openvox 8.19.0

data/lib/puppet/type/file/mode.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+# Manage file modes.  This state should support different formats
+# for specification (e.g., u+rwx, or -0011), but for now only supports
+# specifying the full mode.
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:mode) do
+    require_relative '../../../puppet/util/symbolic_file_mode'
+    include Puppet::Util::SymbolicFileMode
+
+    desc <<-'EOT'
+      The desired permissions mode for the file, in symbolic or numeric
+      notation. This value **must** be specified as a string; do not use
+      un-quoted numbers to represent file modes.
+
+      If the mode is omitted (or explicitly set to `undef`), Puppet does not
+      enforce permissions on existing files and creates new files with
+      permissions of `0644`.
+
+      The `file` type uses traditional Unix permission schemes and translates
+      them to equivalent permissions for systems which represent permissions
+      differently, including Windows. For detailed ACL controls on Windows,
+      you can leave `mode` unmanaged and use
+      [the puppetlabs/acl module.](https://forge.puppetlabs.com/puppetlabs/acl)
+
+      Numeric modes should use the standard octal notation of
+      `<SETUID/SETGID/STICKY><OWNER><GROUP><OTHER>` (for example, "0644").
+
+      * Each of the "owner," "group," and "other" digits should be a sum of the
+        permissions for that class of users, where read = 4, write = 2, and
+        execute/search = 1.
+      * The setuid/setgid/sticky digit is also a sum, where setuid = 4, setgid = 2,
+        and sticky = 1.
+      * The setuid/setgid/sticky digit is optional. If it is absent, Puppet will
+        clear any existing setuid/setgid/sticky permissions. (So to make your intent
+        clear, you should use at least four digits for numeric modes.)
+      * When specifying numeric permissions for directories, Puppet sets the search
+        permission wherever the read permission is set.
+
+      Symbolic modes should be represented as a string of comma-separated
+      permission clauses, in the form `<WHO><OP><PERM>`:
+
+      * "Who" should be any combination of u (user), g (group), and o (other), or a (all)
+      * "Op" should be = (set exact permissions), + (add select permissions),
+        or - (remove select permissions)
+      * "Perm" should be one or more of:
+          * r (read)
+          * w (write)
+          * x (execute/search)
+          * t (sticky)
+          * s (setuid/setgid)
+          * X (execute/search if directory or if any one user can execute)
+          * u (user's current permissions)
+          * g (group's current permissions)
+          * o (other's current permissions)
+
+      Thus, mode `"0664"` could be represented symbolically as either `a=r,ug+w`
+      or `ug=rw,o=r`.  However, symbolic modes are more expressive than numeric
+      modes: a mode only affects the specified bits, so `mode => 'ug+w'` will
+      set the user and group write bits, without affecting any other bits.
+
+      See the manual page for GNU or BSD `chmod` for more details
+      on numeric and symbolic modes.
+
+      On Windows, permissions are translated as follows:
+
+      * Owner and group names are mapped to Windows SIDs
+      * The "other" class of users maps to the "Everyone" SID
+      * The read/write/execute permissions map to the `FILE_GENERIC_READ`,
+        `FILE_GENERIC_WRITE`, and `FILE_GENERIC_EXECUTE` access rights; a
+        file's owner always has the `FULL_CONTROL` right
+      * "Other" users can't have any permissions a file's group lacks,
+        and its group can't have any permissions its owner lacks; that is, "0644"
+        is an acceptable mode, but "0464" is not.
+    EOT
+
+    validate do |value|
+      unless value.is_a?(String)
+        raise Puppet::Error, "The file mode specification must be a string, not '#{value.class.name}'"
+      end
+      unless value.nil? or valid_symbolic_mode?(value)
+        raise Puppet::Error, "The file mode specification is invalid: #{value.inspect}"
+      end
+    end
+
+    munge do |value|
+      return nil if value.nil?
+
+      unless valid_symbolic_mode?(value)
+        raise Puppet::Error, "The file mode specification is invalid: #{value.inspect}"
+      end
+
+      # normalizes to symbolic form, e.g. u+a, an octal string without leading 0
+      normalize_symbolic_mode(value)
+    end
+
+    unmunge do |value|
+      # return symbolic form or octal string *with* leading 0's
+      display_mode(value) if value
+    end
+
+    def desired_mode_from_current(desired, current)
+      current = current.to_i(8) if current.is_a? String
+      is_a_directory = @resource.stat && @resource.stat.directory?
+      symbolic_mode_to_int(desired, current, is_a_directory)
+    end
+
+    # If we're a directory, we need to be executable for all cases
+    # that are readable.  This should probably be selectable, but eh.
+    def dirmask(value)
+      if FileTest.directory?(resource[:path]) and value =~ /^\d+$/ then
+        value = value.to_i(8)
+        value |= 0o100 if value & 0o400 != 0
+        value |= 0o10 if value & 0o40 != 0
+        value |= 0o1 if value & 0o4 != 0
+        value = value.to_s(8)
+      end
+
+      value
+    end
+
+    # If we're not following links and we're a link, then we just turn
+    # off mode management entirely.
+    def insync?(currentvalue)
+      if provider.respond_to?(:munge_windows_system_group)
+        munged_mode = provider.munge_windows_system_group(currentvalue, @should)
+        return false if munged_mode.nil?
+
+        currentvalue = munged_mode
+      end
+      stat = @resource.stat
+      if stat && stat.ftype == "link" && @resource[:links] != :follow
+        debug _("Not managing symlink mode")
+        true
+      else
+        super(currentvalue)
+      end
+    end
+
+    def property_matches?(current, desired)
+      return false unless current
+
+      current_bits = normalize_symbolic_mode(current)
+      desired_bits = desired_mode_from_current(desired, current).to_s(8)
+      current_bits == desired_bits
+    end
+
+    # Ideally, dirmask'ing could be done at munge time, but we don't know if 'ensure'
+    # will eventually be a directory or something else. And unfortunately, that logic
+    # depends on the ensure, source, and target properties. So rather than duplicate
+    # that logic, and get it wrong, we do dirmask during retrieve, after 'ensure' has
+    # been synced.
+    def retrieve
+      if @resource.stat
+        @should &&= @should.collect { |s| dirmask(s) }
+      end
+
+      super
+    end
+
+    # Finally, when we sync the mode out we need to transform it; since we
+    # don't have access to the calculated "desired" value here, or the
+    # "current" value, only the "should" value we need to retrieve again.
+    def sync
+      current = @resource.stat ? @resource.stat.mode : 0o644
+      set(desired_mode_from_current(@should[0], current).to_s(8))
+    end
+
+    def change_to_s(old_value, desired)
+      return super if desired =~ /^\d+$/
+
+      old_bits = normalize_symbolic_mode(old_value)
+      new_bits = normalize_symbolic_mode(desired_mode_from_current(desired, old_bits))
+      super(old_bits, new_bits) + " (#{desired})"
+    end
+
+    def should_to_s(should_value)
+      "'#{should_value.rjust(4, '0')}'"
+    end
+
+    def is_to_s(currentvalue) # rubocop:disable Naming/PredicateName
+      if currentvalue == :absent
+        # This can occur during audits---if a file is transitioning from
+        # present to absent the mode will have a value of `:absent`.
+        super
+      else
+        "'#{currentvalue.rjust(4, '0')}'"
+      end
+    end
+  end
+end

data/lib/puppet/type/file/mtime.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:mtime) do
+    desc "A read-only state to check the file mtime. On \*nix-like systems, this
+      is the time of the most recent change to the content of the file."
+
+    def retrieve
+      current_value = :absent
+      stat = @resource.stat
+      if stat
+        current_value = stat.mtime
+      end
+      current_value.to_s
+    end
+
+    validate do |_val|
+      fail "mtime is read-only"
+    end
+  end
+end

data/lib/puppet/type/file/owner.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Puppet
+  Puppet::Type.type(:file).newproperty(:owner) do
+    include Puppet::Util::Warnings
+
+    desc <<-EOT
+      The user to whom the file should belong.  Argument can be a user name or a
+      user ID.
+
+      On Windows, a group (such as "Administrators") can be set as a file's owner
+      and a user (such as "Administrator") can be set as a file's group; however,
+      a file's owner and group shouldn't be the same. (If the owner is also
+      the group, files with modes like `"0640"` will cause log churn, as they
+      will always appear out of sync.)
+    EOT
+
+    def insync?(current)
+      # We don't want to validate/munge users until we actually start to
+      # evaluate this property, because they might be added during the catalog
+      # apply.
+      @should.map! do |val|
+        uid = provider.name2uid(val)
+        if uid
+          uid
+        elsif provider.resource.noop?
+          return false
+        else
+          raise "Could not find user #{val}"
+        end
+      end
+
+      return true if @should.include?(current)
+
+      unless Puppet.features.root?
+        warnonce "Cannot manage ownership unless running as root"
+        return true
+      end
+
+      false
+    end
+
+    # We want to print names, not numbers
+    def is_to_s(currentvalue) # rubocop:disable Naming/PredicateName
+      super(provider.uid2name(currentvalue) || currentvalue)
+    end
+
+    def should_to_s(newvalue)
+      super(provider.uid2name(newvalue) || newvalue)
+    end
+  end
+end

data/lib/puppet/type/file/selcontext.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+# Manage SELinux context of files.
+#
+# This code actually manages three pieces of data in the context.
+#
+# [root@delenn files]# ls -dZ /
+# drwxr-xr-x  root root system_u:object_r:root_t         /
+#
+# The context of '/' here is 'system_u:object_r:root_t'.  This is
+# three separate fields:
+#
+# system_u is the user context
+# object_r is the role context
+# root_t is the type context
+#
+# All three of these fields are returned in a single string by the
+# output of the stat command, but set individually with the chcon
+# command.  This allows the user to specify a subset of the three
+# values while leaving the others alone.
+#
+# See https://www.nsa.gov/selinux/ for complete docs on SELinux.
+
+module Puppet
+  require_relative '../../../puppet/util/selinux'
+
+  class SELFileContext < Puppet::Property
+    include Puppet::Util::SELinux
+
+    def retrieve
+      return :absent unless @resource.stat
+
+      context = get_selinux_current_context(@resource[:path])
+      is = parse_selinux_context(name, context)
+      if name == :selrange and selinux_support?
+        selinux_category_to_label(is)
+      else
+        is
+      end
+    end
+
+    def retrieve_default_context(property)
+      return nil if Puppet::Util::Platform.windows?
+      if @resource[:selinux_ignore_defaults] == :true
+        return nil
+      end
+
+      context = get_selinux_default_context_with_handle(@resource[:path], provider.class.selinux_handle, @resource[:ensure])
+      unless context
+        return nil
+      end
+
+      property_default = parse_selinux_context(property, context)
+      debug "Found #{property} default '#{property_default}' for #{@resource[:path]}" unless property_default.nil?
+      property_default
+    end
+
+    def insync?(value)
+      if !selinux_support?
+        debug("SELinux bindings not found. Ignoring parameter.")
+        true
+      elsif !selinux_label_support?(@resource[:path])
+        debug("SELinux not available for this filesystem. Ignoring parameter.")
+        true
+      else
+        super
+      end
+    end
+
+    def unsafe_munge(should)
+      unless selinux_support?
+        return should
+      end
+
+      if name == :selrange
+        selinux_category_to_label(should)
+      else
+        should
+      end
+    end
+
+    def sync
+      set_selinux_context(@resource[:path], @should, name)
+      :file_changed
+    end
+  end
+
+  Puppet::Type.type(:file).newparam(:selinux_ignore_defaults) do
+    desc "If this is set, Puppet will not call the SELinux function selabel_lookup to
+      supply defaults for the SELinux attributes (seluser, selrole,
+      seltype, and selrange). In general, you should leave this set at its
+      default and only set it to true when you need Puppet to not try to fix
+      SELinux labels automatically."
+    newvalues(:true, :false)
+
+    defaultto :false
+  end
+
+  Puppet::Type.type(:file).newproperty(:seluser, :parent => Puppet::SELFileContext) do
+    desc "What the SELinux user component of the context of the file should be.
+      Any valid SELinux user component is accepted.  For example `user_u`.
+      If not specified, it defaults to the value returned by selabel_lookup for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    @event = :file_changed
+    defaultto { retrieve_default_context(:seluser) }
+  end
+
+  Puppet::Type.type(:file).newproperty(:selrole, :parent => Puppet::SELFileContext) do
+    desc "What the SELinux role component of the context of the file should be.
+      Any valid SELinux role component is accepted.  For example `role_r`.
+      If not specified, it defaults to the value returned by selabel_lookup for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    @event = :file_changed
+    defaultto { retrieve_default_context(:selrole) }
+  end
+
+  Puppet::Type.type(:file).newproperty(:seltype, :parent => Puppet::SELFileContext) do
+    desc "What the SELinux type component of the context of the file should be.
+      Any valid SELinux type component is accepted.  For example `tmp_t`.
+      If not specified, it defaults to the value returned by selabel_lookup for
+      the file, if any exists.  Only valid on systems with SELinux support
+      enabled."
+
+    @event = :file_changed
+    defaultto { retrieve_default_context(:seltype) }
+  end
+
+  Puppet::Type.type(:file).newproperty(:selrange, :parent => Puppet::SELFileContext) do
+    desc "What the SELinux range component of the context of the file should be.
+      Any valid SELinux range component is accepted.  For example `s0` or
+      `SystemHigh`.  If not specified, it defaults to the value returned by
+      selabel_lookup for the file, if any exists.  Only valid on systems with
+      SELinux support enabled and that have support for MCS (Multi-Category
+      Security)."
+
+    @event = :file_changed
+    defaultto { retrieve_default_context(:selrange) }
+  end
+end