openvox 8.19.0

data/lib/puppet/provider/exec.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/provider'
+require_relative '../../puppet/util/execution'
+
+class Puppet::Provider::Exec < Puppet::Provider
+  include Puppet::Util::Execution
+
+  def environment
+    env = {}
+
+    if (path = resource[:path])
+      env[:PATH] = path.join(File::PATH_SEPARATOR)
+    end
+
+    return env unless (envlist = resource[:environment])
+
+    envlist = [envlist] unless envlist.is_a? Array
+    envlist.each do |setting|
+      unless (match = /^(\w+)=((.|\n)*)$/.match(setting))
+        warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
+        next
+      end
+      var = match[1]
+      value = match[2]
+
+      if env.include?(var) || env.include?(var.to_sym)
+        warning _("Overriding environment setting '%{var}' with '%{value}'") % { var: var, value: value }
+      end
+
+      if value.nil? || value.empty?
+        msg = _("Empty environment setting '%{var}'") % { var: var }
+        Puppet.warn_once('undefined_variables', "empty_env_var_#{var}", msg, resource.file, resource.line)
+      end
+
+      env[var] = value
+    end
+
+    env
+  end
+
+  def run(command, check = false)
+    output = nil
+    sensitive = resource.parameters[:command].sensitive
+
+    checkexe(command)
+
+    debug "Executing#{check ? ' check' : ''} '#{sensitive ? '[redacted]' : command}'"
+
+    # Ruby 2.1 and later interrupt execution in a way that bypasses error
+    # handling by default. Passing Timeout::Error causes an exception to be
+    # raised that can be rescued inside of the block by cleanup routines.
+    #
+    # This is backwards compatible all the way to Ruby 1.8.7.
+    Timeout.timeout(resource[:timeout], Timeout::Error) do
+      cwd = resource[:cwd]
+      # It's ok if cwd is nil. In that case Puppet::Util::Execution.execute() simply will not attempt to
+      # change the working directory, which is exactly the right behavior when no cwd parameter is
+      # expressed on the resource.  Moreover, attempting to change to the directory that is already
+      # the working directory can fail under some circumstances, so avoiding the directory change attempt
+      # is preferable to defaulting cwd to that directory.
+
+      # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
+      # default/system locale will be respected.  Callers may override this behavior by setting locale-related
+      # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
+      output = Puppet::Util::Execution.execute(
+        command,
+        :failonfail => false,
+        :combine => true,
+        :cwd => cwd,
+        :uid => resource[:user], :gid => resource[:group],
+        :override_locale => false,
+        :custom_environment => environment(),
+        :sensitive => sensitive
+      )
+    end
+    # The shell returns 127 if the command is missing.
+    if output.exitstatus == 127
+      raise ArgumentError, output
+    end
+
+    # Return output twice as processstatus was returned before, but only exitstatus was ever called.
+    # Output has the exitstatus on it so it is returned instead. This is here twice as changing this
+    #  would result in a change to the underlying API.
+    [output, output]
+  end
+
+  def extractexe(command)
+    if command.is_a? Array
+      command.first
+    else
+      match = /^"([^"]+)"|^'([^']+)'/.match(command)
+      if match
+        # extract whichever of the two sides matched the content.
+        match[1] or match[2]
+      else
+        command.split(/ /)[0]
+      end
+    end
+  end
+
+  def validatecmd(command)
+    exe = extractexe(command)
+    # if we're not fully qualified, require a path
+    self.fail _("'%{exe}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { exe: exe } if !absolute_path?(exe) and resource[:path].nil?
+  end
+end

data/lib/puppet/provider/file/posix.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+Puppet::Type.type(:file).provide :posix do
+  desc "Uses POSIX functionality to manage file ownership and permissions."
+
+  confine :feature => :posix
+  has_features :manages_symlinks
+
+  include Puppet::Util::POSIX
+  include Puppet::Util::Warnings
+
+  require 'etc'
+  require_relative '../../../puppet/util/selinux'
+
+  class << self
+    def selinux_handle
+      return nil unless Puppet::Util::SELinux.selinux_support?
+
+      # selabel_open takes 3 args: backend, options, and nopt. The backend param
+      # is a constant, SELABEL_CTX_FILE, which happens to be 0. Since options is
+      # nil, nopt can be 0 since nopt represents the # of options specified.
+      @selinux_handle ||= Selinux.selabel_open(Selinux::SELABEL_CTX_FILE, nil, 0)
+    end
+
+    def post_resource_eval
+      if @selinux_handle
+        Selinux.selabel_close(@selinux_handle)
+        @selinux_handle = nil
+      end
+    end
+  end
+
+  def uid2name(id)
+    return id.to_s if id.is_a?(Symbol) or id.is_a?(String)
+    return nil if id > Puppet[:maximum_uid].to_i
+
+    begin
+      user = Etc.getpwuid(id)
+    rescue TypeError, ArgumentError
+      return nil
+    end
+
+    if user.uid == ""
+      nil
+    else
+      user.name
+    end
+  end
+
+  # Determine if the user is valid, and if so, return the UID
+  def name2uid(value)
+    Integer(value)
+  rescue
+    uid(value) || false
+  end
+
+  def gid2name(id)
+    return id.to_s if id.is_a?(Symbol) or id.is_a?(String)
+    return nil if id > Puppet[:maximum_uid].to_i
+
+    begin
+      group = Etc.getgrgid(id)
+    rescue TypeError, ArgumentError
+      return nil
+    end
+
+    if group.gid == ""
+      nil
+    else
+      group.name
+    end
+  end
+
+  def name2gid(value)
+    Integer(value)
+  rescue
+    gid(value) || false
+  end
+
+  def owner
+    stat = resource.stat
+    unless stat
+      return :absent
+    end
+
+    currentvalue = stat.uid
+
+    # On OS X, files that are owned by -2 get returned as really
+    # large UIDs instead of negative ones.  This isn't a Ruby bug,
+    # it's an OS X bug, since it shows up in perl, too.
+    if currentvalue > Puppet[:maximum_uid].to_i
+      warning _("Apparently using negative UID (%{currentvalue}) on a platform that does not consistently handle them") % { currentvalue: currentvalue }
+      currentvalue = :silly
+    end
+
+    currentvalue
+  end
+
+  def owner=(should)
+    # Set our method appropriately, depending on links.
+    if resource[:links] == :manage
+      method = :lchown
+    else
+      method = :chown
+    end
+
+    begin
+      File.send(method, should, nil, resource[:path])
+    rescue => detail
+      raise Puppet::Error, _("Failed to set owner to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def group
+    stat = resource.stat
+    return :absent unless stat
+
+    currentvalue = stat.gid
+
+    # On OS X, files that are owned by -2 get returned as really
+    # large GIDs instead of negative ones.  This isn't a Ruby bug,
+    # it's an OS X bug, since it shows up in perl, too.
+    if currentvalue > Puppet[:maximum_uid].to_i
+      warning _("Apparently using negative GID (%{currentvalue}) on a platform that does not consistently handle them") % { currentvalue: currentvalue }
+      currentvalue = :silly
+    end
+
+    currentvalue
+  end
+
+  def group=(should)
+    # Set our method appropriately, depending on links.
+    if resource[:links] == :manage
+      method = :lchown
+    else
+      method = :chown
+    end
+
+    begin
+      File.send(method, nil, should, resource[:path])
+    rescue => detail
+      raise Puppet::Error, _("Failed to set group to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+    end
+  end
+
+  def mode
+    stat = resource.stat
+    if stat
+      (stat.mode & 0o07777).to_s(8).rjust(4, '0')
+    else
+      :absent
+    end
+  end
+
+  def mode=(value)
+    File.chmod(value.to_i(8), resource[:path])
+  rescue => detail
+    error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
+    error.set_backtrace detail.backtrace
+    raise error
+  end
+end

data/lib/puppet/provider/file/windows.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+Puppet::Type.type(:file).provide :windows do
+  desc "Uses Microsoft Windows functionality to manage file ownership and permissions."
+
+  confine 'os.name' => :windows
+  has_feature :manages_symlinks if Puppet.features.manages_symlinks?
+
+  include Puppet::Util::Warnings
+
+  if Puppet::Util::Platform.windows?
+    require_relative '../../../puppet/util/windows'
+    include Puppet::Util::Windows::Security
+  end
+
+  # Determine if the account is valid, and if so, return the UID
+  def name2id(value)
+    Puppet::Util::Windows::SID.name_to_sid(value)
+  end
+
+  # If it's a valid SID, get the name. Otherwise, it's already a name,
+  # so just return it.
+  def id2name(id)
+    if Puppet::Util::Windows::SID.valid_sid?(id)
+      Puppet::Util::Windows::SID.sid_to_name(id)
+    else
+      id
+    end
+  end
+
+  # We use users and groups interchangeably, so use the same methods for both
+  # (the type expects different methods, so we have to oblige).
+  alias :uid2name :id2name
+  alias :gid2name :id2name
+
+  alias :name2gid :name2id
+  alias :name2uid :name2id
+
+  def owner
+    return :absent unless resource.stat
+
+    get_owner(resource[:path])
+  end
+
+  def owner=(should)
+    set_owner(should, resolved_path)
+  rescue => detail
+    raise Puppet::Error, _("Failed to set owner to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+  end
+
+  def group
+    return :absent unless resource.stat
+
+    get_group(resource[:path])
+  end
+
+  def group=(should)
+    set_group(should, resolved_path)
+  rescue => detail
+    raise Puppet::Error, _("Failed to set group to '%{should}': %{detail}") % { should: should, detail: detail }, detail.backtrace
+  end
+
+  def mode
+    if resource.stat
+      mode = get_mode(resource[:path])
+      mode ? mode.to_s(8).rjust(4, '0') : :absent
+    else
+      :absent
+    end
+  end
+
+  def mode=(value)
+    managing_owner = !resource[:owner].nil?
+    managing_group = !resource[:group].nil?
+    set_mode(value.to_i(8), resource[:path], true, managing_owner, managing_group)
+  rescue => detail
+    error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
+    error.set_backtrace detail.backtrace
+    raise error
+  end
+
+  def validate
+    if [:owner, :group, :mode].any? { |p| resource[p] } and !supports_acl?(resource[:path])
+      resource.fail(_("Can only manage owner, group, and mode on filesystems that support Windows ACLs, such as NTFS"))
+    end
+  end
+
+  # munge the windows group permissions if the user or group are set to SYSTEM
+  #
+  # when SYSTEM user is the group or user and the resoure is not managing them then treat
+  # the resource as insync if System has FullControl access.
+  #
+  # @param [String] current - the current mode returned by the resource
+  # @param [String] should  - what the mode should be
+  #
+  # @return [String, nil] munged mode or nil if the resource should be out of sync
+  def munge_windows_system_group(current, should)
+    [
+      {
+        'type' => 'group',
+        'resource' => resource[:group],
+        'set_to_user' => group,
+        'fullcontrol' => "070".to_i(8),
+        'remove_mask' => "707".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "070".to_i(8)),
+      },
+      {
+        'type' => 'owner',
+        'resource' => resource[:owner],
+        'set_to_user' => owner,
+        'fullcontrol' => "700".to_i(8),
+        'remove_mask' => "077".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "700".to_i(8)),
+      }
+    ].each do |mode_part|
+      if mode_part['resource'].nil? && (mode_part['set_to_user'] == Puppet::Util::Windows::SID::LocalSystem)
+        if (current.to_i(8) & mode_part['fullcontrol']) == mode_part['fullcontrol']
+          # Since the group is LocalSystem, and the permissions are FullControl,
+          # replace the value returned with the value expected. This will treat
+          # this specific situation as "insync"
+          current = ((current.to_i(8) & mode_part['remove_mask']) | mode_part['should_mask']).to_s(8).rjust(4, '0')
+        else
+          # If the SYSTEM account does _not_ have FullControl in this scenario, we should
+          # force the resource out of sync no matter what.
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          Puppet.debug { _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type'] } }
+          return nil
+        end
+      end
+    end
+    current
+  end
+
+  attr_reader :file
+
+  private
+
+  def file
+    @file ||= Puppet::FileSystem.pathname(resource[:path])
+  end
+
+  def resolved_path
+    path = file()
+    # under POSIX, :manage means use lchown - i.e. operate on the link
+    return path.to_s if resource[:links] == :manage
+
+    # otherwise, use chown -- that will resolve the link IFF it is a link
+    # otherwise it will operate on the path
+    Puppet::FileSystem.symlink?(path) ? Puppet::FileSystem.readlink(path) : path.to_s
+  end
+end

data/lib/puppet/provider/group/aix.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+# Group Puppet provider for AIX. It uses standard commands to manage groups:
+#  mkgroup, rmgroup, lsgroup, chgroup
+require_relative '../../../puppet/provider/aix_object'
+
+Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject do
+  desc "Group management for AIX."
+
+  # This will the default provider for this platform
+  defaultfor 'os.name' => :aix
+  confine 'os.name' => :aix
+
+  # Commands that manage the element
+  commands :list      => "/usr/sbin/lsgroup"
+  commands :add       => "/usr/bin/mkgroup"
+  commands :delete    => "/usr/sbin/rmgroup"
+  commands :modify    => "/usr/bin/chgroup"
+
+  # Provider features
+  has_features :manages_aix_lam
+  has_features :manages_members
+  has_features :manages_local_users_and_groups
+
+  class << self
+    # Used by the AIX user provider. Returns a hash of:
+    #   {
+    #     :name => <group_name>,
+    #     :gid  => <gid>
+    #   }
+    #
+    # that matches the group, which can either be the group name or
+    # the gid. Takes an optional set of ia_module_args
+    def find(group, ia_module_args = [])
+      groups = list_all(ia_module_args)
+
+      id_property = mappings[:puppet_property][:id]
+
+      if group.is_a?(String)
+        # Find by name
+        group_hash = groups.find { |cur_group| cur_group[:name] == group }
+      else
+        # Find by gid
+        group_hash = groups.find do |cur_group|
+          id_property.convert_attribute_value(cur_group[:id]) == group
+        end
+      end
+
+      unless group_hash
+        raise ArgumentError, _("No AIX group exists with a group name or gid of %{group}!") % { group: group }
+      end
+
+      # Convert :id => :gid
+      id = group_hash.delete(:id)
+      group_hash[:gid] = id_property.convert_attribute_value(id)
+
+      group_hash
+    end
+
+    # Define some Puppet Property => AIX Attribute (and vice versa)
+    # conversion functions here. This is so we can unit test them.
+
+    def members_to_users(provider, members)
+      members = members.split(',') if members.is_a?(String)
+      unless provider.resource[:auth_membership]
+        current_members = provider.members
+        current_members = [] if current_members == :absent
+        members = (members + current_members).uniq
+      end
+
+      members.join(',')
+    end
+
+    def users_to_members(users)
+      users.split(',')
+    end
+  end
+
+  mapping puppet_property: :members,
+          aix_attribute: :users,
+          property_to_attribute: method(:members_to_users),
+          attribute_to_property: method(:users_to_members)
+
+  numeric_mapping puppet_property: :gid,
+                  aix_attribute: :id
+
+  # Now that we have all of our mappings, let's go ahead and make
+  # the resource methods (property getters + setters for our mapped
+  # properties + a getter for the attributes property).
+  mk_resource_methods
+
+  # We could add this to the top-level members property since the
+  # implementation is not platform-specific; however, it is best
+  # to do it this way so that we do not accidentally break something.
+  # This is ok for now, since we do plan on moving this and the
+  # auth_membership management over to the property class in a future
+  # Puppet release.
+  def members_insync?(current, should)
+    current.sort == @resource.parameter(:members).actual_should(current, should)
+  end
+end

data/lib/puppet/provider/group/directoryservice.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require_relative '../../../puppet/provider/nameservice/directoryservice'
+
+Puppet::Type.type(:group).provide :directoryservice, :parent => Puppet::Provider::NameService::DirectoryService do
+  desc "Group management using DirectoryService on OS X.
+
+  "
+
+  commands :dscl => "/usr/bin/dscl"
+  confine 'os.name' => :darwin
+  defaultfor 'os.name' => :darwin
+  has_feature :manages_members
+
+  def members_insync?(current, should)
+    return false unless current
+
+    if current == :absent
+      should.empty?
+    else
+      current.sort.uniq == should.sort.uniq
+    end
+  end
+end