests
-        let(:expected_user_name) { "Guest" }
-
-        before do
-          resource.owner(expected_user_name)
-          resource.run_action(:create)
-        end
-
-        it "sets the owner on new_resource to the username (string) of the desired owner" do
-          expect(resource.owner).to eq(expected_user_name)
-        end
-
-      end
-
-      context "and owner is specified with a fully qualified domain user" do
-
-        # TODO: duplicated from "securable resource"
-        let(:expected_user_name) { 'domain\user' }
-
-        before do
-          skip "windows reporting not yet fully supported"
-          resource.owner(expected_user_name)
-          resource.run_action(:create)
-        end
-
-        it "sets the owner on new_resource to the fully qualified name of the desired owner" do
-          expect(resource.owner).to eq(expected_user_name)
-        end
-      end
-
-    end
-
-    context "when the target file exists" do
-      before do
-        skip "windows reporting not yet fully supported"
-        FileUtils.touch(resource.path)
-        resource.action(:create)
-      end
-
-      context "and no security metadata is specified in new_resource" do
-        it "sets the current values on current resource as strings" do
-          # TODO: most stable way to specify?
-          expect(current_resource.owner).to eq(etc.getpwuid(process.uid).name)
-          expect(current_resource.expanded_rights).to eq({ "CURRENTUSER" => ALL_EXPANDED_PERMISSIONS })
-        end
-      end
-
-      context "and owner is specified with a string (username) in new_resource" do
-
-        let(:expected_user_name) { etc.getpwuid(process.uid).name }
-
-        before do
-          resource.owner(expected_user_name)
-        end
-
-        it "sets the owner on current_resource to the username (string) of the desired owner" do
-          expect(current_resource.owner).to eq(expected_user_name)
-        end
-
-      end
-
-      context "and owner is specified as a fully qualified 'domain\\user' in new_resource" do
-
-        let(:expected_user_name) { 'domain\user' }
-
-        before do
-          resource.owner(expected_user_name)
-        end
-
-        it "sets the owner on current_resource to the fully qualified name of the desired owner" do
-          expect(current_resource.owner).to eq(expected_uid)
-        end
-      end
-
-      context "and access rights are specified on the new_resource" do
-        # TODO: before do blah
-
-        it "sets the expanded_rights on the current resource" do
-          skip
-        end
-      end
-
-      context "and no access rights are specified on the current resource" do
-        # TODO: before do blah
-
-        it "sets the expanded rights on the current resource" do
-          skip
-        end
-      end
-
-    end
-  end
-end

data/spec/support/shared/functional/windows_script.rb

@@ -1,260 +0,0 @@
-#
-# Author:: Serdar Sutay (<serdar@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
-# License:: Apache License, Version 2.0
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# Shared context used by both Powershell and Batch script provider
-# tests.
-
-require "chef/platform/query_helpers"
-
-shared_context Chef::Resource::WindowsScript do
-  before(:all) do
-    @ohai_reader = Ohai::System.new
-    @ohai_reader.all_plugins(%w{platform kernel})
-
-    new_node = Chef::Node.new
-    new_node.consume_external_attrs(@ohai_reader.data, {})
-
-    events = Chef::EventDispatch::Dispatcher.new
-
-    @run_context = Chef::RunContext.new(new_node, {}, events)
-  end
-
-  let(:script_output_path) do
-    File.join(Dir.tmpdir, make_tmpname("windows_script_test"))
-  end
-
-  before(:each) do
-    File.delete(script_output_path) if File.exist?(script_output_path)
-  end
-
-  after(:each) do
-    File.delete(script_output_path) if File.exist?(script_output_path)
-  end
-
-  shared_examples_for "a script resource with architecture attribute" do
-    context "with the given architecture attribute value" do
-      let(:expected_architecture) do
-        if resource_architecture
-          expected_architecture = resource_architecture
-        else
-          expected_architecture = @ohai_reader.data["kernel"]["machine"].to_sym
-        end
-      end
-      let(:expected_architecture_output) do
-        expected_architecture == :i386 ? "X86" : "AMD64"
-      end
-      let(:guard_script_suffix) do
-        "guard"
-      end
-      let(:guard_script_output_path) do
-        "#{script_output_path}#{guard_script_suffix}"
-      end
-      let(:resource_command) do
-        "#{architecture_command} #{output_command} #{script_output_path}"
-      end
-      let(:resource_guard_command) do
-        "#{architecture_command} #{output_command} #{guard_script_output_path}"
-      end
-
-      before(:each) do
-        resource.code resource_command
-        (resource.architecture resource_architecture) if resource_architecture
-        resource.returns(0)
-      end
-
-      it "creates a process with the expected architecture" do
-        resource.run_action(:run)
-        expect(get_process_architecture).to eq(expected_architecture_output.downcase)
-      end
-
-      it "executes guards with the same architecture as the resource" do
-        resource.only_if resource_guard_command
-        resource.run_action(:run)
-        expect(get_process_architecture).to eq(expected_architecture_output.downcase)
-        expect(get_guard_process_architecture).to eq(expected_architecture_output.downcase)
-        expect(get_guard_process_architecture).to eq(get_process_architecture)
-      end
-
-      context "when the guard's architecture is specified as 64-bit" do
-        let(:guard_architecture) { :x86_64 }
-        it "executes a 64-bit guard", :windows64_only do
-          resource.only_if resource_guard_command, architecture: guard_architecture
-          resource.run_action(:run)
-          expect(get_guard_process_architecture).to eq("amd64")
-        end
-      end
-
-      context "when the guard's architecture is specified as 32-bit" do
-        let(:guard_architecture) { :i386 }
-        it "executes a 32-bit guard" do
-          resource.only_if resource_guard_command, architecture: guard_architecture
-          resource.run_action(:run)
-          expect(get_guard_process_architecture).to eq("x86")
-        end
-      end
-    end
-  end
-
-  shared_examples_for "a Windows script running on Windows" do
-    shared_examples_for "a script that cannot be accessed by other users if they are not administrators" do
-      include Chef::Mixin::ShellOut
-
-      let(:script_provider) { resource.provider_for_action(:run) }
-      let(:script_file) { script_provider.script_file }
-      let(:script_file_path) { script_file.to_path }
-
-      let(:read_access_denied_command) { "::File.read('#{script_file_path}')" }
-      let(:modify_access_denied_command) { "::File.write('#{script_file_path}', 'stuff')" }
-      let(:delete_access_denied_command) { "::File.delete('#{script_file_path}')" }
-      let(:access_denied_sentinel) { 7334 }
-      let(:access_allowed_sentinel) { 1586 }
-      let(:access_command_invalid) { 0 }
-
-      let(:ruby_interpreter_path) { RbConfig.ruby }
-      let(:ruby_command_template) { "require 'FileUtils';status = 0;begin; #{ruby_access_command};rescue Exception => e; puts e; status = e.class == Errno::EACCES ? #{access_denied_sentinel} : #{access_allowed_sentinel};end;exit status" }
-      let(:command_template) { "set BUNDLE_GEMFILE=&#{ruby_interpreter_path} -e \"#{ruby_command_template}\"" }
-      let(:access_command) { command_template }
-
-      before do
-        expect(script_provider).to receive(:unlink_script_file)
-        resource.code("echo hi")
-        script_provider.action_run
-      end
-
-      after do
-        script_file.close! if script_file
-        ::File.delete(script_file.to_path) if script_file && ::File.exist?(script_file.to_path)
-      end
-
-      include_context "alternate user identity"
-
-      shared_examples_for "a script whose file system location cannot be accessed by other non-admin users" do
-        let(:ruby_access_command) { file_access_command }
-        it "generates a script in the local file system that prevents read access to other non-admin users" do
-          shell_out!(access_command, user: windows_nonadmin_user, password: windows_nonadmin_user_password, returns: [access_denied_sentinel])
-        end
-      end
-
-      context "when a different non-admin user attempts write (modify) to access the script" do
-        let(:file_access_command) { modify_access_denied_command }
-        it_behaves_like "a script whose file system location cannot be accessed by other non-admin users"
-      end
-
-      context "when a different non-admin user attempts write (delete) to access the script" do
-        let(:file_access_command) { delete_access_denied_command }
-        it_behaves_like "a script whose file system location cannot be accessed by other non-admin users"
-      end
-    end
-
-    describe "when the run action is invoked on Windows" do
-      it "executes the script code" do
-        resource.code("chcp > \"#{script_output_path}\"")
-        resource.returns(0)
-        resource.run_action(:run)
-      end
-
-      context "the script is executed with the identity of the current user", :windows_service_requires_assign_token do
-        it_behaves_like "a script that cannot be accessed by other users if they are not administrators"
-      end
-
-      context "the script is executed with an alternate non-admin identity", :windows_service_requires_assign_token do
-        include_context "alternate user identity"
-
-        before do
-          resource.user(windows_alternate_user)
-          resource.password(windows_alternate_user_password)
-        end
-
-        it_behaves_like "a script that cannot be accessed by other users if they are not administrators"
-      end
-    end
-
-    context "when $env:TMP has a space" do
-      before(:each) do
-        @dir = Dir.mktmpdir("Jerry Smith")
-        @original_env = ENV.to_hash.dup
-        ENV.delete("TMP")
-        ENV["TMP"] = @dir
-      end
-
-      after(:each) do
-        FileUtils.remove_entry_secure(@dir)
-        ENV.clear
-        ENV.update(@original_env)
-      end
-
-      it "executes the script code" do
-        resource.code("chcp > \"#{script_output_path}\"")
-        resource.returns(0)
-        resource.run_action(:run)
-      end
-    end
-
-    context "when evaluating guards" do
-      it "has a guard_interpreter attribute set to the short name of the resource" do
-        expect(resource.guard_interpreter).to eq(resource.resource_name)
-        resource.not_if "findstr.exe /thiscommandhasnonzeroexitstatus"
-        expect(Chef::Resource).to receive(:resource_for_node).and_call_original
-        expect(resource.class).to receive(:new).and_call_original
-        expect(resource.should_skip?(:run)).to be_falsey
-      end
-
-      context "when this resource is used as a guard and it is specified with an alternate user identity" do
-        let(:guard_interpreter_resource) { resource.resource_name }
-        it_behaves_like "a resource with a guard specifying an alternate user identity"
-      end
-    end
-
-    context "when the architecture attribute is not set" do
-      let(:resource_architecture) { nil }
-      it_behaves_like "a script resource with architecture attribute"
-    end
-
-    context "when the architecture attribute is :i386" do
-      let(:resource_architecture) { :i386 }
-      it_behaves_like "a script resource with architecture attribute"
-    end
-
-    context "when the architecture attribute is :x86_64" do
-      let(:resource_architecture) { :x86_64 }
-      it_behaves_like "a script resource with architecture attribute"
-    end
-
-    describe "when running with an alternate user identity" do
-      let(:resource_command_property) { :code }
-      it_behaves_like "an execute resource that supports alternate user identity"
-    end
-  end
-
-  def get_windows_script_output(suffix = "")
-    File.read("#{script_output_path}#{suffix}")
-  end
-
-  def source_contains_case_insensitive_content?( source, content )
-    source.downcase.include?(content.downcase)
-  end
-
-  def get_guard_process_architecture
-    get_process_architecture(guard_script_suffix)
-  end
-
-  def get_process_architecture(suffix = "")
-    get_windows_script_output(suffix).strip.downcase
-  end
-
-end