openvox 7.37.1

data/lib/puppet/util/rpm_compare.rb

@@ -0,0 +1,193 @@
+module Puppet::Util::RpmCompare
+
+  ARCH_LIST = %w(
+    noarch i386 i686 ppc ppc64 armv3l armv4b armv4l armv4tl armv5tel
+    armv5tejl armv6l armv7l m68kmint s390 s390x ia64 x86_64 sh3 sh4
+  ).freeze
+
+  ARCH_REGEX = Regexp.new(ARCH_LIST.join('|\.'))
+
+  # This is an attempt at implementing RPM's
+  # lib/rpmvercmp.c rpmvercmp(a, b) in Ruby.
+  #
+  # Some of the things in here look REALLY
+  # UGLY and/or arbitrary. Our goal is to
+  # match how RPM compares versions, quirks
+  # and all.
+  #
+  # I've kept a lot of C-like string processing
+  # in an effort to keep this as identical to RPM
+  # as possible.
+  #
+  # returns 1 if str1 is newer than str2,
+  #         0 if they are identical
+  #        -1 if str1 is older than str2
+  def rpmvercmp(str1, str2)
+    return 0 if str1 == str2
+
+    front_strip_re = /^[^A-Za-z0-9~]+/
+
+    while str1.length > 0 or str2.length > 0
+      # trim anything that's in front_strip_re and != '~' off the beginning of each string
+      str1 = str1.gsub(front_strip_re, '')
+      str2 = str2.gsub(front_strip_re, '')
+
+      # "handle the tilde separator, it sorts before everything else"
+      if str1 =~ /^~/ && str2 =~ /^~/
+        # if they both have ~, strip it
+        str1 = str1[1..-1]
+        str2 = str2[1..-1]
+        next
+      elsif str1 =~ /^~/
+        return -1
+      elsif str2 =~ /^~/
+        return 1
+      end
+
+      break if str1.length == 0 or str2.length == 0
+
+      # "grab first completely alpha or completely numeric segment"
+      isnum = false
+      # if the first char of str1 is a digit, grab the chunk of continuous digits from each string
+      if str1 =~ /^[0-9]+/
+        if str1 =~ /^[0-9]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[0-9]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+        isnum = true
+      # else grab the chunk of continuous alphas from each string (which may be '')
+      else
+        if str1 =~ /^[A-Za-z]+/
+          segment1 = $~.to_s
+          str1 = $~.post_match
+        else
+          segment1 = ''
+        end
+        if str2 =~ /^[A-Za-z]+/
+          segment2 = $~.to_s
+          str2 = $~.post_match
+        else
+          segment2 = ''
+        end
+      end
+
+      # if the segments we just grabbed from the strings are different types (i.e. one numeric one alpha),
+      # where alpha also includes ''; "numeric segments are always newer than alpha segments"
+      if segment2.length == 0
+        return 1 if isnum
+        return -1
+      end
+
+      if isnum
+        # "throw away any leading zeros - it's a number, right?"
+        segment1 = segment1.gsub(/^0+/, '')
+        segment2 = segment2.gsub(/^0+/, '')
+        # "whichever number has more digits wins"
+        return 1 if segment1.length > segment2.length
+        return -1 if segment1.length < segment2.length
+      end
+
+      # "strcmp will return which one is greater - even if the two segments are alpha
+      # or if they are numeric. don't return if they are equal because there might
+      # be more segments to compare"
+      rc = segment1 <=> segment2
+      return rc if rc != 0
+    end #end while loop
+
+    # if we haven't returned anything yet, "whichever version still has characters left over wins"
+    return 1 if str1.length > str2.length
+    return -1 if str1.length < str2.length
+    0
+  end
+
+  # parse a rpm "version" specification
+  # this re-implements rpm's
+  # rpmUtils.miscutils.stringToVersion() in ruby
+  def rpm_parse_evr(full_version)
+    epoch_index = full_version.index(':')
+    if epoch_index
+      epoch = full_version[0,epoch_index]
+      full_version = full_version[epoch_index+1,full_version.length]
+    else
+      epoch = nil
+    end
+    begin
+      epoch = String(Integer(epoch))
+    rescue
+      # If there are non-digits in the epoch field, default to nil
+      epoch = nil
+    end
+    release_index = full_version.index('-')
+    if release_index
+      version = full_version[0,release_index]
+      release = full_version[release_index+1,full_version.length]
+      arch = release.scan(ARCH_REGEX)[0]
+      if arch
+        architecture = arch.delete('.')
+        release.gsub!(ARCH_REGEX, '')
+      end
+    else
+      version = full_version
+      release = nil
+    end
+    return { :epoch => epoch, :version => version, :release => release, :arch => architecture }
+  end
+
+  # this method is a native implementation of the
+  # compare_values function in rpm's python bindings,
+  # found in python/header-py.c, as used by rpm.
+  def compare_values(s1, s2)
+    return 0 if s1.nil? && s2.nil?
+    return 1 if ( not s1.nil? ) && s2.nil?
+    return -1 if s1.nil? && (not s2.nil?)
+    return rpmvercmp(s1, s2)
+  end
+
+  # how rpm compares two package versions:
+  # rpmUtils.miscutils.compareEVR(), which massages data types and then calls
+  # rpm.labelCompare(), found in rpm.git/python/header-py.c, which
+  # sets epoch to 0 if null, then compares epoch, then ver, then rel
+  # using compare_values() and returns the first non-0 result, else 0.
+  # This function combines the logic of compareEVR() and labelCompare().
+  #
+  # "version_should" can be v, v-r, or e:v-r.
+  # "version_is" will always be at least v-r, can be e:v-r
+  #
+  # return 1: a is newer than b
+  #        0: a and b are the same version
+  #       -1: b is newer than a
+  def rpm_compareEVR(should, is)
+    # pass on to rpm labelCompare
+    should_hash = rpm_parse_evr(should)
+    is_hash = rpm_parse_evr(is)
+
+    if !should_hash[:epoch].nil?
+      rc = compare_values(should_hash[:epoch], is_hash[:epoch])
+      return rc unless rc == 0
+    end
+
+    rc = compare_values(should_hash[:version], is_hash[:version])
+    return rc unless rc == 0
+
+    # here is our special case, PUP-1244.
+    # if should_hash[:release] is nil (not specified by the user),
+    # and comparisons up to here are equal, return equal. We need to
+    # evaluate to whatever level of detail the user specified, so we
+    # don't end up upgrading or *downgrading* when not intended.
+    #
+    # This should NOT be triggered if we're trying to ensure latest.
+    return 0 if should_hash[:release].nil?
+
+    rc = compare_values(should_hash[:release], is_hash[:release])
+
+    return rc
+  end
+end

data/lib/puppet/util/rubygems.rb

@@ -0,0 +1,67 @@
+require_relative '../../puppet/util'
+
+module Puppet::Util::RubyGems
+
+  # Base/factory class for rubygems source. These classes introspec into
+  # rubygems to in order to list where the rubygems system will look for files
+  # to load.
+  class Source
+    class << self
+      # @api private
+      def has_rubygems?
+        # Gems are not actually available when Bundler is loaded, even
+        # though the Gem constant is defined. This is because Bundler
+        # loads in rubygems, but then removes the custom require that
+        # rubygems installs. So when Bundler is around we have to act
+        # as though rubygems is not, e.g. we shouldn't be able to load
+        # a gem that Bundler doesn't want us to see.
+        defined? ::Gem and not defined? ::Bundler
+      end
+
+      # @api private
+      def source
+        if has_rubygems?
+          Gems18Source
+        else
+          NoGemsSource
+        end
+      end
+
+      def new(*args)
+        object = source.allocate
+        object.send(:initialize, *args)
+        object
+      end
+    end
+  end
+
+  # For RubyGems >= 1.8.0
+  # @api private
+  class Gems18Source < Source
+    def directories
+      # `require 'mygem'` will consider and potentially load
+      # prerelease gems, so we need to match that behavior.
+      #
+      # Just load the stub which points to the gem path, and
+      # delay loading the full specification until if/when the
+      # gem is required.
+      Gem::Specification.stubs.collect do |spec|
+        File.join(spec.full_gem_path, 'lib')
+      end
+    end
+
+    def clear_paths
+      Gem.clear_paths
+    end
+  end
+
+  # @api private
+  class NoGemsSource < Source
+    def directories
+      []
+    end
+
+    def clear_paths; end
+  end
+end
+

data/lib/puppet/util/run_mode.rb

@@ -0,0 +1,122 @@
+require 'etc'
+
+module Puppet
+  module Util
+    class RunMode
+      def initialize(name)
+        @name = name.to_sym
+      end
+
+      attr :name
+
+      def self.[](name)
+        @run_modes ||= {}
+        if Puppet::Util::Platform.windows?
+          @run_modes[name] ||= WindowsRunMode.new(name)
+        else
+          @run_modes[name] ||= UnixRunMode.new(name)
+        end
+      end
+
+      def server?
+        name == :master || name == :server
+      end
+
+      def master?
+        name == :master || name == :server
+      end
+
+      def agent?
+        name == :agent
+      end
+
+      def user?
+        name == :user
+      end
+
+      def run_dir
+        RunMode[name].run_dir
+      end
+
+      def log_dir
+        RunMode[name].log_dir
+      end
+
+      private
+
+      ##
+      # select the system or the user directory depending on the context of
+      # this process.  The most common use is determining filesystem path
+      # values for confdir and vardir.  The intended semantics are:
+      # {https://projects.puppetlabs.com/issues/16637 #16637} for Puppet 3.x
+      #
+      # @todo this code duplicates {Puppet::Settings#which\_configuration\_file}
+      #   as described in {https://projects.puppetlabs.com/issues/16637 #16637}
+      def which_dir( system, user )
+        if Puppet.features.root?
+          File.expand_path(system)
+        else
+          File.expand_path(user)
+        end
+      end
+    end
+
+    class UnixRunMode < RunMode
+      def conf_dir
+        which_dir("/etc/puppetlabs/puppet", "~/.puppetlabs/etc/puppet")
+      end
+
+      def code_dir
+        which_dir("/etc/puppetlabs/code", "~/.puppetlabs/etc/code")
+      end
+
+      def var_dir
+        which_dir("/opt/puppetlabs/puppet/cache", "~/.puppetlabs/opt/puppet/cache")
+      end
+
+      def public_dir
+        which_dir("/opt/puppetlabs/puppet/public", "~/.puppetlabs/opt/puppet/public")
+      end
+
+      def run_dir
+        which_dir("/var/run/puppetlabs", "~/.puppetlabs/var/run")
+      end
+
+      def log_dir
+        which_dir("/var/log/puppetlabs/puppet", "~/.puppetlabs/var/log")
+      end
+    end
+
+    class WindowsRunMode < RunMode
+      def conf_dir
+        which_dir(File.join(windows_common_base("puppet/etc")), "~/.puppetlabs/etc/puppet")
+      end
+
+      def code_dir
+        which_dir(File.join(windows_common_base("code")), "~/.puppetlabs/etc/code")
+      end
+
+      def var_dir
+        which_dir(File.join(windows_common_base("puppet/cache")), "~/.puppetlabs/opt/puppet/cache")
+      end
+
+      def public_dir
+        which_dir(File.join(windows_common_base("puppet/public")), "~/.puppetlabs/opt/puppet/public")
+      end
+
+      def run_dir
+        which_dir(File.join(windows_common_base("puppet/var/run")), "~/.puppetlabs/var/run")
+      end
+
+      def log_dir
+        which_dir(File.join(windows_common_base("puppet/var/log")), "~/.puppetlabs/var/log")
+      end
+
+    private
+
+      def windows_common_base(*extra)
+        [ENV['ALLUSERSPROFILE'], "PuppetLabs"] + extra
+      end
+    end
+  end
+end

data/lib/puppet/util/selinux.rb

@@ -0,0 +1,297 @@
+# Provides utility functions to help interface Puppet to SELinux.
+#
+# This requires the very new SELinux Ruby bindings.  These bindings closely
+# mirror the SELinux C library interface.
+#
+# Support for the command line tools is not provided because the performance
+# was abysmal.  At this time (2008-11-02) the only distribution providing
+# these Ruby SELinux bindings which I am aware of is Fedora (in libselinux-ruby).
+
+Puppet.features.selinux? # check, but continue even if it's not
+
+require 'pathname'
+
+module Puppet::Util::SELinux
+
+  S_IFREG = 0100000
+  S_IFDIR = 0040000
+  S_IFLNK = 0120000
+
+  def self.selinux_support?
+    return false unless defined?(Selinux)
+    if Selinux.is_selinux_enabled == 1
+      return true
+    end
+    false
+  end
+
+  def selinux_support?
+    Puppet::Util::SELinux.selinux_support?
+  end
+
+  # Retrieve and return the full context of the file.  If we don't have
+  # SELinux support or if the SELinux call fails then return nil.
+  def get_selinux_current_context(file)
+    return nil unless selinux_support?
+    retval = Selinux.lgetfilecon(file)
+    if retval == -1
+      return nil
+    end
+    retval[1]
+  end
+
+  # Retrieve and return the default context of the file.  If we don't have
+  # SELinux support or if the SELinux call fails to file a default then return nil.
+  def get_selinux_default_context(file, resource_ensure=nil)
+    return nil unless selinux_support?
+    # If the filesystem has no support for SELinux labels, return a default of nil
+    # instead of what matchpathcon would return
+    return nil unless selinux_label_support?(file)
+    # If the file exists we should pass the mode to matchpathcon for the most specific
+    # matching.  If not, we can pass a mode of 0.
+    begin
+      filestat = file_lstat(file)
+      mode = filestat.mode
+    rescue Errno::EACCES
+      mode = 0
+    rescue Errno::ENOENT
+      if resource_ensure
+        mode = get_create_mode(resource_ensure)
+      else
+        mode = 0
+      end
+    end
+
+    retval = Selinux.matchpathcon(file, mode)
+    if retval == -1
+      return nil
+    end
+    retval[1]
+  end
+
+  # Take the full SELinux context returned from the tools and parse it
+  # out to the three (or four) component parts.  Supports :seluser, :selrole,
+  # :seltype, and on systems with range support, :selrange.
+  def parse_selinux_context(component, context)
+    if context.nil? or context == "unlabeled"
+      return nil
+    end
+    components = /^([^\s:]+):([^\s:]+):([^\s:]+)(?::([\sa-zA-Z0-9:,._-]+))?$/.match(context)
+    unless components
+      raise Puppet::Error, _("Invalid context to parse: %{context}") % { context: context }
+    end
+    case component
+    when :seluser
+      components[1]
+    when :selrole
+      components[2]
+    when :seltype
+      components[3]
+    when :selrange
+      components[4]
+    else
+      raise Puppet::Error, _("Invalid SELinux parameter type")
+    end
+  end
+
+  # This updates the actual SELinux label on the file.  You can update
+  # only a single component or update the entire context.
+  # The caveat is that since setting a partial context makes no sense the
+  # file has to already exist.  Puppet (via the File resource) will always
+  # just try to set components, even if all values are specified by the manifest.
+  # I believe that the OS should always provide at least a fall-through context
+  # though on any well-running system.
+  def set_selinux_context(file, value, component = false)
+    return nil unless selinux_support? && selinux_label_support?(file)
+
+    if component
+      # Must first get existing context to replace a single component
+      context = Selinux.lgetfilecon(file)[1]
+      if context == -1
+        # We can't set partial context components when no context exists
+        # unless/until we can find a way to make Puppet call this method
+        # once for all selinux file label attributes.
+        Puppet.warning _("Can't set SELinux context on file unless the file already has some kind of context")
+        return nil
+      end
+      context = context.split(':')
+      case component
+        when :seluser
+          context[0] = value
+        when :selrole
+          context[1] = value
+        when :seltype
+          context[2] = value
+        when :selrange
+          context[3] = value
+        else
+          raise ArgumentError, _("set_selinux_context component must be one of :seluser, :selrole, :seltype, or :selrange")
+      end
+      context = context.join(':')
+    else
+      context = value
+    end
+
+    retval = Selinux.lsetfilecon(file, context)
+    if retval == 0
+      return true
+    else
+      Puppet.warning _("Failed to set SELinux context %{context} on %{file}") % { context: context, file: file }
+      return false
+    end
+  end
+
+  # Since this call relies on get_selinux_default_context it also needs a
+  # full non-relative path to the file.  Fortunately, that seems to be all
+  # Puppet uses.  This will set the file's SELinux context to the policy's
+  # default context (if any) if it differs from the context currently on
+  # the file.
+  def set_selinux_default_context(file, resource_ensure=nil)
+    new_context = get_selinux_default_context(file, resource_ensure)
+    return nil unless new_context
+    cur_context = get_selinux_current_context(file)
+    if new_context != cur_context
+      set_selinux_context(file, new_context)
+      return new_context
+    end
+    nil
+  end
+
+  ##
+  # selinux_category_to_label is an internal method that converts all
+  # selinux categories to their internal representation, avoiding
+  # potential issues when mcstransd is not functional.
+  #
+  # It is not marked private because it is needed by File's
+  # selcontext.rb, but it is not intended for use outside of Puppet's
+  # code.
+  #
+  # @param category [String] An selinux category, such as "s0" or "SystemLow"
+  #
+  # @return [String] the numeric category name, such as "s0"
+  def selinux_category_to_label(category)
+    # We don't cache this, but there's already a ton of duplicate work
+    # in the selinux handling code.
+
+    path = Selinux.selinux_translations_path
+    begin
+      File.open(path).each do |line|
+        line.strip!
+        next if line.empty?
+        next if line[0] == "#" # skip comments
+        line.gsub!(/[[:space:]]+/m, '')
+        mapping = line.split("=", 2)
+        if category == mapping[1]
+          return mapping[0]
+        end
+      end
+    rescue SystemCallError => ex
+      log_exception(ex)
+      raise Puppet::Error, _("Could not open SELinux category translation file %{path}.") % { context: context }
+    end
+
+    category
+  end
+
+  ########################################################################
+  # Internal helper methods from here on in, kids.  Don't fiddle.
+  private
+
+  # Check filesystem a path resides on for SELinux support against
+  # whitelist of known-good filesystems.
+  # Returns true if the filesystem can support SELinux labels and
+  # false if not.
+  def selinux_label_support?(file)
+    fstype = find_fs(file)
+    return false if fstype.nil?
+    filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs', 'tmpfs', 'zfs']
+    filesystems.include?(fstype)
+  end
+
+  # Get mode file type bits set based on ensure on
+  # the file resource. This helps SELinux determine
+  # what context a new resource being created should have.
+  def get_create_mode(resource_ensure)
+    mode = 0
+    case resource_ensure
+    when :present, :file
+      mode |= S_IFREG
+    when :directory
+      mode |= S_IFDIR
+    when :link
+      mode |= S_IFLNK
+    end
+    mode
+  end
+
+  # Internal helper function to read and parse /proc/mounts
+  def read_mounts
+    mounts = ""
+    begin
+      if File.method_defined? "read_nonblock"
+        # If possible we use read_nonblock in a loop rather than read to work-
+        # a linux kernel bug.  See ticket #1963 for details.
+        mountfh = File.open("/proc/mounts")
+        loop do
+          mounts += mountfh.read_nonblock(1024)
+        end
+      else
+        # Otherwise we shell out and let cat do it for us
+        mountfh = IO.popen("/bin/cat /proc/mounts")
+        mounts = mountfh.read
+      end
+    rescue EOFError
+      # that's expected
+    rescue
+      return nil
+    ensure
+      mountfh.close if mountfh
+    end
+
+    mntpoint = {}
+
+    # Read all entries in /proc/mounts.  The second column is the
+    # mountpoint and the third column is the filesystem type.
+    # We skip rootfs because it is always mounted at /
+    mounts.each_line do |line|
+      params = line.split(' ')
+      next if params[2] == 'rootfs'
+      mntpoint[params[1]] = params[2]
+    end
+    mntpoint
+  end
+
+  # Internal helper function to return which type of filesystem a given file
+  # path resides on
+  def find_fs(path)
+    mounts = read_mounts
+    return nil unless mounts
+
+    # cleanpath eliminates useless parts of the path (like '.', or '..', or
+    # multiple slashes), without touching the filesystem, and without
+    # following symbolic links.  This gives the right (logical) tree to follow
+    # while we try and figure out what file-system the target lives on.
+    path = Pathname(path).cleanpath
+    unless path.absolute?
+      raise Puppet::DevError, _("got a relative path in SELinux find_fs: %{path}") % { path: path }
+    end
+
+    # Now, walk up the tree until we find a match for that path in the hash.
+    path.ascend do |segment|
+      return mounts[segment.to_s] if mounts.has_key?(segment.to_s)
+    end
+
+    # Should never be reached...
+    return mounts['/']
+  end
+
+  ##
+  # file_lstat is an internal, private method to allow precise stubbing and
+  # mocking without affecting the rest of the system.
+  #
+  # @return [File::Stat] File.lstat result
+  def file_lstat(path)
+    Puppet::FileSystem.lstat(path)
+  end
+  private :file_lstat
+end

data/lib/puppet/util/skip_tags.rb

@@ -0,0 +1,13 @@
+require_relative '../../puppet/util/tagging'
+
+class Puppet::Util::SkipTags
+  include Puppet::Util::Tagging
+
+  def initialize(stags)
+    self.tags = stags unless defined?(@tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+end