puppet 0.24.5 → 0.24.6

data/lib/puppet/type/file.rb

@@ -368,7 +368,7 @@ module Puppet
                         Find.find(self[:path]) do |f|
                             if File.file?(f)
                                 sum = backup.backup(f)
-                                self.info "Filebucketed %s to %s with sum %s" %
+                                self.notice "Filebucketed %s to %s with sum %s" %
                                     [f, backup.name, sum]
                             end
                         end
@@ -403,7 +403,7 @@ module Puppet
                 case backup
                 when Puppet::Network::Client.client(:Dipper):
                     sum = backup.backup(file)
-                    self.info "Filebucketed to %s with sum %s" %
+                    self.notice "Filebucketed to %s with sum %s" %
                         [backup.name, sum]
                     return true
                 when String:
@@ -849,6 +849,8 @@ module Puppet
             # Keep track of all the files we found in the source, so we can purge
             # appropriately.
             sourced = []
+
+            success = false
             
             @parameters[:source].should.each do |source|
                 sourceobj, path = uri2obj(source)
@@ -863,6 +865,8 @@ module Puppet
                 if desc == "" 
                     next
                 end
+
+                success = true
             
                 # Now create a new child for every file returned in the list.
                 result += desc.split("\n").collect { |line|
@@ -898,6 +902,11 @@ module Puppet
                     return [result, sourced]
                 end
             end
+
+            unless success
+                raise Puppet::Error, "None of the provided sources exist"
+            end
+
             return [result, sourced]
         end
 
@@ -1148,4 +1157,5 @@ module Puppet
     require 'puppet/type/file/group'
     require 'puppet/type/file/mode'
     require 'puppet/type/file/type'
+    require 'puppet/type/file/selcontext'  # SELinux file context
 end

data/lib/puppet/type/file/checksum.rb

@@ -53,6 +53,9 @@ Puppet::Type.type(:file).newproperty(:checksum) do
         else
             if FileTest.directory?(@resource[:path])
                 return :time
+            elsif @resource[:source] and value.to_s != "md5"
+                 self.warning("Files with source set must use md5 as checksum. Forcing to md5 from %s for %s" % [ value, @resource[:path] ])
+                return :md5
             else
                 return symbolize(value)
             end
@@ -161,6 +164,7 @@ Puppet::Type.type(:file).newproperty(:checksum) do
 
         checktype = :mtime if checktype == :timestamp
         checktype = :ctime if checktype == :time
+        self.should = checktype = :md5 if @resource.property(:source)
 
         file ||= @resource[:path]
 

data/lib/puppet/type/file/group.rb

@@ -1,6 +1,10 @@
+require 'puppet/util/posix'
+
 # Manage file group ownership.
 module Puppet
     Puppet.type(:file).newproperty(:group) do
+        include Puppet::Util::POSIX
+
         require 'etc'
         desc "Which group should own the file.  Argument can be either group
             name or group ID."
@@ -42,32 +46,23 @@ module Puppet
             end
         end
 
-        def retrieve
-            if self.should
-                @should = @should.collect do |val|
-                    unless val.is_a?(Integer)
-                        if tmp = validgroup?(val)
-                            val = tmp
-                        else
-                            raise "Could not find group %s" % val
-                        end
-                    else
-                        val
-                    end
+        def insync?(current)
+            @should.each do |value|
+                if value =~ /^\d+$/
+                    gid = Integer(value)
+                elsif value.is_a?(String)
+                    fail "Could not find group %s" % value unless gid = gid(value)
+                else
+                    gid = value
                 end
-            end
-            stat = @resource.stat(false)
 
-            unless stat
-                return :absent
+                return true if gid == current
             end
+            return false
+        end
 
-            # Set our method appropriately, depending on links.
-            if stat.ftype == "link" and @resource[:links] != :follow
-                @method = :lchown
-            else
-                @method = :chown
-            end
+        def retrieve
+            return :absent unless stat = resource.stat(false)
 
             currentvalue = stat.gid
 
@@ -84,12 +79,8 @@ module Puppet
 
         # Determine if the group is valid, and if so, return the GID
         def validgroup?(value)
-            if value =~ /^\d+$/
-                value = value.to_i
-            end
-        
-            if gid = Puppet::Util.gid(value)
-                return gid
+            if number = gid(value)
+                return number
             else
                 return false
             end
@@ -99,32 +90,28 @@ module Puppet
         # we'll just let it fail, but we should probably set things up so
         # that users get warned if they try to change to an unacceptable group.
         def sync
-            unless @resource.stat(false)
-                stat = @resource.stat(true)
-                currentvalue = self.retrieve
-
-                unless stat
-                    self.debug "File '%s' does not exist; cannot chgrp" %
-                        @resource[:path]
-                    return nil
-                end
+            # Set our method appropriately, depending on links.
+            if resource[:links] == :manage
+                method = :lchown
+            else
+                method = :chown
             end
 
             gid = nil
-            unless gid = Puppet::Util.gid(self.should)
-                raise Puppet::Error, "Could not find group %s" % self.should
+            @should.each do |group|
+                break if gid = validgroup?(group)
             end
 
+            raise Puppet::Error, "Could not find group(s) %s" % @should.join(",") unless gid
+
             begin
                 # set owner to nil so it's ignored
-                File.send(@method,nil,gid,@resource[:path])
+                File.send(method, nil, gid, resource[:path])
             rescue => detail
-                error = Puppet::Error.new( "failed to chgrp %s to %s: %s" %
-                    [@resource[:path], self.should, detail.message])
+                error = Puppet::Error.new( "failed to chgrp %s to %s: %s" % [resource[:path], gid, detail.message])
                 raise error
             end
             return :file_changed
         end
     end
 end
-

data/lib/puppet/type/file/selcontext.rb

@@ -0,0 +1,104 @@
+# Manage SELinux context of files.
+#
+# This code actually manages three pieces of data in the context.
+#
+# [root@delenn files]# ls -dZ /
+# drwxr-xr-x  root root system_u:object_r:root_t         /
+#
+# The context of '/' here is 'system_u:object_r:root_t'.  This is
+# three seperate fields:
+#
+# system_u is the user context
+# object_r is the role context
+# root_t is the type context
+#
+# All three of these fields are returned in a single string by the
+# output of the stat command, but set individually with the chcon
+# command.  This allows the user to specify a subset of the three
+# values while leaving the others alone.
+#
+# See http://www.nsa.gov/selinux/ for complete docs on SELinux.
+
+module Puppet
+    require 'puppet/util/selinux'
+
+    class SELFileContext < Puppet::Property
+        include Puppet::Util::SELinux
+
+        def retrieve
+            unless @resource.stat(false)
+                return :absent
+            end
+            context = self.get_selinux_current_context(@resource[:path])
+            return parse_selinux_context(name, context)
+        end
+
+        def retrieve_default_context(property)
+            unless context = self.get_selinux_default_context(@resource[:path])
+                return nil
+            end
+            property_default = self.parse_selinux_context(property, context)
+            self.debug "Found #{property} default '#{property_default}' for #{@resource[:path]}"
+            return property_default
+        end
+
+        def sync
+            unless @resource.stat(false)
+                stat = @resource.stat(true)
+                unless stat
+                    return nil
+                end
+            end
+
+            self.set_selinux_context(@resource[:path], @should, name)
+            return :file_changed
+        end
+    end
+
+    Puppet.type(:file).newproperty(:seluser, :parent => Puppet::SELFileContext) do
+        desc "What the SELinux user component of the context of the file should be.
+            Any valid SELinux user component is accepted.  For example ``user_u``.
+            If not specified it defaults to the value returned by matchpathcon for
+            the file, if any exists.  Only valid on systems with SELinux support
+            enabled."
+
+        @event = :file_changed
+        defaultto { self.retrieve_default_context(:seluser) }
+    end
+
+    Puppet.type(:file).newproperty(:selrole, :parent => Puppet::SELFileContext) do
+        desc "What the SELinux role component of the context of the file should be.
+            Any valid SELinux role component is accepted.  For example ``role_r``.
+            If not specified it defaults to the value returned by matchpathcon for
+            the file, if any exists.  Only valid on systems with SELinux support
+            enabled."
+
+        @event = :file_changed
+        defaultto { self.retrieve_default_context(:selrole) }
+    end
+
+    Puppet.type(:file).newproperty(:seltype, :parent => Puppet::SELFileContext) do
+        desc "What the SELinux type component of the context of the file should be.
+            Any valid SELinux type component is accepted.  For example ``tmp_t``.
+            If not specified it defaults to the value returned by matchpathcon for
+            the file, if any exists.  Only valid on systems with SELinux support
+            enabled."
+
+        @event = :file_changed
+        defaultto { self.retrieve_default_context(:seltype) }
+    end
+
+    Puppet.type(:file).newproperty(:selrange, :parent => Puppet::SELFileContext) do
+        desc "What the SELinux range component of the context of the file should be.
+            Any valid SELinux range component is accepted.  For example ``s0`` or
+            ``SystemHigh``.  If not specified it defaults to the value returned by
+            matchpathcon for the file, if any exists.  Only valid on systems with
+            SELinux support enabled and that have support for MCS (Multi-Category
+            Security)."
+
+        @event = :file_changed
+        defaultto { self.retrieve_default_context(:selrange) }
+    end
+
+end
+

data/lib/puppet/type/group.rb

@@ -118,14 +118,6 @@ module Puppet
 
             defaultto false
         end
-
-        def retrieve
-            if self.provider and @provider.exists?
-                return super
-            else
-               return currentpropvalues(:absent) 
-            end
-        end
     end
 end
 

data/lib/puppet/type/package.rb

@@ -138,8 +138,8 @@ module Puppet
                             # that can't query versions.
                             return true
                         else
-                            self.debug "is is %s, latest %s is %s" %
-                                [is.inspect, @resource.name, @latest.inspect]
+                            self.debug "%s %s is installed, latest is %s" %
+                                [@resource.name, is.inspect, @latest.inspect]
                         end
                     when :absent
                         return true if is == :absent or is == :purged

data/lib/puppet/type/selboolean.rb

@@ -0,0 +1,31 @@
+#
+# Simple module for manageing SELinux booleans
+#
+
+module Puppet
+    newtype(:selboolean) do
+        @doc = "Manages SELinux booleans on systems with SELinux support.  The supported booleans
+            are any of the ones found in /selinux/booleans/."
+
+        newparam(:name) do
+            desc "The name of the SELinux boolean to be managed."
+            isnamevar
+        end
+
+        newproperty(:value) do
+            desc "Whether the the SELinux boolean should be enabled or disabled."
+            newvalue(:on)
+            newvalue(:off)
+        end
+
+        newparam(:persistent) do
+            desc "If set true, SELinux booleans will be written to disk and persist accross reboots.
+                The default is ``false``."
+
+            defaultto :false
+            newvalues(:true, :false)
+        end
+
+    end
+end
+

data/lib/puppet/type/selmodule.rb

@@ -0,0 +1,54 @@
+#
+# Simple module for manageing SELinux policy modules
+#
+
+Puppet::Type.newtype(:selmodule) do
+    @doc = "Manages loading and unloading of SELinux policy modules
+        on the system.  Requires SELinux support.  See man semodule(8)
+        for more information on SELinux policy modules."
+
+    ensurable
+
+    newparam(:name) do
+        desc "The name of the SELinux policy to be managed.  You should not
+            include the customary trailing .pp extension."
+        isnamevar
+    end
+
+    newparam(:selmoduledir) do
+
+        desc "The directory to look for the compiled pp module file in.
+            Currently defaults to /usr/share/selinux/targeted.  If selmodulepath
+            is not specified the module will be looked for in this directory in a
+            in a file called NAME.pp, where NAME is the value of the name parameter."
+
+        defaultto "/usr/share/selinux/targeted"
+    end
+
+    newparam(:selmodulepath) do
+
+        desc "The full path to the compiled .pp policy module.  You only need to use
+            this if the module file is not in the directory pointed at by selmoduledir."
+
+    end
+
+    newproperty(:syncversion) do
+
+        desc "If set to ``true``, the policy will be reloaded if the
+        version found in the on-disk file differs from the loaded
+        version.  If set to ``false`` (the default) the the only check
+        that will be made is if the policy is loaded at all or not."
+
+        newvalue(:true)
+        newvalue(:false)
+    end
+
+    autorequire(:file) do
+        if self[:selmodulepath]
+            [self[:selmodulepath]]
+        else
+            ["#{self[:selmoduledir]}/#{self[:name]}.pp"]
+        end       
+    end
+end
+

data/lib/puppet/type/ssh_authorized_key.rb

@@ -1,6 +1,7 @@
 module Puppet
     newtype(:ssh_authorized_key) do
-        @doc = "Manages ssh authorized keys."
+        @doc = "Manages SSH authorized keys. Currently only type 2 keys are
+        supported."
 
         ensurable
 
@@ -11,8 +12,7 @@ module Puppet
         end
 
         newproperty(:type) do
-            desc "The encryption type used.  Usually ssh-dss or ssh-rsa for
-                  SSH version 2. Not used for SSH version 1."
+            desc "The encryption type used: ssh-dss or ssh-rsa."
 
             newvalue("ssh-dss")
             newvalue("ssh-rsa")