puppet 0.18.4 → 0.22.4

data/lib/puppet/type/exec.rb

@@ -1,5 +1,8 @@
 module Puppet
     newtype(:exec) do
+        include Puppet::Util::Execution
+        require 'timeout'
+
         @doc = "Executes external commands.  It is critical that all commands
             executed using this mechanism can be run multiple times without
             harm, i.e., they are *idempotent*.  One useful way to create idempotent
@@ -13,7 +16,7 @@ module Puppet
             share their commands with other instances as a dependency, since
             Puppet has no way of knowing which instance you mean.
 
-            For example:
+            For example::
 
                 # defined in the production class
                 exec { \"make\":
@@ -34,18 +37,21 @@ module Puppet
             obviously different images, so ``exec`` had to be treated specially.
 
             It is recommended to avoid duplicate names whenever possible.
+
+            Note that if an ``exec`` receives an event from another resource,
+            it will get executed again (or execute the command specified in
+            ``refresh``, if there is one).
             
             There is a strong tendency to use ``exec`` to do whatever work Puppet
             can't already do; while this is obviously acceptable (and unavoidable)
             in the short term, it is highly recommended to migrate work from ``exec``
-            to real Puppet element types as quickly as possible.  If you find that
+            to native Puppet types as quickly as possible.  If you find that
             you are doing a lot of work with ``exec``, please at least notify
             us at Reductive Labs what you are doing, and hopefully we can work with
-            you to get a native element type for the work you are doing.  In general,
-            it is a Puppet bug if you need ``exec`` to do your work."
+            you to get a native element type for the work you are doing."
 
         require 'open3'
-        require 'puppet/type/state'
+        require 'puppet/type/property'
 
         # Create a new check mechanism.  It's basically just a parameter that
         # provides one extra 'check' method.
@@ -60,7 +66,8 @@ module Puppet
             @checks.keys
         end
 
-        newstate(:returns) do |state|
+        newproperty(:returns) do |property|
+            include Puppet::Util::Execution
             munge do |value|
                 value.to_s
             end
@@ -76,41 +83,6 @@ module Puppet
                 return "executed successfully"
             end
 
-            # Verify that we have the executable
-            def checkexe
-                cmd = self.parent[:command]
-                if cmd =~ /^\//
-                    exe = cmd.split(/ /)[0]
-                    unless FileTest.exists?(exe)
-                        self.fail(
-                            "Could not find executable %s" % exe
-                        )
-                    end
-                    unless FileTest.executable?(exe)
-                        self.fail(
-                            "%s is not executable" % exe
-                        )
-                    end
-                elsif path = self.parent[:path]
-                    exe = cmd.split(/ /)[0]
-                    tmppath = ENV["PATH"]
-                    ENV["PATH"] = self.parent[:path].join(":")
-
-                    path = %{which #{exe}}.chomp
-                    if path == ""
-                        self.fail(
-                            "Could not find command '%s'" % exe
-                        )
-                    end
-                    ENV["PATH"] = tmppath
-                else
-                    self.fail(
-                        "%s is somehow not qualified with no search path" %
-                            self.parent[:command]
-                    )
-                end
-            end
-
             # First verify that all of our checks pass.
             def retrieve
                 # Default to somethinng
@@ -126,15 +98,16 @@ module Puppet
             def sync
                 olddir = nil
 
-                self.checkexe
-
                 # We need a dir to change to, even if it's just the cwd
                 dir = self.parent[:cwd] || Dir.pwd
-                tmppath = ENV["PATH"]
 
                 event = :executed_command
 
-                @output, status = @parent.run(self.parent[:command])
+                begin
+                    @output, status = @parent.run(self.parent[:command])
+                rescue Timeout::Error
+                    self.fail "Command exceeded timeout" % value.inspect
+                end
 
                 loglevel = @parent[:loglevel]
                 if status.exitstatus.to_s != self.should.to_s
@@ -174,7 +147,7 @@ module Puppet
 
             # Support both arrays and colon-separated fields.
             def value=(*values)
-                @value = values.collect { |val|
+                @value = values.flatten.collect { |val|
                     val.split(":")
                 }.flatten
             end
@@ -183,29 +156,15 @@ module Puppet
         newparam(:user) do
             desc "The user to run the command as.  Note that if you
                 use this then any error output is not currently captured.  This
-                is because of a bug within Ruby."
+                is because of a bug within Ruby.  If you are using Puppet to
+                create this user, the exec will automatically require the user,
+                as long as it is specified by name."
 
-            munge do |user|
-                unless Process.uid == 0
+            # Most validation is handled by the SUIDManager class.
+            validate do |user|
+                unless Puppet.features.root?
                     self.fail "Only root can execute commands as other users"
                 end
-                require 'etc'
-
-                method = :getpwnam
-                case user
-                when Integer
-                    method = :getpwuid
-                when /^\d+$/
-                    user = user.to_i
-                    method = :getpwuid
-                end
-                begin
-                    Etc.send(method, user)
-                rescue ArgumentError
-                    self.fail "No such user %s" % user
-                end
-
-                return user
             end
         end
 
@@ -214,26 +173,7 @@ module Puppet
                 haphazardly on different platforms -- it is a platform issue
                 not a Ruby or Puppet one, since the same variety exists when
                 running commnands as different users in the shell."
-
-            # Execute the command as the specified group
-            munge do |group|
-                require 'etc'
-                method = :getgrnam
-                case group
-                when Integer: method = :getgrgid
-                when /^\d+$/
-                    group = group.to_i
-                    method = :getgrgid
-                end
-
-                begin
-                    Etc.send(method, group)
-                rescue ArgumentError
-                    self.fail "No such group %s" % group
-                end
-
-                group
-            end
+            # Validation is handled by the SUIDManager class.
         end
 
         newparam(:cwd) do
@@ -241,7 +181,9 @@ module Puppet
                 this directory does not exist, the command will fail."
 
             validate do |dir|
-                self.fail("CWD must be a fully qualified path") unless dir
+                unless dir =~ /^#{File::SEPARATOR}/
+                    self.fail("CWD must be a fully qualified path")
+                end
             end
 
             munge do |dir|
@@ -260,15 +202,62 @@ module Puppet
 
             values = [:true, :false]
             # And all of the log levels
-            Puppet::Log.eachlevel { |level| values << level }
+            Puppet::Util::Log.eachlevel { |level| values << level }
             newvalues(*values)
         end
 
+        newparam(:refresh) do
+            desc "How to refresh this command.  By default, the exec is just
+                called again when it receives an event from another resource,
+                but this parameter allows you to define a different command
+                for refreshing."
+
+            validate do |command|
+                @parent.validatecmd(command)
+            end
+        end
+
+        newparam(:env) do
+            desc "Any additional environment variables you want to set for a
+                command.  Note that if you use this to set PATH, it will override
+                the ``path`` attribute.  Multiple environment variables should be
+                specified as an array."
+
+            validate do |values|
+                values = [values] unless values.is_a? Array
+                values.each do |value|
+                    unless value =~ /\w+=/
+                        raise ArgumentError, "Invalid environment setting '%s'" % value
+                    end
+                end
+            end
+        end
+        
+        newparam(:timeout) do
+            desc "The maximum time the command should take.  If the command takes
+                longer than the timeout, the command is considered to have failed
+                and will be stopped.  Use any negative number to disable the timeout."
+            
+            munge do |value|
+                value = value.shift if value.is_a?(Array)
+                if value.is_a?(String)
+                    unless value =~ /^[-\d.]+$/
+                        raise ArgumentError, "The timeout must be a number."
+                    end
+                    Float(value)
+                else
+                    value
+                end
+            end
+            
+            defaultto 300
+        end
+
         newcheck(:refreshonly) do
             desc "The command should only be run as a
                 refresh mechanism for when a dependent object is changed.  It only
                 makes sense to use this option when this command depends on some
-                other object; it is useful for triggering an action:
+                other object; it is useful for triggering an action::
                     
                     # Pull down the main aliases file
                     file { \"/etc/aliases\":
@@ -290,14 +279,19 @@ module Puppet
             # We always fail this test, because we're only supposed to run
             # on refresh.
             def check(value)
-                false
+                # We have to invert the values.
+                if value == :true
+                    false
+                else
+                    true
+                end
             end
         end
 
         newcheck(:creates) do 
             desc "A file that this command creates.  If this
                 parameter is provided, then the command will only be run
-                if the specified file does not exist.
+                if the specified file does not exist::
 
                     exec { \"tar xf /my/tar/file.tar\":
                         cwd => \"/var/tmp\",
@@ -330,7 +324,7 @@ module Puppet
 
         newcheck(:unless) do
             desc "If this parameter is set, then this ``exec`` will run unless
-                the command returns 0.  For example:
+                the command returns 0.  For example::
                     
                     exec { \"/bin/echo root >> /usr/lib/cron/cron.allow\":
                         path => \"/usr/bin:/usr/sbin:/bin\",
@@ -354,7 +348,12 @@ module Puppet
 
             # Return true if the command does not return 0.
             def check(value)
-                output, status = @parent.run(value, true)
+                begin
+                    output, status = @parent.run(value, true)
+                rescue Timeout::Error
+                    err "Check %s exceeded timeout" % value.inspect
+                    return false
+                end
 
                 return status.exitstatus != 0
             end
@@ -362,7 +361,7 @@ module Puppet
 
         newcheck(:onlyif) do
             desc "If this parameter is set, then this ``exec`` will only run if
-                the command returns 0.  For example:
+                the command returns 0.  For example::
                     
                     exec { \"logrotate\":
                         path => \"/usr/bin:/usr/sbin:/bin\",
@@ -385,7 +384,12 @@ module Puppet
 
             # Return true if the command returns 0.
             def check(value)
-                output, status = @parent.run(value, true)
+                begin
+                    output, status = @parent.run(value, true)
+                rescue Timeout::Error
+                    err "Check %s exceeded timeout" % value.inspect
+                    return false
+                end
 
                 return status.exitstatus == 0
             end
@@ -432,13 +436,23 @@ module Puppet
             reqs
         end
 
+        autorequire(:user) do
+            # Autorequire users if they are specified by name
+            if user = self[:user] and user !~ /^\d+$/
+                user
+            end
+        end
+
         def self.list
             self.collect { |i| i }
         end
 
-        # Verify that we pass all of the checks.
-        def check
+        # Verify that we pass all of the checks.  The argument determines whether
+        # we skip the :refreshonly check, which is necessary because we now check
+        # within refresh()
+        def check(refreshing = false)
             self.class.checks.each { |check|
+                next if refreshing and check == :refreshonly
                 if @parameters.include?(check)
                     val = @parameters[check].value
                     val = [val] unless val.is_a? Array
@@ -453,27 +467,61 @@ module Puppet
             return true
         end
 
+        # Verify that we have the executable
+        def checkexe(cmd)
+            if cmd =~ /^\//
+                exe = cmd.split(/ /)[0]
+                unless FileTest.exists?(exe)
+                    raise ArgumentError, "Could not find executable %s" % exe
+                end
+                unless FileTest.executable?(exe)
+                    raise ArgumentError,
+                        "%s is not executable" % exe
+                end
+            elsif path = self[:path]
+                exe = cmd.split(/ /)[0]
+                withenv :PATH => self[:path].join(":") do
+                    path = %{which #{exe}}.chomp
+                    if path == ""
+                        raise ArgumentError,
+                            "Could not find command '%s'" % exe
+                    end
+                end
+            else
+                raise ArgumentError,
+                    "%s is somehow not qualified with no search path" %
+                        self[:command]
+            end
+        end
+
         def output
-            if self.state(:returns).nil?
+            if self.property(:returns).nil?
                 return nil
             else
-                return self.state(:returns).output
+                return self.property(:returns).output
             end
         end
 
-        # this might be a very, very bad idea...
+        # Run the command, or optionally run a separately-specified command.
         def refresh
-            self.state(:returns).sync
+            if self.check(true)
+                if cmd = self[:refresh]
+                    self.run(cmd)
+                else
+                    self.property(:returns).sync
+                end
+            end
         end
 
         # Run a command.
         def run(command, check = false)
             output = nil
             status = nil
-            tmppath = ENV["PATH"]
 
             dir = nil
 
+            checkexe(command)
+
             if dir = self[:cwd]
                 unless File.directory?(dir)
                     if check
@@ -493,52 +541,60 @@ module Puppet
             end
             begin
                 # Do our chdir
-                Dir.chdir(dir) {
+                Dir.chdir(dir) do
+                    env = {}
+
                     if self[:path]
-                        ENV["PATH"] = self[:path].join(":")
+                        env[:PATH] = self[:path].join(":")
                     end
 
-                    # The user and group default to nil, which 'asuser'
-                    # handlers correctly
-                    Puppet::Util.asuser(self[:user], self[:group]) {
-                        # capture both stdout and stderr
-                        if self[:user]
-                            unless defined? @@alreadywarned
-                                Puppet.warning(
-                        "Cannot capture STDERR when running as another user"
-                                )
-                                @@alreadywarned = true
+                    if envlist = self[:env]
+                        envlist = [envlist] unless envlist.is_a? Array
+                        envlist.each do |setting|
+                            if setting =~ /^(\w+)=((.|\n)+)$/
+                                name = $1
+                                value = $2
+                                if env.include? name
+                                    warning(
+                                    "Overriding environment setting '%s' with '%s'" %
+                                        [name, value]
+                                    )
+                                end
+                                env[name] = value
+                            else
+                                warning "Cannot understand env setting %s" % setting.inspect
                             end
-                            output = %x{#{command}}
-                        else
-                            output = %x{#{command} 2>&1}
                         end
-                    }
-                    status = $?.dup
-                }
+                    end
+
+                    withenv env do
+                        Timeout::timeout(self[:timeout]) do
+                            output, status = Puppet::Util::SUIDManager.run_and_capture(
+                                [command], self[:user], self[:group]
+                            )
+                        end
+                        # The shell returns 127 if the command is missing.
+                        if status.exitstatus == 127
+                            raise ArgumentError, output
+                        end
+                    end
+                end
             rescue Errno::ENOENT => detail
                 self.fail detail.to_s
-            ensure
-                # reset things to how we found them
-                ENV["PATH"] = tmppath
             end
 
             return output, status
         end
 
-        def to_s
-            "exec(%s)" % self.name
-        end
-
         def validatecmd(cmd)
             # if we're not fully qualified, require a path
             if cmd !~ /^\//
                 if self[:path].nil?
-                    self.fail "both unqualifed and specified no search path"
+                    self.fail "'%s' is both unqualifed and specified no search path" % cmd
                 end
             end
         end
     end
 end
 
-# $Id: exec.rb 1422 2006-07-22 03:32:56Z luke $
+# $Id: exec.rb 2442 2007-04-30 19:42:58Z luke $