openvox 8.19.0

data/lib/puppet/util/selinux.rb

@@ -0,0 +1,331 @@
+# frozen_string_literal: true
+
+# Provides utility functions to help interface Puppet to SELinux.
+#
+# This requires the very new SELinux Ruby bindings.  These bindings closely
+# mirror the SELinux C library interface.
+#
+# Support for the command line tools is not provided because the performance
+# was abysmal.  At this time (2008-11-02) the only distribution providing
+# these Ruby SELinux bindings which I am aware of is Fedora (in libselinux-ruby).
+
+Puppet.features.selinux? # check, but continue even if it's not
+
+require 'pathname'
+
+module Puppet::Util::SELinux
+  S_IFREG = 0o100000
+  S_IFDIR = 0o040000
+  S_IFLNK = 0o120000
+
+  def self.selinux_support?
+    return false unless defined?(Selinux)
+    if Selinux.is_selinux_enabled == 1
+      return true
+    end
+
+    false
+  end
+
+  def selinux_support?
+    Puppet::Util::SELinux.selinux_support?
+  end
+
+  # Retrieve and return the full context of the file.  If we don't have
+  # SELinux support or if the SELinux call fails then return nil.
+  def get_selinux_current_context(file)
+    return nil unless selinux_support?
+
+    retval = Selinux.lgetfilecon(file)
+    if retval == -1
+      return nil
+    end
+
+    retval[1]
+  end
+
+  # Retrieve and return the default context of the file.  If we don't have
+  # SELinux support or if the SELinux call fails to file a default then return nil.
+  # @deprecated matchpathcon is a deprecated method, selabel_lookup is preferred
+  def get_selinux_default_context(file, resource_ensure = nil)
+    return nil unless selinux_support?
+    # If the filesystem has no support for SELinux labels, return a default of nil
+    # instead of what matchpathcon would return
+    return nil unless selinux_label_support?(file)
+
+    # If the file exists we should pass the mode to matchpathcon for the most specific
+    # matching.  If not, we can pass a mode of 0.
+    mode = file_mode(file, resource_ensure)
+
+    retval = Selinux.matchpathcon(file, mode)
+    retval == -1 ? nil : retval[1]
+  end
+
+  # Retrieve and return the default context of the file using an selinux handle.
+  # If we don't have SELinux support or if the SELinux call fails to file a
+  # default then return nil.
+  def get_selinux_default_context_with_handle(file, handle, resource_ensure = nil)
+    return nil unless selinux_support?
+    # If the filesystem has no support for SELinux labels, return a default of nil
+    # instead of what selabel_lookup would return
+    return nil unless selinux_label_support?(file)
+
+    # Handle is needed for selabel_lookup
+    raise ArgumentError, _("Cannot get default context with nil handle") unless handle
+
+    # If the file exists we should pass the mode to selabel_lookup for the most specific
+    # matching.  If not, we can pass a mode of 0.
+    mode = file_mode(file, resource_ensure)
+
+    retval = Selinux.selabel_lookup(handle, file, mode)
+    retval == -1 ? nil : retval[1]
+  end
+
+  # Take the full SELinux context returned from the tools and parse it
+  # out to the three (or four) component parts.  Supports :seluser, :selrole,
+  # :seltype, and on systems with range support, :selrange.
+  def parse_selinux_context(component, context)
+    if context.nil? or context == "unlabeled"
+      return nil
+    end
+
+    components = /^([^\s:]+):([^\s:]+):([^\s:]+)(?::([\sa-zA-Z0-9:,._-]+))?$/.match(context)
+    unless components
+      raise Puppet::Error, _("Invalid context to parse: %{context}") % { context: context }
+    end
+
+    case component
+    when :seluser
+      components[1]
+    when :selrole
+      components[2]
+    when :seltype
+      components[3]
+    when :selrange
+      components[4]
+    else
+      raise Puppet::Error, _("Invalid SELinux parameter type")
+    end
+  end
+
+  # This updates the actual SELinux label on the file.  You can update
+  # only a single component or update the entire context.
+  # The caveat is that since setting a partial context makes no sense the
+  # file has to already exist.  Puppet (via the File resource) will always
+  # just try to set components, even if all values are specified by the manifest.
+  # I believe that the OS should always provide at least a fall-through context
+  # though on any well-running system.
+  def set_selinux_context(file, value, component = false)
+    return nil unless selinux_support? && selinux_label_support?(file)
+
+    if component
+      # Must first get existing context to replace a single component
+      context = Selinux.lgetfilecon(file)[1]
+      if context == -1
+        # We can't set partial context components when no context exists
+        # unless/until we can find a way to make Puppet call this method
+        # once for all selinux file label attributes.
+        Puppet.warning _("Can't set SELinux context on file unless the file already has some kind of context")
+        return nil
+      end
+      context = context.split(':')
+      case component
+      when :seluser
+        context[0] = value
+      when :selrole
+        context[1] = value
+      when :seltype
+        context[2] = value
+      when :selrange
+        context[3] = value
+      else
+        raise ArgumentError, _("set_selinux_context component must be one of :seluser, :selrole, :seltype, or :selrange")
+      end
+      context = context.join(':')
+    else
+      context = value
+    end
+
+    retval = Selinux.lsetfilecon(file, context)
+    if retval == 0
+      true
+    else
+      Puppet.warning _("Failed to set SELinux context %{context} on %{file}") % { context: context, file: file }
+      false
+    end
+  end
+
+  # Since this call relies on get_selinux_default_context it also needs a
+  # full non-relative path to the file.  Fortunately, that seems to be all
+  # Puppet uses.  This will set the file's SELinux context to the policy's
+  # default context (if any) if it differs from the context currently on
+  # the file.
+  def set_selinux_default_context(file, resource_ensure = nil)
+    new_context = get_selinux_default_context(file, resource_ensure)
+    return nil unless new_context
+
+    cur_context = get_selinux_current_context(file)
+    if new_context != cur_context
+      set_selinux_context(file, new_context)
+      return new_context
+    end
+    nil
+  end
+
+  ##
+  # selinux_category_to_label is an internal method that converts all
+  # selinux categories to their internal representation, avoiding
+  # potential issues when mcstransd is not functional.
+  #
+  # It is not marked private because it is needed by File's
+  # selcontext.rb, but it is not intended for use outside of Puppet's
+  # code.
+  #
+  # @param category [String] An selinux category, such as "s0" or "SystemLow"
+  #
+  # @return [String] the numeric category name, such as "s0"
+  def selinux_category_to_label(category)
+    # We don't cache this, but there's already a ton of duplicate work
+    # in the selinux handling code.
+
+    path = Selinux.selinux_translations_path
+    begin
+      File.open(path).each do |line|
+        line.strip!
+        next if line.empty?
+        next if line[0] == "#" # skip comments
+
+        line.gsub!(/[[:space:]]+/m, '')
+        mapping = line.split("=", 2)
+        if category == mapping[1]
+          return mapping[0]
+        end
+      end
+    rescue SystemCallError => ex
+      log_exception(ex)
+      raise Puppet::Error, _("Could not open SELinux category translation file %{path}.") % { context: context }
+    end
+
+    category
+  end
+
+  ########################################################################
+  # Internal helper methods from here on in, kids.  Don't fiddle.
+  private
+
+  # Check filesystem a path resides on for SELinux support against
+  # whitelist of known-good filesystems.
+  # Returns true if the filesystem can support SELinux labels and
+  # false if not.
+  def selinux_label_support?(file)
+    fstype = find_fs(file)
+    return false if fstype.nil?
+
+    filesystems = %w[ext2 ext3 ext4 gfs gfs2 xfs jfs btrfs tmpfs zfs]
+    filesystems.include?(fstype)
+  end
+
+  # Get mode file type bits set based on ensure on
+  # the file resource. This helps SELinux determine
+  # what context a new resource being created should have.
+  def get_create_mode(resource_ensure)
+    mode = 0
+    case resource_ensure
+    when :present, :file
+      mode |= S_IFREG
+    when :directory
+      mode |= S_IFDIR
+    when :link
+      mode |= S_IFLNK
+    end
+    mode
+  end
+
+  # If the file/directory/symlink exists, return its mode. Otherwise, get the default mode
+  # that should be used to create the file/directory/symlink taking into account the desired
+  # file type specified in +resource_ensure+.
+  def file_mode(file, resource_ensure)
+    filestat = file_lstat(file)
+    filestat.mode
+  rescue Errno::EACCES
+    0
+  rescue Errno::ENOENT
+    if resource_ensure
+      get_create_mode(resource_ensure)
+    else
+      0
+    end
+  end
+
+  # Internal helper function to read and parse /proc/mounts
+  def read_mounts
+    mounts = ''.dup
+    begin
+      if File.method_defined? "read_nonblock"
+        # If possible we use read_nonblock in a loop rather than read to work-
+        # a linux kernel bug.  See ticket #1963 for details.
+        mountfh = File.new("/proc/mounts")
+        loop do
+          mounts += mountfh.read_nonblock(1024)
+        end
+      else
+        # Otherwise we shell out and let cat do it for us
+        mountfh = IO.popen("/bin/cat /proc/mounts")
+        mounts = mountfh.read
+      end
+    rescue EOFError
+      # that's expected
+    rescue
+      return nil
+    ensure
+      mountfh.close if mountfh
+    end
+
+    mntpoint = {}
+
+    # Read all entries in /proc/mounts.  The second column is the
+    # mountpoint and the third column is the filesystem type.
+    # We skip rootfs because it is always mounted at /
+    mounts.each_line do |line|
+      params = line.split(' ')
+      next if params[2] == 'rootfs'
+
+      mntpoint[params[1]] = params[2]
+    end
+    mntpoint
+  end
+
+  # Internal helper function to return which type of filesystem a given file
+  # path resides on
+  def find_fs(path)
+    mounts = read_mounts
+    return nil unless mounts
+
+    # cleanpath eliminates useless parts of the path (like '.', or '..', or
+    # multiple slashes), without touching the filesystem, and without
+    # following symbolic links.  This gives the right (logical) tree to follow
+    # while we try and figure out what file-system the target lives on.
+    path = Pathname(path).cleanpath
+    unless path.absolute?
+      raise Puppet::DevError, _("got a relative path in SELinux find_fs: %{path}") % { path: path }
+    end
+
+    # Now, walk up the tree until we find a match for that path in the hash.
+    path.ascend do |segment|
+      return mounts[segment.to_s] if mounts.has_key?(segment.to_s)
+    end
+
+    # Should never be reached...
+    mounts['/']
+  end
+
+  ##
+  # file_lstat is an internal, private method to allow precise stubbing and
+  # mocking without affecting the rest of the system.
+  #
+  # @return [File::Stat] File.lstat result
+  def file_lstat(path)
+    Puppet::FileSystem.lstat(path)
+  end
+  private :file_lstat
+end

data/lib/puppet/util/skip_tags.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/util/tagging'
+
+class Puppet::Util::SkipTags
+  include Puppet::Util::Tagging
+
+  def initialize(stags)
+    self.tags = stags unless defined?(@tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+end

data/lib/puppet/util/splayer.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Handle splay options (sleeping for a random interval before executing)
+module Puppet::Util::Splayer
+  # Have we splayed already?
+  def splayed?
+    !!@splayed
+  end
+
+  # Sleep when splay is enabled; else just return.
+  def splay(do_splay = Puppet[:splay])
+    return unless do_splay
+    return if splayed?
+
+    time = rand(Puppet[:splaylimit] + 1)
+    Puppet.info _("Sleeping for %{time} seconds (splay is enabled)") % { time: time }
+    sleep(time)
+    @splayed = true
+  end
+end

data/lib/puppet/util/storage.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require 'yaml'
+require 'singleton'
+require_relative '../../puppet/util/yaml'
+
+# a class for storing state
+class Puppet::Util::Storage
+  include Singleton
+  include Puppet::Util
+
+  def self.state
+    @@state
+  end
+
+  def initialize
+    self.class.load
+  end
+
+  # Return a hash that will be stored to disk.  It's worth noting
+  # here that we use the object's full path, not just the name/type
+  # combination.  At the least, this is useful for those non-isomorphic
+  # types like exec, but it also means that if an object changes locations
+  # in the configuration it will lose its cache.
+  def self.cache(object)
+    if object.is_a?(Symbol)
+      name = object
+    else
+      name = object.to_s
+    end
+
+    @@state[name] ||= {}
+  end
+
+  def self.clear
+    @@state.clear
+  end
+
+  def self.init
+    @@state = {}
+  end
+
+  init
+
+  def self.load
+    Puppet.settings.use(:main) unless FileTest.directory?(Puppet[:statedir])
+    filename = Puppet[:statefile]
+
+    unless Puppet::FileSystem.exist?(filename)
+      init if @@state.nil?
+      return
+    end
+    unless File.file?(filename)
+      Puppet.warning(_("Checksumfile %{filename} is not a file, ignoring") % { filename: filename })
+      return
+    end
+    Puppet::Util.benchmark(:debug, "Loaded state in %{seconds} seconds") do
+      @@state = Puppet::Util::Yaml.safe_load_file(filename, [Symbol, Time])
+    rescue Puppet::Util::Yaml::YamlLoadError => detail
+      Puppet.err _("Checksumfile %{filename} is corrupt (%{detail}); replacing") % { filename: filename, detail: detail }
+
+      begin
+        File.rename(filename, filename + ".bad")
+      rescue
+        raise Puppet::Error, _("Could not rename corrupt %{filename}; remove manually") % { filename: filename }, detail.backtrace
+      end
+    end
+
+    unless @@state.is_a?(Hash)
+      Puppet.err _("State got corrupted")
+      init
+    end
+  end
+
+  def self.stateinspect
+    @@state.inspect
+  end
+
+  def self.store
+    Puppet.debug "Storing state"
+
+    Puppet.info _("Creating state file %{file}") % { file: Puppet[:statefile] } unless Puppet::FileSystem.exist?(Puppet[:statefile])
+
+    if Puppet[:statettl] == 0 || Puppet[:statettl] == Float::INFINITY
+      Puppet.debug "Not pruning old state cache entries"
+    else
+      Puppet::Util.benchmark(:debug, "Pruned old state cache entries in %{seconds} seconds") do
+        ttl_cutoff = Time.now - Puppet[:statettl]
+
+        @@state.reject! do |k, _v|
+          @@state[k][:checked] && @@state[k][:checked] < ttl_cutoff
+        end
+      end
+    end
+
+    Puppet::Util.benchmark(:debug, "Stored state in %{seconds} seconds") do
+      Puppet::Util::Yaml.dump(@@state, Puppet[:statefile])
+    end
+  end
+end

data/lib/puppet/util/suidmanager.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/util/warnings'
+require 'forwardable'
+require 'etc'
+
+module Puppet::Util::SUIDManager
+  include Puppet::Util::Warnings
+  extend Forwardable
+
+  # Note groups= is handled specially due to a bug in OS X 10.6, 10.7,
+  # and probably upcoming releases...
+  to_delegate_to_process = [:euid=, :euid, :egid=, :egid, :uid=, :uid, :gid=, :gid, :groups]
+
+  to_delegate_to_process.each do |method|
+    def_delegator Process, method
+    module_function method
+  end
+
+  def osx_maj_ver
+    return @osx_maj_ver unless @osx_maj_ver.nil?
+
+    @osx_maj_ver = Puppet.runtime[:facter].value('os.macosx.version.major') || false
+  end
+  module_function :osx_maj_ver
+
+  def groups=(grouplist)
+    Process.groups = grouplist
+  rescue Errno::EINVAL => e
+    # We catch Errno::EINVAL as some operating systems (OS X in particular) can
+    # cause troubles when using Process#groups= to change *this* user / process
+    # list of supplementary groups membership.  This is done via Ruby's function
+    # "static VALUE proc_setgroups(VALUE obj, VALUE ary)" which is effectively
+    # a wrapper for "int setgroups(size_t size, const gid_t *list)" (part of SVr4
+    # and 4.3BSD but not in POSIX.1-2001) that fails and sets errno to EINVAL.
+    #
+    # This does not appear to be a problem with Ruby but rather an issue on the
+    # operating system side.  Therefore we catch the exception and look whether
+    # we run under OS X or not -- if so, then we acknowledge the problem and
+    # re-throw the exception otherwise.
+    if !osx_maj_ver || osx_maj_ver.empty?
+      raise e
+    end
+  end
+  module_function :groups=
+
+  def self.root?
+    if Puppet::Util::Platform.windows?
+      require_relative '../../puppet/util/windows/user'
+      Puppet::Util::Windows::User.admin?
+    else
+      Process.uid == 0
+    end
+  end
+
+  # Methods to handle changing uid/gid of the running process. In general,
+  # these will noop or fail on Windows, and require root to change to anything
+  # but the current uid/gid (which is a noop).
+
+  # Runs block setting euid and egid if provided then restoring original ids.
+  # If running on Windows or without root, the block will be run with the
+  # current euid/egid.
+  def asuser(new_uid = nil, new_gid = nil)
+    return yield if Puppet::Util::Platform.windows?
+    return yield unless root?
+    return yield unless new_uid or new_gid
+
+    old_euid = euid
+    old_egid = egid
+    begin
+      change_privileges(new_uid, new_gid, false)
+
+      yield
+    ensure
+      change_privileges(new_uid ? old_euid : nil, old_egid, false)
+    end
+  end
+  module_function :asuser
+
+  # If `permanently` is set, will permanently change the uid/gid of the
+  # process. If not, it will only set the euid/egid. If only uid is supplied,
+  # the primary group of the supplied gid will be used. If only gid is
+  # supplied, only gid will be changed. This method will fail if used on
+  # Windows.
+  def change_privileges(uid = nil, gid = nil, permanently = false)
+    return unless uid or gid
+
+    unless gid
+      uid = convert_xid(:uid, uid)
+      gid = Etc.getpwuid(uid).gid
+    end
+
+    change_group(gid, permanently)
+    change_user(uid, permanently) if uid
+  end
+  module_function :change_privileges
+
+  # Changes the egid of the process if `permanently` is not set, otherwise
+  # changes gid. This method will fail if used on Windows, or attempting to
+  # change to a different gid without root.
+  def change_group(group, permanently = false)
+    gid = convert_xid(:gid, group)
+    raise Puppet::Error, _("No such group %{group}") % { group: group } unless gid
+
+    return if Process.egid == gid
+
+    if permanently
+      Process::GID.change_privilege(gid)
+    else
+      Process.egid = gid
+    end
+  end
+  module_function :change_group
+
+  # As change_group, but operates on uids. If changing user permanently,
+  # supplementary groups will be set the to default groups for the new uid.
+  def change_user(user, permanently = false)
+    uid = convert_xid(:uid, user)
+    raise Puppet::Error, _("No such user %{user}") % { user: user } unless uid
+
+    return if Process.euid == uid
+
+    if permanently
+      # If changing uid, we must be root. So initgroups first here.
+      initgroups(uid)
+
+      Process::UID.change_privilege(uid)
+    elsif Process.euid == 0
+      # We must be root to initgroups, so initgroups before dropping euid if
+      # we're root, otherwise elevate euid before initgroups.
+      # change euid (to root) first.
+      initgroups(uid)
+      Process.euid = uid
+    else
+      Process.euid = uid
+      initgroups(uid)
+    end
+  end
+  module_function :change_user
+
+  # Make sure the passed argument is a number.
+  def convert_xid(type, id)
+    return id if id.is_a? Integer
+
+    map = { :gid => :group, :uid => :user }
+    raise ArgumentError, _("Invalid id type %{type}") % { type: type } unless map.include?(type)
+
+    ret = Puppet::Util.send(type, id)
+    if ret.nil?
+      raise Puppet::Error, _("Invalid %{klass}: %{id}") % { klass: map[type], id: id }
+    end
+
+    ret
+  end
+  module_function :convert_xid
+
+  # Initialize primary and supplemental groups to those of the target user.  We
+  # take the UID and manually look up their details in the system database,
+  # including username and primary group. This method will fail on Windows, or
+  # if used without root to initgroups of another user.
+  def initgroups(uid)
+    pwent = Etc.getpwuid(uid)
+    Process.initgroups(pwent.name, pwent.gid)
+  end
+
+  module_function :initgroups
+end