puppet 0.24.5 → 0.24.6

data/lib/puppet/util/filetype.rb

@@ -1,8 +1,13 @@
 # Basic classes for reading, writing, and emptying files.  Not much
 # to see here.
+
+require 'puppet/util/selinux'
+
 class Puppet::Util::FileType
     attr_accessor :loaded, :path, :synced
 
+    include Puppet::Util::SELinux
+
     class << self
         attr_accessor :name
         include Puppet::Util::ClassGen
@@ -109,6 +114,8 @@ class Puppet::Util::FileType
             tf.print text; tf.flush 
             FileUtils.cp(tf.path, @path) 
             tf.close
+            # If SELinux is present, we need to ensure the file has its expected context
+            set_selinux_default_context(@path)
         end
     end
 

data/lib/puppet/util/ldap/connection.rb

@@ -17,7 +17,17 @@ class Puppet::Util::Ldap::Connection
               else
                   false
               end
-        new(Puppet[:ldapserver], Puppet[:ldapport], :ssl => ssl)
+
+        options = {}
+        options[:ssl] = ssl
+        if user = Puppet.settings[:ldapuser] and user != ""
+            options[:user] = user
+            if pass = Puppet.settings[:ldappassword] and pass != ""
+                options[:password] = pass
+            end
+        end
+
+        new(Puppet[:ldapserver], Puppet[:ldapport], options)
     end
 
     def close

data/lib/puppet/util/ldap/manager.rb

@@ -80,7 +80,7 @@ class Puppet::Util::Ldap::Manager
 
     # Calculate the dn for a given resource.
     def dn(name)
-        ["#{rdn.to_s}=%s" % name, base].join(",")
+        ["%s=%s" % [rdn, name], base].join(",")
     end
 
     # Convert an ldap-style entry hash to a provider-style hash.

data/lib/puppet/util/log.rb

@@ -1,10 +1,12 @@
 require 'syslog'
+require 'puppet/util/tagging'
 
 # Pass feedback to the user.  Log levels are modeled after syslog's, and it is
 # expected that that will be the most common log destination.  Supports
 # multiple destinations, one of which is a remote server.
 class Puppet::Util::Log
     include Puppet::Util
+    include Puppet::Util::Tagging
 
     @levels = [:debug,:info,:notice,:warning,:err,:alert,:emerg,:crit]
     @loglevel = 2
@@ -244,23 +246,31 @@ class Puppet::Util::Log
     newdesttype :console do
                 
         
-        PINK = {:console => "", :html => "FFA0A0"}
-        GREEN = {:console => "", :html => "00CD00"}
-        YELLOW = {:console => "", :html => "FFFF60"}
-        SLATE = {:console => "", :html => "80A0FF"}
-        ORANGE = {:console => "", :html => "FFA500"}
-        BLUE = {:console => "", :html => "40FFFF"}
-        RESET = {:console => "", :html => ""}
+        RED 	= {:console => "", :html => "FFA0A0"}
+        GREEN 	= {:console => "", :html => "00CD00"}
+        YELLOW 	= {:console => "", :html => "FFFF60"}
+        BLUE 	= {:console => "", :html => "80A0FF"}
+        PURPLE 	= {:console => "", :html => "FFA500"}
+        CYAN 	= {:console => "", :html => "40FFFF"}
+        WHITE	= {:console => "", :html => "FFFFFF"}
+        HRED	= {:console => "", :html => "FFA0A0"}
+        HGREEN 	= {:console => "", :html => "00CD00"}
+        HYELLOW	= {:console => "", :html => "FFFF60"}
+        HBLUE 	= {:console => "", :html => "80A0FF"}
+        HPURPLE	= {:console => "", :html => "FFA500"}
+        HCYAN 	= {:console => "", :html => "40FFFF"}
+        HWHITE	= {:console => "", :html => "FFFFFF"}
+        RESET 	= {:console => "", :html => ""}
 
         @@colormap = {
-            :debug => SLATE,
+            :debug => WHITE,
             :info => GREEN,
-            :notice => PINK,
-            :warning => ORANGE,
-            :err => YELLOW,
-            :alert => BLUE,
-            :emerg => RESET,
-            :crit => RESET
+            :notice => CYAN,
+            :warning => YELLOW,
+            :err => HPURPLE,
+            :alert => RED,
+            :emerg => HRED,
+            :crit => HRED
         }
         
         def colorize(level, str)
@@ -462,12 +472,12 @@ class Puppet::Util::Log
         @levels.include?(level)
     end
 
-    attr_accessor :level, :message, :time, :tags, :remote
+    attr_accessor :level, :message, :time, :remote
     attr_reader :source
 
     def initialize(args)
         unless args.include?(:level) && args.include?(:message)
-            raise Puppet::DevError, "Puppet::Util::Log called incorrectly"
+            raise ArgumentError, "Puppet::Util::Log called incorrectly"
         end
 
         if args[:level].class == String
@@ -475,35 +485,27 @@ class Puppet::Util::Log
         elsif args[:level].class == Symbol
             @level = args[:level]
         else
-            raise Puppet::DevError,
-                "Level is not a string or symbol: #{args[:level].class}"
+            raise ArgumentError, "Level is not a string or symbol: #{args[:level].class}"
         end
 
-        # Just return unless we're actually at a level we should send
-        #return unless self.class.sendlevel?(@level)
-
         @message = args[:message].to_s
         @time = Time.now
-        # this should include the host name, and probly lots of other
-        # stuff, at some point
-        unless self.class.validlevel?(level)
-            raise Puppet::DevError, "Invalid message level #{level}"
-        end
 
-        if args.include?(:tags)
-            @tags = args[:tags]
-        end
+        raise ArgumentError, "Invalid log level %s" % level unless self.class.validlevel?(level)
 
-        if args.include?(:source)
-            self.source = args[:source]
-        else
-            @source = "Puppet"
+        if tags = args[:tags]
+            tags.each { |t| self.tag(t) }
         end
 
+        self.source = args[:source] || "Puppet"
+
+        # Tag myself with my log level
+        tag(level)
+
         Log.newmessage(self)
     end
 
-    # Was the source of this log an object?
+    # Was the source of this log a Puppet resource or parameter?
     def objectsource?
         if defined? @objectsource and @objectsource
             @objectsource
@@ -525,17 +527,11 @@ class Puppet::Util::Log
             @objectsource = false
             @source = source.to_s
         end
-        unless defined? @tags and @tags
-            if source.respond_to?(:tags)
-                @tags = source.tags
-            end
+        if source.respond_to?(:tags)
+            source.tags.each { |t| tag(t) }
         end
     end
 
-    def tagged?(tag)
-        @tags.detect { |t| t.to_s == tag.to_s }
-    end
-
     def to_report
         "%s %s (%s): %s" % [self.time, self.source, self.level, self.to_s]
     end
@@ -544,5 +540,8 @@ class Puppet::Util::Log
         return @message
     end
 end
-Puppet::Log = Puppet::Util::Log
 
+# This is for backward compatibility from when we changed the constant to Puppet::Util::Log
+# because the reports include the constant name.  Apparently the alias was created in
+# March 2007, should could probably be removed soon.
+Puppet::Log = Puppet::Util::Log

data/lib/puppet/util/metric.rb

@@ -5,6 +5,8 @@ require 'puppet'
 class Puppet::Util::Metric
     
     # Load the library as a feature, so we can test its presence.
+    # It's only used by this class, so there's no reason to move it
+    # to the main feature list.
     Puppet.features.add :rrd, :libs => 'RRDtool'
 
     attr_accessor :type, :name, :value, :label
@@ -12,6 +14,15 @@ class Puppet::Util::Metric
 
     attr_writer :basedir
 
+    # Return a specific value
+    def [](name)
+        if value = @values.find { |v| v[0] == name }
+            return value[2]
+        else
+            return nil
+        end
+    end
+
     def basedir
         if defined? @basedir
             @basedir
@@ -93,11 +104,7 @@ class Puppet::Util::Metric
     def initialize(name,label = nil)
         @name = name.to_s
 
-        if label
-            @label = label
-        else
-            @label = name.to_s.capitalize.gsub("_", " ")
-        end
+        @label = label || labelize(name)
 
         @values = []
     end
@@ -107,9 +114,7 @@ class Puppet::Util::Metric
     end
 
     def newvalue(name,value,label = nil)
-        unless label
-            label = name.to_s.capitalize.gsub("_", " ")
-        end
+        label ||= labelize(name)
         @values.push [name,label,value]
     end
 
@@ -145,7 +150,16 @@ class Puppet::Util::Metric
     def values
         @values.sort { |a, b| a[1] <=> b[1] }
     end
+
+    private
+    
+    # Convert a name into a label.
+    def labelize(name)
+        name.to_s.capitalize.gsub("_", " ")
+    end
 end
 
+# This is necessary because we changed the class path in early 2007,
+# and reports directly yaml-dump these metrics, so both client and server
+# have to agree on the class name.
 Puppet::Metric = Puppet::Util::Metric
-

data/lib/puppet/util/posix.rb

@@ -3,23 +3,20 @@ module Puppet::Util::POSIX
 
     # Retrieve a field from a POSIX Etc object.  The id can be either an integer
     # or a name.  This only works for users and groups.  It's also broken on
-    # some platforms, unfortunately.
-    def old_get_posix_field(space, field, id)
-        unless id
-            raise ArgumentError, "Did not get id"
-        end
-        if id =~ /^\d+$/
-            id = Integer(id)
-        end
-        prefix = "get" + space.to_s
+    # some platforms, unfortunately, which is why we fall back to the other
+    # method search_posix_field in the gid and uid methods if a sanity check
+    # fails
+    def get_posix_field(space, field, id)
+        raise Puppet::DevError, "Did not get id from caller" unless id
+
         if id.is_a?(Integer)
             if id > Puppet[:maximum_uid].to_i
                 Puppet.err "Tried to get %s field for silly id %s" % [field, id]
                 return nil
             end
-            method = (prefix + idfield(space).to_s).intern
+            method = methodbyid(space)
         else
-            method = (prefix + "nam").intern
+            method = methodbyname(space)
         end
 
         begin
@@ -31,13 +28,11 @@ module Puppet::Util::POSIX
     end
 
     # A degenerate method of retrieving name/id mappings.  The job of this method is
-    # to find a specific entry and then return a given field from that entry.
-    def get_posix_field(type, field, id)
+    # to retrieve all objects of a certain type, search for a specific entry 
+    # and then return a given field from that entry.
+    def search_posix_field(type, field, id)
         idmethod = idfield(type)
         integer = false
-        if id =~ /^\d+$/
-            id = Integer(id)
-        end
         if id.is_a?(Integer)
             integer = true
             if id > Puppet[:maximum_uid].to_i
@@ -112,14 +107,70 @@ module Puppet::Util::POSIX
         end
     end
     
+    # Determine what the method is to get users and groups by id
+    def methodbyid(space)
+        case Puppet::Util.symbolize(space)
+        when :gr, :group: return :getgrgid
+        when :pw, :user, :passwd: return :getpwuid
+        else
+            raise ArgumentError.new("Can only handle users and groups")
+        end
+    end
+    
+    # Determine what the method is to get users and groups by name
+    def methodbyname(space)
+        case Puppet::Util.symbolize(space)
+        when :gr, :group: return :getgrnam
+        when :pw, :user, :passwd: return :getpwnam
+        else
+            raise ArgumentError.new("Can only handle users and groups")
+        end
+    end
+    
     # Get the GID of a given group, provided either a GID or a name
     def gid(group)
-        get_posix_field(:group, :gid, group)
+        begin
+            group = Integer(group)
+        rescue ArgumentError
+            # pass
+        end
+        if group.is_a?(Integer)
+            return nil unless name = get_posix_field(:group, :name, group)
+            gid = get_posix_field(:group, :gid, name)
+            check_value = gid
+        else
+            return nil unless gid = get_posix_field(:group, :gid, group)
+            name = get_posix_field(:group, :name, gid)
+            check_value = name
+        end
+        if check_value != group
+            return search_posix_field(:group, :gid, group)
+        else
+            return gid
+        end
     end
 
     # Get the UID of a given user, whether a UID or name is provided
     def uid(user)
-        get_posix_field(:passwd, :uid, user)
+        begin
+            user = Integer(user)
+        rescue ArgumentError
+            # pass
+        end
+        if user.is_a?(Integer)
+            return nil unless name = get_posix_field(:passwd, :name, user)
+            uid = get_posix_field(:passwd, :uid, name)
+            check_value = uid
+        else
+            return nil unless uid = get_posix_field(:passwd, :uid, user)
+            name = get_posix_field(:passwd, :name, uid)
+            check_value = name
+        end
+        if check_value != user
+            return search_posix_field(:passwd, :uid, user)
+        else
+            return uid
+        end
     end
 end
 

data/lib/puppet/util/selinux.rb

@@ -0,0 +1,139 @@
+# Provides utility functions to help interfaces Puppet to SELinux.
+#
+# Currently this is implemented via the command line tools.  At some
+# point support should be added to use the new SELinux ruby bindings
+# as that will be faster and more reliable then shelling out when they
+# are available.  At this time (2008-09-26) these bindings aren't bundled on
+# any SELinux-using distribution I know of.
+
+require 'puppet/util'
+
+module Puppet::Util::SELinux
+
+    include Puppet::Util
+
+    def selinux_support?
+        FileTest.exists?("/selinux/enforce")
+    end
+
+    # Retrieve and return the full context of the file.  If we don't have
+    # SELinux support or if the stat call fails then return nil.
+    def get_selinux_current_context(file)
+        unless selinux_support?
+            return nil
+        end
+        context = ""
+        begin
+            execpipe("/usr/bin/stat -c %C #{file}") do |out|
+                out.each do |line|
+                    context << line
+                end
+            end
+        rescue Puppet::ExecutionFailure
+            return nil
+        end
+        context.chomp!
+        # Handle the case that the system seems to have SELinux support but
+        # stat finds unlabled files.
+        if context == "(null)"
+            return nil
+        end
+        return context
+    end
+
+    # Use the matchpathcon command, if present, to return the SELinux context
+    # which the SELinux policy on the system expects the file to have.  We can
+    # use this to obtain a good default context.  If the command does not
+    # exist or the call fails return nil.
+    #
+    # Note: For this command to work a full, non-relative, filesystem path
+    # should be given.
+    def get_selinux_default_context(file)
+        unless selinux_support?
+            return nil
+        end
+        unless FileTest.executable?("/usr/sbin/matchpathcon")
+            return nil
+        end
+        context = ""
+        begin
+            execpipe("/usr/sbin/matchpathcon #{file}") do |out|
+                out.each do |line|
+                    context << line
+                end
+            end
+        rescue Puppet::ExecutionFailure
+            return nil
+        end
+        # For a successful match, matchpathcon returns two fields separated by
+        # a variable amount of whitespace.  The second field is the full context.
+        context = context.split(/\s/)[1]
+        return context
+    end
+
+    # Take the full SELinux context returned from the tools and parse it
+    # out to the three (or four) component parts.  Supports :seluser, :selrole,
+    # :seltype, and on systems with range support, :selrange.
+    def parse_selinux_context(component, context)
+        if context.nil? or context == "unlabeled"
+            return nil
+        end
+        unless context =~ /^([a-z0-9_]+):([a-z0-9_]+):([a-z0-9_]+)(?::([a-zA-Z0-9:,._-]+))?/
+            raise Puppet::Error, "Invalid context to parse: #{context}"
+        end
+        ret = {
+            :seluser => $1,
+            :selrole => $2,
+            :seltype => $3,
+            :selrange => $4,
+        }
+        return ret[component]
+    end
+
+    # This updates the actual SELinux label on the file.  You can update
+    # only a single component or update the entire context.  It is just a
+    # wrapper around the chcon command.
+    def set_selinux_context(file, value, component = false)
+        unless selinux_support?
+            return nil
+        end
+        case component
+            when :seluser
+                flag = "-u"
+            when :selrole
+                flag = "-r"
+            when :seltype
+                flag = "-t"
+            when :selrange
+                flag = "-l"
+            else
+                flag = nil
+        end
+
+        if flag.nil?
+            cmd = ["/usr/bin/chcon","-h",value,file]
+        else
+            cmd = ["/usr/bin/chcon","-h",flag,value,file]
+        end
+        execute(cmd)
+        return true
+    end
+
+    # Since this call relies on get_selinux_default_context it also needs a
+    # full non-relative path to the file.  Fortunately, that seems to be all
+    # Puppet uses.  This will set the file's SELinux context to the policy's
+    # default context (if any) if it differs from the context currently on
+    # the file.
+    def set_selinux_default_context(file)
+        new_context = get_selinux_default_context(file)
+        unless new_context
+            return nil
+        end
+        cur_context = get_selinux_current_context(file)
+        if new_context != cur_context
+            set_selinux_context(file, new_context)
+            return new_context
+        end
+        return nil
+    end
+end