puppet-retrospec 1.5.0 → 1.6.0

data/vendor/pup410/lib/puppet/provider/user/hpux.rb

@@ -0,0 +1,95 @@
+Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
+  desc "User management for HP-UX. This provider uses the undocumented `-F`
+    switch to HP-UX's special `usermod` binary to work around the fact that
+    its standard `usermod` cannot make changes while the user is logged in.
+    New functionality provides for changing trusted computing passwords and
+    resetting password expirations under trusted computing."
+
+  defaultfor :operatingsystem => "hp-ux"
+  confine :operatingsystem => "hp-ux"
+
+  commands :modify => "/usr/sam/lbin/usermod.sam", :delete => "/usr/sam/lbin/userdel.sam", :add => "/usr/sam/lbin/useradd.sam"
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :home, :flag => "-d", :method => :dir
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  has_features :manages_homedir, :allows_duplicates, :manages_passwords
+
+  def deletecmd
+    super.insert(1,"-F")
+  end
+
+  def modifycmd(param,value)
+     cmd = super(param, value)
+     cmd << "-F"
+     if trusted then
+       # Append an additional command to reset the password age to 0
+       # until a workaround with expiry module can be found for trusted
+       # computing.
+       cmd << ";"
+       cmd << "/usr/lbin/modprpw"
+       cmd << "-v"
+       cmd << "-l"
+       cmd << "#{resource.name}"
+     end
+     cmd
+  end
+
+  def password
+    # Password management routine for trusted and non-trusted systems
+    #temp=""
+    while ent = Etc.getpwent() do
+      if ent.name == resource.name
+        temp=ent.name
+        break
+      end
+    end
+    Etc.endpwent()
+    if !temp
+      return nil
+    end
+
+    ent = Etc.getpwnam(resource.name)
+    if ent.passwd == "*"
+      # Either no password or trusted password, check trusted
+      file_name="/tcb/files/auth/#{resource.name.chars.first}/#{resource.name}"
+      if File.file?(file_name)
+        # Found the tcb user for the specific user, now get passwd
+        File.open(file_name).each do |line|
+          if ( line =~ /u_pwd/ )
+            temp_passwd=line.split(":")[1].split("=")[1]
+            ent.passwd = temp_passwd
+            return ent.passwd
+          end
+        end
+      else
+        debug "No trusted computing user file #{file_name} found."
+      end
+    else
+      return ent.passwd
+    end
+  end
+
+  def trusted
+    # Check to see if the HP-UX box is running in trusted compute mode
+    # UID for root should always be 0
+    trusted_sys = exec_getprpw('root','-m uid')
+    if trusted_sys.chomp == "uid=0"
+      return true
+    else
+      return false
+    end
+  end
+
+  def exec_getprpw(user,opts)
+    Puppet::Util::Execution.execute("/usr/lbin/getprpw #{opts} #{user}", { :combine => true })
+  end
+end

data/vendor/pup410/lib/puppet/provider/user/user_role_add.rb

@@ -0,0 +1,227 @@
+require 'puppet/util'
+require 'puppet/util/user_attr'
+require 'date'
+
+Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source => :useradd do
+
+  desc "User and role management on Solaris, via `useradd` and `roleadd`."
+
+  defaultfor :osfamily => :solaris
+
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "passwd", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :shell, :flag => "-s"
+  options :roles, :flag => "-R"
+  options :auths, :flag => "-A"
+  options :profiles, :flag => "-P"
+  options :password_min_age, :flag => "-n"
+  options :password_max_age, :flag => "-x"
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  def shell=(value)
+    check_valid_shell
+    set("shell", value)
+  end
+
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age, :manages_shell
+
+  def check_valid_shell
+    unless File.exists?(@resource.should(:shell))
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must exist")
+    end
+    unless File.executable?(@resource.should(:shell).to_s)
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must be executable")
+    end
+  end
+
+  #must override this to hand the keyvalue pairs
+  def add_properties
+    cmd = []
+    Puppet::Type.type(:user).validproperties.each do |property|
+      #skip the password because we can't create it with the solaris useradd
+      next if [:ensure, :password, :password_min_age, :password_max_age].include?(property)
+      # 1680 Now you can set the hashed passwords on solaris:lib/puppet/provider/user/user_role_add.rb
+      # the value needs to be quoted, mostly because -c might
+      # have spaces in it
+      if value = @resource.should(property) and value != ""
+        if property == :keys
+          cmd += build_keys_cmd(value)
+        else
+          cmd << flag(property) << value
+        end
+      end
+    end
+    cmd
+  end
+
+  def user_attributes
+    @user_attributes ||= UserAttr.get_attributes_by_name(@resource[:name])
+  end
+
+  def flush
+    @user_attributes = nil
+  end
+
+  def command(cmd)
+    cmd = ("role_#{cmd}").intern if is_role? or (!exists? and @resource[:ensure] == :role)
+    super(cmd)
+  end
+
+  def is_role?
+    user_attributes and user_attributes[:type] == "role"
+  end
+
+  def run(cmd, msg)
+      execute(cmd)
+  rescue Puppet::ExecutionFailure => detail
+      raise Puppet::Error, "Could not #{msg} #{@resource.class.name} #{@resource.name}: #{detail}", detail.backtrace
+  end
+
+  def transition(type)
+    cmd = [command(:modify)]
+    cmd << "-K" << "type=#{type}"
+    cmd += add_properties
+    cmd << @resource[:name]
+  end
+
+  def create
+    if is_role?
+      run(transition("normal"), "transition role to")
+    else
+      run(addcmd, "create")
+      if cmd = passcmd
+        run(cmd, "change password policy for")
+      end
+    end
+    # added to handle case when password is specified
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+  def destroy
+    run(deletecmd, "delete "+ (is_role? ? "role" : "user"))
+  end
+
+  def create_role
+    if exists? and !is_role?
+      run(transition("role"), "transition user to")
+    else
+      run(addcmd, "create role")
+    end
+  end
+
+  def roles
+    user_attributes[:roles] if user_attributes
+  end
+
+  def auths
+    user_attributes[:auths] if user_attributes
+  end
+
+  def profiles
+    user_attributes[:profiles] if user_attributes
+  end
+
+  def project
+    user_attributes[:project] if user_attributes
+  end
+
+  def managed_attributes
+    [:name, :type, :roles, :auths, :profiles, :project]
+  end
+
+  def remove_managed_attributes
+    managed = managed_attributes
+    user_attributes.select { |k,v| !managed.include?(k) }.inject({}) { |hash, array| hash[array[0]] = array[1]; hash }
+  end
+
+  def keys
+    if user_attributes
+      #we have to get rid of all the keys we are managing another way
+      remove_managed_attributes
+    end
+  end
+
+  def build_keys_cmd(keys_hash)
+    cmd = []
+    keys_hash.each do |k,v|
+      cmd << "-K" << "#{k}=#{v}"
+    end
+    cmd
+  end
+
+  def keys=(keys_hash)
+    run([command(:modify)] + build_keys_cmd(keys_hash) << @resource[:name], "modify attribute key pairs")
+  end
+
+
+  # This helper makes it possible to test this on stub data without having to
+  # do too many crazy things!
+  def target_file_path
+    "/etc/shadow"
+  end
+  private :target_file_path
+
+  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return it
+  #No abstraction, all esoteric knowledge of file formats, yay
+  def shadow_entry
+    return @shadow_entry if defined? @shadow_entry
+    @shadow_entry = File.readlines(target_file_path).
+      reject { |r| r =~ /^[^\w]/ }.
+      # PUP-229: don't suppress the empty fields
+      collect { |l| l.chomp.split(':', -1) }.
+      find { |user, _| user == @resource[:name] }
+  end
+
+  def password
+    return :absent unless shadow_entry
+    shadow_entry[1]
+  end
+
+  def password_min_age
+    return :absent unless shadow_entry
+    shadow_entry[3].empty? ? -1 : shadow_entry[3]
+  end
+
+  def password_max_age
+    return :absent unless shadow_entry
+    shadow_entry[4].empty? ? -1 : shadow_entry[4]
+  end
+
+  # Read in /etc/shadow, find the line for our used and rewrite it with the
+  # new pw.  Smooth like 80 grit sandpaper.
+  #
+  # Now uses the `replace_file` mechanism to minimize the chance that we lose
+  # data, but it is still terrible.  We still skip platform locking, so a
+  # concurrent `vipw -s` session will have no idea we risk data loss.
+  def password=(cryptopw)
+    begin
+      shadow = File.read(target_file_path)
+
+      # Go Mifune loves the race here where we can lose data because
+      # /etc/shadow changed between reading it and writing it.
+      # --daniel 2012-02-05
+      Puppet::Util.replace_file(target_file_path, 0640) do |fh|
+        shadow.each_line do |line|
+          line_arr = line.split(':')
+          if line_arr[0] == @resource[:name]
+            line_arr[1] = cryptopw
+            line_arr[2] = (Date.today - Date.new(1970,1,1)).to_i.to_s
+            line = line_arr.join(':')
+          end
+          fh.print line
+        end
+      end
+    rescue => detail
+      self.fail Puppet::Error, "Could not write replace #{target_file_path}: #{detail}", detail
+    end
+  end
+end

data/vendor/pup410/lib/puppet/provider/user/useradd.rb

@@ -0,0 +1,231 @@
+require 'puppet/provider/nameservice/objectadd'
+require 'date'
+require 'puppet/util/libuser'
+require 'time'
+require 'puppet/error'
+
+Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameService::ObjectAdd do
+  desc "User management via `useradd` and its ilk.  Note that you will need to
+    install Ruby's shadow password library (often known as `ruby-libshadow`)
+    if you wish to manage user passwords."
+
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage"
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :password_min_age, :flag => "-m", :method => :sp_min
+  options :password_max_age, :flag => "-M", :method => :sp_max
+  options :password, :method => :sp_pwdp
+  options :expiry, :method => :sp_expire,
+    :munge => proc { |value|
+      if value == :absent
+        ''
+      else
+        case Facter.value(:operatingsystem)
+        when 'Solaris'
+          # Solaris uses %m/%d/%Y for useradd/usermod
+          expiry_year, expiry_month, expiry_day = value.split('-')
+          [expiry_month, expiry_day, expiry_year].join('/')
+        else
+          value
+        end
+      end
+    },
+    :unmunge => proc { |value|
+      if value == -1
+        :absent
+      else
+        # Expiry is days after 1970-01-01
+        (Date.new(1970,1,1) + value).strftime('%Y-%m-%d')
+      end
+    }
+
+  optional_commands :localadd => "luseradd"
+  has_feature :libuser if Puppet.features.libuser?
+
+  def exists?
+    return !!localuid if @resource.forcelocal?
+    super
+  end
+
+  def uid
+     return localuid if @resource.forcelocal?
+     get(:uid)
+  end
+
+  def finduser(key, value)
+    passwd_file = "/etc/passwd"
+    passwd_keys = ['account', 'password', 'uid', 'gid', 'gecos', 'directory', 'shell']
+    index = passwd_keys.index(key)
+    File.open(passwd_file) do |f|
+      f.each_line do |line|
+         user = line.split(":")
+         if user[index] == value
+             f.close
+             return user
+         end
+      end
+    end
+    false
+  end
+
+  def local_username
+    finduser('uid', @resource.uid)
+  end
+
+  def localuid
+    user = finduser('account', resource[:name])
+    return user[2] if user
+    false
+  end
+
+  def shell=(value)
+    check_valid_shell
+    set("shell", value)
+  end
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  has_features :manages_homedir, :allows_duplicates, :manages_expiry
+  has_features :system_users unless %w{HP-UX Solaris}.include? Facter.value(:operatingsystem)
+
+  has_features :manages_passwords, :manages_password_age if Puppet.features.libshadow?
+  has_features :manages_shell
+
+  def check_allow_dup
+    # We have to manually check for duplicates when using libuser
+    # because by default duplicates are allowed.  This check is
+    # to ensure consistent behaviour of the useradd provider when
+    # using both useradd and luseradd
+    if not @resource.allowdupe? and @resource.forcelocal?
+       if @resource.should(:uid) and finduser('uid', @resource.should(:uid).to_s)
+           raise(Puppet::Error, "UID #{@resource.should(:uid).to_s} already exists, use allowdupe to force user creation")
+       end
+    elsif @resource.allowdupe? and not @resource.forcelocal?
+       return ["-o"]
+    end
+    []
+  end
+
+  def check_valid_shell
+    unless File.exists?(@resource.should(:shell))
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must exist")
+    end
+    unless File.executable?(@resource.should(:shell).to_s)
+      raise(Puppet::Error, "Shell #{@resource.should(:shell)} must be executable")
+    end
+  end
+
+  def check_manage_home
+    cmd = []
+    if @resource.managehome? and not @resource.forcelocal?
+      cmd << "-m"
+    elsif not @resource.managehome? and Facter.value(:osfamily) == 'RedHat'
+      cmd << "-M"
+    end
+    cmd
+  end
+
+  def check_manage_expiry
+    cmd = []
+    if @resource[:expiry] and not @resource.forcelocal?
+      cmd << "-e #{@resource[:expiry]}"
+    end
+
+    cmd
+  end
+
+  def check_system_users
+    if self.class.system_users? and resource.system?
+      ["-r"]
+    else
+      []
+    end
+  end
+
+  def add_properties
+    cmd = []
+    # validproperties is a list of properties in undefined order
+    # sort them to have a predictable command line in tests
+    Puppet::Type.type(:user).validproperties.sort.each do |property|
+      next if property == :ensure
+      next if property.to_s =~ /password_.+_age/
+      next if property == :groups and @resource.forcelocal?
+      next if property == :expiry and @resource.forcelocal?
+      # the value needs to be quoted, mostly because -c might
+      # have spaces in it
+      if value = @resource.should(property) and value != ""
+        cmd << flag(property) << munge(property, value)
+      end
+    end
+    cmd
+  end
+
+  def addcmd
+    if @resource.forcelocal?
+      cmd = [command(:localadd)]
+      @custom_environment = Puppet::Util::Libuser.getenv
+    else
+      cmd = [command(:add)]
+    end
+    if not @resource.should(:gid) and Puppet::Util.gid(@resource[:name])
+      cmd += ["-g", @resource[:name]]
+    end
+    cmd += add_properties
+    cmd += check_allow_dup
+    cmd += check_manage_home
+    cmd += check_system_users
+    cmd << @resource[:name]
+  end
+
+  def deletecmd
+    cmd = [command(:delete)]
+    cmd += @resource.managehome? ? ['-r'] : []
+    cmd << @resource[:name]
+  end
+
+  def passcmd
+    age_limits = [:password_min_age, :password_max_age].select { |property| @resource.should(property) }
+    if age_limits.empty?
+      nil
+    else
+      [command(:password),age_limits.collect { |property| [flag(property), @resource.should(property)]}, @resource[:name]].flatten
+    end
+  end
+
+  [:expiry, :password_min_age, :password_max_age, :password].each do |shadow_property|
+    define_method(shadow_property) do
+      if Puppet.features.libshadow?
+        if ent = Shadow::Passwd.getspnam(@canonical_name)
+          method = self.class.option(shadow_property, :method)
+          return unmunge(shadow_property, ent.send(method))
+        end
+      end
+      :absent
+    end
+  end
+
+  def create
+    if @resource[:shell]
+      check_valid_shell
+    end
+     super
+     if @resource.forcelocal? and self.groups?
+       set(:groups, @resource[:groups])
+     end
+     if @resource.forcelocal? and @resource[:expiry]
+       set(:expiry, @resource[:expiry])
+     end
+  end
+
+  def groups?
+    !!@resource[:groups]
+  end
+end