openvox 7.37.1

data/lib/puppet/provider/exec.rb

@@ -0,0 +1,105 @@
+require_relative '../../puppet/provider'
+require_relative '../../puppet/util/execution'
+
+class Puppet::Provider::Exec < Puppet::Provider
+  include Puppet::Util::Execution
+
+  def environment
+    env = {}
+
+    if (path = resource[:path])
+      env[:PATH] = path.join(File::PATH_SEPARATOR)
+    end
+
+    return env unless (envlist = resource[:environment])
+
+    envlist = [envlist] unless envlist.is_a? Array
+    envlist.each do |setting|
+      unless (match = /^(\w+)=((.|\n)*)$/.match(setting))
+        warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
+        next
+      end
+      var = match[1]
+      value = match[2]
+
+      if env.include?(var) || env.include?(var.to_sym)
+        warning _("Overriding environment setting '%{var}' with '%{value}'") % { var: var, value: value }
+      end
+
+      if value.nil? || value.empty?
+        msg = _("Empty environment setting '%{var}'") % {var: var}
+        Puppet.warn_once('undefined_variables', "empty_env_var_#{var}", msg, resource.file, resource.line)
+      end
+
+      env[var] = value
+    end
+
+    env
+  end
+
+  def run(command, check = false)
+    output = nil
+    sensitive = resource.parameters[:command].sensitive
+
+    checkexe(command)
+
+    debug "Executing#{check ? " check": ""} '#{sensitive ? '[redacted]' : command}'"
+
+    # Ruby 2.1 and later interrupt execution in a way that bypasses error
+    # handling by default. Passing Timeout::Error causes an exception to be
+    # raised that can be rescued inside of the block by cleanup routines.
+    #
+    # This is backwards compatible all the way to Ruby 1.8.7.
+    Timeout::timeout(resource[:timeout], Timeout::Error) do
+      cwd = resource[:cwd]
+      # It's ok if cwd is nil. In that case Puppet::Util::Execution.execute() simply will not attempt to
+      # change the working directory, which is exactly the right behavior when no cwd parameter is
+      # expressed on the resource.  Moreover, attempting to change to the directory that is already
+      # the working directory can fail under some circumstances, so avoiding the directory change attempt
+      # is preferable to defaulting cwd to that directory.
+
+      # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
+      # default/system locale will be respected.  Callers may override this behavior by setting locale-related
+      # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
+      output = Puppet::Util::Execution.execute(
+        command,
+        :failonfail => false,
+        :combine => true,
+        :cwd => cwd,
+        :uid => resource[:user], :gid => resource[:group],
+        :override_locale => false,
+        :custom_environment => environment(),
+        :sensitive => sensitive
+      )
+    end
+    # The shell returns 127 if the command is missing.
+    if output.exitstatus == 127
+      raise ArgumentError, output
+    end
+
+    # Return output twice as processstatus was returned before, but only exitstatus was ever called.
+    # Output has the exitstatus on it so it is returned instead. This is here twice as changing this
+    #  would result in a change to the underlying API.
+    return output, output
+  end
+
+  def extractexe(command)
+    if command.is_a? Array
+      command.first
+    else
+      match = /^"([^"]+)"|^'([^']+)'/.match(command)
+      if match
+        # extract whichever of the two sides matched the content.
+        match[1] or match[2]
+      else
+        command.split(/ /)[0]
+      end
+    end
+  end
+
+  def validatecmd(command)
+    exe = extractexe(command)
+    # if we're not fully qualified, require a path
+    self.fail _("'%{exe}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { exe: exe } if !absolute_path?(exe) and resource[:path].nil?
+  end
+end

data/lib/puppet/provider/file/posix.rb

@@ -0,0 +1,144 @@
+Puppet::Type.type(:file).provide :posix do
+  desc "Uses POSIX functionality to manage file ownership and permissions."
+
+  confine :feature => :posix
+  has_features :manages_symlinks
+
+  include Puppet::Util::POSIX
+  include Puppet::Util::Warnings
+
+  require 'etc'
+  require_relative '../../../puppet/util/selinux'
+
+  def self.post_resource_eval
+    Selinux.matchpathcon_fini if Puppet::Util::SELinux.selinux_support?
+  end
+
+  def uid2name(id)
+    return id.to_s if id.is_a?(Symbol) or id.is_a?(String)
+    return nil if id > Puppet[:maximum_uid].to_i
+
+    begin
+      user = Etc.getpwuid(id)
+    rescue TypeError, ArgumentError
+      return nil
+    end
+
+    if user.uid == ""
+      return nil
+    else
+      return user.name
+    end
+  end
+
+  # Determine if the user is valid, and if so, return the UID
+  def name2uid(value)
+    Integer(value) rescue uid(value) || false
+  end
+
+  def gid2name(id)
+    return id.to_s if id.is_a?(Symbol) or id.is_a?(String)
+    return nil if id > Puppet[:maximum_uid].to_i
+
+    begin
+      group = Etc.getgrgid(id)
+    rescue TypeError, ArgumentError
+      return nil
+    end
+
+    if group.gid == ""
+      return nil
+    else
+      return group.name
+    end
+  end
+
+  def name2gid(value)
+    Integer(value) rescue gid(value) || false
+  end
+
+  def owner
+    stat = resource.stat
+    unless stat
+      return :absent
+    end
+
+    currentvalue = stat.uid
+
+    # On OS X, files that are owned by -2 get returned as really
+    # large UIDs instead of negative ones.  This isn't a Ruby bug,
+    # it's an OS X bug, since it shows up in perl, too.
+    if currentvalue > Puppet[:maximum_uid].to_i
+      self.warning _("Apparently using negative UID (%{currentvalue}) on a platform that does not consistently handle them") % { currentvalue: currentvalue }
+      currentvalue = :silly
+    end
+
+    currentvalue
+  end
+
+  def owner=(should)
+    # Set our method appropriately, depending on links.
+    if resource[:links] == :manage
+      method = :lchown
+    else
+      method = :chown
+    end
+
+    begin
+      File.send(method, should, nil, resource[:path])
+    rescue => detail
+      raise Puppet::Error, _("Failed to set owner to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def group
+    stat = resource.stat
+    return :absent unless stat
+
+    currentvalue = stat.gid
+
+    # On OS X, files that are owned by -2 get returned as really
+    # large GIDs instead of negative ones.  This isn't a Ruby bug,
+    # it's an OS X bug, since it shows up in perl, too.
+    if currentvalue > Puppet[:maximum_uid].to_i
+      self.warning _("Apparently using negative GID (%{currentvalue}) on a platform that does not consistently handle them") % { currentvalue: currentvalue }
+      currentvalue = :silly
+    end
+
+    currentvalue
+  end
+
+  def group=(should)
+    # Set our method appropriately, depending on links.
+    if resource[:links] == :manage
+      method = :lchown
+    else
+      method = :chown
+    end
+
+    begin
+      File.send(method, nil, should, resource[:path])
+    rescue => detail
+      raise Puppet::Error, _("Failed to set group to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def mode
+    stat = resource.stat
+    if stat
+      return (stat.mode & 007777).to_s(8).rjust(4, '0')
+    else
+      return :absent
+    end
+  end
+
+  def mode=(value)
+    begin
+      File.chmod(value.to_i(8), resource[:path])
+    rescue => detail
+      error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
+      error.set_backtrace detail.backtrace
+      raise error
+    end
+  end
+end

data/lib/puppet/provider/file/windows.rb

@@ -0,0 +1,152 @@
+Puppet::Type.type(:file).provide :windows do
+  desc "Uses Microsoft Windows functionality to manage file ownership and permissions."
+
+  confine :operatingsystem => :windows
+  has_feature :manages_symlinks if Puppet.features.manages_symlinks?
+
+  include Puppet::Util::Warnings
+
+  if Puppet::Util::Platform.windows?
+    require_relative '../../../puppet/util/windows'
+    include Puppet::Util::Windows::Security
+  end
+
+  # Determine if the account is valid, and if so, return the UID
+  def name2id(value)
+    Puppet::Util::Windows::SID.name_to_sid(value)
+  end
+
+  # If it's a valid SID, get the name. Otherwise, it's already a name,
+  # so just return it.
+  def id2name(id)
+    if Puppet::Util::Windows::SID.valid_sid?(id)
+      Puppet::Util::Windows::SID.sid_to_name(id)
+    else
+      id
+    end
+  end
+
+  # We use users and groups interchangeably, so use the same methods for both
+  # (the type expects different methods, so we have to oblige).
+  alias :uid2name :id2name
+  alias :gid2name :id2name
+
+  alias :name2gid :name2id
+  alias :name2uid :name2id
+
+  def owner
+    return :absent unless resource.stat
+    get_owner(resource[:path])
+  end
+
+  def owner=(should)
+    begin
+      set_owner(should, resolved_path)
+    rescue => detail
+      raise Puppet::Error, _("Failed to set owner to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def group
+    return :absent unless resource.stat
+    get_group(resource[:path])
+  end
+
+  def group=(should)
+    begin
+      set_group(should, resolved_path)
+    rescue => detail
+      raise Puppet::Error, _("Failed to set group to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def mode
+    if resource.stat
+      mode = get_mode(resource[:path])
+      mode ? mode.to_s(8).rjust(4, '0') : :absent
+    else
+      :absent
+    end
+  end
+
+  def mode=(value)
+    begin
+      managing_owner = !resource[:owner].nil?
+      managing_group = !resource[:group].nil?
+      set_mode(value.to_i(8), resource[:path], true, managing_owner, managing_group)
+    rescue => detail
+      error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
+      error.set_backtrace detail.backtrace
+      raise error
+    end
+    :file_changed
+  end
+
+  def validate
+    if [:owner, :group, :mode].any?{|p| resource[p]} and !supports_acl?(resource[:path])
+      resource.fail(_("Can only manage owner, group, and mode on filesystems that support Windows ACLs, such as NTFS"))
+    end
+  end
+
+  # munge the windows group permissions if the user or group are set to SYSTEM
+  #
+  # when SYSTEM user is the group or user and the resoure is not managing them then treat
+  # the resource as insync if System has FullControl access.
+  #
+  # @param [String] current - the current mode returned by the resource
+  # @param [String] should  - what the mode should be
+  #
+  # @return [String, nil] munged mode or nil if the resource should be out of sync
+  def munge_windows_system_group(current, should)
+    [
+      {
+        'type'        => 'group',
+        'resource'    => resource[:group],
+        'set_to_user' => group,
+        'fullcontrol' => "070".to_i(8),
+        'remove_mask' => "707".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "070".to_i(8)),
+      },
+      {
+        'type'        => 'owner',
+        'resource'    => resource[:owner],
+        'set_to_user' => owner,
+        'fullcontrol' => "700".to_i(8),
+        'remove_mask' => "077".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "700".to_i(8)),
+      }
+    ].each do |mode_part|
+      if mode_part['resource'].nil? && (mode_part['set_to_user'] == Puppet::Util::Windows::SID::LocalSystem)
+        if (current.to_i(8) & mode_part['fullcontrol']) == mode_part['fullcontrol']
+          # Since the group is LocalSystem, and the permissions are FullControl,
+          # replace the value returned with the value expected. This will treat
+          # this specific situation as "insync"
+          current = ( (current.to_i(8) & mode_part['remove_mask']) | mode_part['should_mask'] ).to_s(8).rjust(4, '0')
+        else
+          # If the SYSTEM account does _not_ have FullControl in this scenario, we should
+          # force the resource out of sync no matter what.
+          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          Puppet.debug { _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type']} }
+          return nil
+        end
+      end
+    end
+    current
+  end
+
+  attr_reader :file
+  private
+  def file
+    @file ||= Puppet::FileSystem.pathname(resource[:path])
+  end
+
+  def resolved_path
+    path = file()
+    # under POSIX, :manage means use lchown - i.e. operate on the link
+    return path.to_s if resource[:links] == :manage
+
+    # otherwise, use chown -- that will resolve the link IFF it is a link
+    # otherwise it will operate on the path
+    Puppet::FileSystem.symlink?(path) ? Puppet::FileSystem.readlink(path) : path.to_s
+  end
+end

data/lib/puppet/provider/group/aix.rb

@@ -0,0 +1,99 @@
+# Group Puppet provider for AIX. It uses standard commands to manage groups:
+#  mkgroup, rmgroup, lsgroup, chgroup
+require_relative '../../../puppet/provider/aix_object'
+
+Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject do
+  desc "Group management for AIX."
+
+  # This will the default provider for this platform
+  defaultfor :operatingsystem => :aix
+  confine :operatingsystem => :aix
+
+  # Commands that manage the element
+  commands :list      => "/usr/sbin/lsgroup"
+  commands :add       => "/usr/bin/mkgroup"
+  commands :delete    => "/usr/sbin/rmgroup"
+  commands :modify    => "/usr/bin/chgroup"
+
+  # Provider features
+  has_features :manages_aix_lam
+  has_features :manages_members
+  has_features :manages_local_users_and_groups
+
+  class << self
+    # Used by the AIX user provider. Returns a hash of:
+    #   {
+    #     :name => <group_name>,
+    #     :gid  => <gid>
+    #   }
+    #
+    # that matches the group, which can either be the group name or
+    # the gid. Takes an optional set of ia_module_args
+    def find(group, ia_module_args = [])
+      groups = list_all(ia_module_args)
+
+      id_property = mappings[:puppet_property][:id]
+
+      if group.is_a?(String)
+        # Find by name
+        group_hash = groups.find { |cur_group| cur_group[:name] == group }
+      else
+        # Find by gid
+        group_hash = groups.find do |cur_group|
+          id_property.convert_attribute_value(cur_group[:id]) == group
+        end
+      end
+
+      unless group_hash
+        raise ArgumentError, _("No AIX group exists with a group name or gid of %{group}!") % { group: group }
+      end
+
+      # Convert :id => :gid
+      id = group_hash.delete(:id)
+      group_hash[:gid] = id_property.convert_attribute_value(id)
+
+      group_hash
+    end
+
+    # Define some Puppet Property => AIX Attribute (and vice versa)
+    # conversion functions here. This is so we can unit test them.
+
+    def members_to_users(provider, members)
+      members = members.split(',') if members.is_a?(String)
+      unless provider.resource[:auth_membership]
+        current_members = provider.members
+        current_members = [] if current_members == :absent
+        members = (members + current_members).uniq
+      end
+
+      members.join(',')
+    end
+
+    def users_to_members(users)
+      users.split(',')
+    end
+  end
+
+  mapping puppet_property: :members,
+          aix_attribute: :users,
+          property_to_attribute: method(:members_to_users),
+          attribute_to_property: method(:users_to_members)
+
+  numeric_mapping puppet_property: :gid,
+                  aix_attribute: :id
+
+  # Now that we have all of our mappings, let's go ahead and make
+  # the resource methods (property getters + setters for our mapped
+  # properties + a getter for the attributes property).
+  mk_resource_methods
+
+  # We could add this to the top-level members property since the
+  # implementation is not platform-specific; however, it is best
+  # to do it this way so that we do not accidentally break something.
+  # This is ok for now, since we do plan on moving this and the
+  # auth_membership management over to the property class in a future
+  # Puppet release.
+  def members_insync?(current, should)
+    current.sort == @resource.parameter(:members).actual_should(current, should)
+  end
+end

data/lib/puppet/provider/group/directoryservice.rb

@@ -0,0 +1,22 @@
+require_relative '../../../puppet/provider/nameservice/directoryservice'
+
+Puppet::Type.type(:group).provide :directoryservice, :parent => Puppet::Provider::NameService::DirectoryService do
+  desc "Group management using DirectoryService on OS X.
+
+  "
+
+  commands :dscl => "/usr/bin/dscl"
+  confine :operatingsystem => :darwin
+  defaultfor :operatingsystem => :darwin
+  has_feature :manages_members
+
+  def members_insync?(current, should)
+    return false unless current
+    if current == :absent
+      return should.empty?
+    else
+      return current.sort.uniq == should.sort.uniq
+    end
+  end
+
+end

data/lib/puppet/provider/group/groupadd.rb

@@ -0,0 +1,174 @@
+require_relative '../../../puppet/provider/nameservice/objectadd'
+require_relative '../../../puppet/util/libuser'
+
+Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameService::ObjectAdd do
+  desc "Group management via `groupadd` and its ilk. The default for most platforms.
+
+ To use the `forcelocal` parameter, you need to install the `libuser` package (providing
+  `/usr/sbin/lgroupadd` and `/usr/sbin/luseradd`)."
+
+  commands :add => "groupadd", :delete => "groupdel", :modify => "groupmod"
+
+  has_feature :system_groups unless %w{HP-UX Solaris}.include? Puppet.runtime[:facter].value(:operatingsystem)
+
+  verify :gid, _("GID must be an integer") do |value|
+    value.is_a? Integer
+  end
+
+  optional_commands :localadd => "lgroupadd", :localdelete => "lgroupdel", :localmodify => "lgroupmod", :purgemember => "usermod"
+
+  has_feature :manages_local_users_and_groups if Puppet.features.libuser?
+  has_feature :manages_members if Puppet.features.libuser? ||
+                                  (Puppet.runtime[:facter].value('os.name') == "Fedora" &&
+                                  Puppet.runtime[:facter].value('os.release.major').to_i >= 40)
+
+  # Libuser's modify command 'lgroupmod' requires '-M' flag for member additions.
+  # 'groupmod' command requires the '-aU' flags for it.
+  if Puppet.features.libuser?
+    options :members, :flag => '-M', :method => :mem
+  else
+    options :members, :flag => '-aU', :method => :mem
+  end
+
+  def exists?
+    return !!localgid if @resource.forcelocal?
+    super
+  end
+
+  def gid
+    return localgid if @resource.forcelocal?
+    get(:gid)
+  end
+
+  def localgid
+    group = findgroup(:group_name, resource[:name])
+    return group[:gid] if group
+    false
+  end
+
+  def check_allow_dup
+    # We have to manually check for duplicates when using libuser
+    # because by default duplicates are allowed.  This check is
+    # to ensure consistent behaviour of the useradd provider when
+    # using both useradd and luseradd
+    if not @resource.allowdupe? and @resource.forcelocal?
+       if @resource.should(:gid) and findgroup(:gid, @resource.should(:gid).to_s)
+           raise(Puppet::Error, _("GID %{resource} already exists, use allowdupe to force group creation") % { resource: @resource.should(:gid).to_s })
+       end
+    elsif @resource.allowdupe? and not @resource.forcelocal?
+       return ["-o"]
+    end
+    []
+  end
+
+  def create
+    super
+    set(:members, @resource[:members]) if @resource[:members]
+  end
+
+  def addcmd
+    # The localadd command (lgroupadd) must only be called when libuser is supported.
+    if Puppet.features.libuser? && @resource.forcelocal?
+      cmd = [command(:localadd)]
+      @custom_environment = Puppet::Util::Libuser.getenv
+    else
+      cmd = [command(:add)]
+    end
+
+    gid = @resource.should(:gid)
+    if gid
+      unless gid == :absent
+        cmd << flag(:gid) << gid
+      end
+    end
+    cmd += check_allow_dup
+    cmd << "-r" if @resource.system? and self.class.system_groups?
+    cmd << @resource[:name]
+    cmd
+  end
+
+  def validate_members(members)
+    members.each do |member|
+      member.split(',').each do |user|
+        Etc.getpwnam(user.strip)
+      end
+    end
+  end
+
+  def modifycmd(param, value)
+    # The localmodify command (lgroupmod) must only be called when libuser is supported.
+    if Puppet.features.libuser? && (@resource.forcelocal? || @resource[:members])
+      cmd = [command(:localmodify)]
+      @custom_environment = Puppet::Util::Libuser.getenv
+    else
+      cmd = [command(:modify)]
+    end
+
+    if param == :members
+      validate_members(value)
+      value = members_to_s(value)
+      purge_members if @resource[:auth_membership] && !members.empty?
+    end
+
+    cmd << flag(param) << value
+    # TODO the group type only really manages gid, so there are currently no
+    # tests for this behavior
+    cmd += check_allow_dup if param == :gid
+    cmd << @resource[:name]
+
+    cmd
+  end
+
+  def deletecmd
+    # The localdelete command (lgroupdel) must only be called when libuser is supported.
+    if Puppet.features.libuser? && @resource.forcelocal?
+      @custom_environment = Puppet::Util::Libuser.getenv
+      [command(:localdelete), @resource[:name]]
+    else
+      [command(:delete), @resource[:name]]
+    end
+  end
+
+  def members_insync?(current, should)
+    current.uniq.sort == @resource.parameter(:members).actual_should(current, should)
+  end
+
+  def members_to_s(current)
+    return '' if current.nil? || !current.kind_of?(Array)
+    current.join(',')
+  end
+
+  def purge_members
+    # The groupadd provider doesn't have the ability currently to remove members from a group, libuser does.
+    # Use libuser's lgroupmod command to achieve purging members if libuser is supported.
+    # Otherwise use the 'usermod' command.
+    if Puppet.features.libuser?
+      localmodify('-m', members_to_s(members), @resource.name)
+    else
+      members.each do |member|
+        purgemember('-rG', @resource.name, member)
+      end
+    end
+  end
+
+  private
+
+  def findgroup(key, value)
+    group_file = '/etc/group'
+    group_keys = [:group_name, :password, :gid, :user_list]
+
+    unless @groups
+      unless Puppet::FileSystem.exist?(group_file)
+        raise Puppet::Error.new("Forcelocal set for group resource '#{resource[:name]}', but #{group_file} does not exist")
+      end
+
+      @groups = []
+      Puppet::FileSystem.each_line(group_file) do |line|
+        group = line.chomp.split(':')
+        @groups << Hash[group_keys.zip(group)]
+      end
+    end
+
+    @groups.find { |param| param[key] == value } || false
+  end
+end