puppet 3.3.2 → 3.4.0.rc1

data/spec/integration/type/file_spec.rb

@@ -21,21 +21,28 @@ describe Puppet::Type.type(:file) do
     File.join(parent, 'file_testing')
   end
 
+  let(:dir) do
+    # we create a directory first so backups of :path that are stored in
+    # the same directory will also be removed after the tests
+    parent = tmpdir('file_spec')
+    File.join(parent, 'dir_testing')
+  end
+
   if Puppet.features.posix?
     def set_mode(mode, file)
       File.chmod(mode, file)
     end
 
     def get_mode(file)
-      File.lstat(file).mode
+      Puppet::FileSystem::File.new(file).lstat.mode
     end
 
     def get_owner(file)
-      File.lstat(file).uid
+      Puppet::FileSystem::File.new(file).lstat.uid
     end
 
     def get_group(file)
-      File.lstat(file).gid
+      Puppet::FileSystem::File.new(file).lstat.gid
     end
   else
     class SecurityHelper
@@ -57,6 +64,10 @@ describe Puppet::Type.type(:file) do
     def get_group(file)
       SecurityHelper.get_group(file)
     end
+
+    def get_aces_for_path_by_sid(path, sid)
+      SecurityHelper.get_aces_for_path_by_sid(path, sid)
+    end
   end
 
   before do
@@ -72,7 +83,7 @@ describe Puppet::Type.type(:file) do
     status = catalog.apply.report.resource_statuses["File[#{source}]"]
     status.should_not be_failed
     status.should_not be_changed
-    File.should_not be_exist(source)
+    Puppet::FileSystem::File.exist?(source).should be_false
   end
 
   describe "when ensure is absent" do
@@ -81,14 +92,14 @@ describe Puppet::Type.type(:file) do
       catalog.add_resource(described_class.new(:path => path, :ensure => :absent, :backup => :false))
       report = catalog.apply.report
       report.resource_statuses["File[#{path}]"].should_not be_failed
-      File.should_not be_exist(path)
+      Puppet::FileSystem::File.exist?(path).should be_false
     end
 
     it "should do nothing if file is not present" do
       catalog.add_resource(described_class.new(:path => path, :ensure => :absent, :backup => :false))
       report = catalog.apply.report
       report.resource_statuses["File[#{path}]"].should_not be_failed
-      File.should_not be_exist(path)
+      Puppet::FileSystem::File.exist?(path).should be_false
     end
 
     # issue #14599
@@ -204,7 +215,7 @@ describe Puppet::Type.type(:file) do
         end
       end
 
-      describe "for links", :unless => Puppet.features.microsoft_windows? do
+      describe "for links", :if => described_class.defaultprovider.feature?(:manages_symlinks) do
         let(:link) { tmpfile('link_mode') }
 
         describe "when managing links" do
@@ -214,7 +225,7 @@ describe Puppet::Type.type(:file) do
             FileUtils.touch(link_target)
             File.chmod(0444, link_target)
 
-            File.symlink(link_target, link)
+            Puppet::FileSystem::File.new(link_target).symlink(link)
           end
 
           it "should not set the executable bit on the link nor the target" do
@@ -222,8 +233,8 @@ describe Puppet::Type.type(:file) do
 
             catalog.apply
 
-            (File.stat(link).mode & 07777) == 0666
-            (File.lstat(link_target).mode & 07777) == 0444
+            (Puppet::FileSystem::File.new(link).stat.mode & 07777) == 0666
+            (Puppet::FileSystem::File.new(link_target).lstat.mode & 07777) == 0444
           end
 
           it "should ignore dangling symlinks (#6856)" do
@@ -232,7 +243,7 @@ describe Puppet::Type.type(:file) do
             catalog.add_resource described_class.new(:path => link, :ensure => :link, :mode => 0666, :target => link_target, :links => :manage)
             catalog.apply
 
-            File.should_not be_exist(link)
+            Puppet::FileSystem::File.exist?(link).should be_false
           end
 
           it "should create a link to the target if ensure is omitted" do
@@ -240,9 +251,9 @@ describe Puppet::Type.type(:file) do
             catalog.add_resource described_class.new(:path => link, :target => link_target)
             catalog.apply
 
-            File.should be_exist link
-            File.lstat(link).ftype.should == 'link'
-            File.readlink(link).should == link_target
+            Puppet::FileSystem::File.exist?(link).should be_true
+            Puppet::FileSystem::File.new(link).lstat.ftype.should == 'link'
+            Puppet::FileSystem::File.new(link).readlink().should == link_target
           end
         end
 
@@ -251,7 +262,7 @@ describe Puppet::Type.type(:file) do
             target = tmpfile('dangling')
 
             FileUtils.touch(target)
-            File.symlink(target, link)
+            Puppet::FileSystem::File.new(target).symlink(link)
             File.delete(target)
 
             catalog.add_resource described_class.new(:path => path, :source => link, :mode => 0600, :links => :follow)
@@ -264,7 +275,7 @@ describe Puppet::Type.type(:file) do
             before :each do
               File.chmod(0600, link_target)
 
-              File.symlink(link_target, link)
+              Puppet::FileSystem::File.new(link_target).symlink(link)
             end
 
             after :each do
@@ -327,7 +338,7 @@ describe Puppet::Type.type(:file) do
             before :each do
               FileUtils.touch(link_target)
 
-              File.symlink(link_target, link)
+              Puppet::FileSystem::File.new(link_target).symlink(link)
             end
 
             it "should create the file, not a symlink (#2817, #10315)" do
@@ -357,8 +368,8 @@ describe Puppet::Type.type(:file) do
               File.chmod(0666, real_target)
 
               # link -> target -> real_target
-              File.symlink(real_target, target)
-              File.symlink(target, link)
+              Puppet::FileSystem::File.new(real_target).symlink(target)
+              Puppet::FileSystem::File.new(target).symlink(link)
             end
 
             after :each do
@@ -397,13 +408,13 @@ describe Puppet::Type.type(:file) do
       catalog.add_resource file
       catalog.add_resource filebucket
 
-      File.open(file[:path], "wb") { |f| f.puts "bar" }
+      File.open(file[:path], "w") { |f| f.write("bar") }
 
-      md5 = Digest::MD5.hexdigest(IO.binread(file[:path]))
+      md5 = Digest::MD5.hexdigest("bar")
 
       catalog.apply
 
-      filebucket.bucket.getfile(md5).should == "bar\n"
+      filebucket.bucket.getfile(md5).should == "bar"
     end
 
     it "should backup files in the local directory when a backup string is provided" do
@@ -415,7 +426,7 @@ describe Puppet::Type.type(:file) do
       catalog.apply
 
       backup = file[:path] + ".bak"
-      FileTest.should be_exist(backup)
+      Puppet::FileSystem::File.exist?(backup).should be_true
       File.read(backup).should == "bar\n"
     end
 
@@ -437,7 +448,7 @@ describe Puppet::Type.type(:file) do
       File.read(file[:path]).should == "bar\n"
     end
 
-    it "should not backup symlinks", :unless => Puppet.features.microsoft_windows? do
+    it "should not backup symlinks", :if => described_class.defaultprovider.feature?(:manages_symlinks) do
       link = tmpfile("link")
       dest1 = tmpfile("dest1")
       dest2 = tmpfile("dest2")
@@ -447,14 +458,14 @@ describe Puppet::Type.type(:file) do
       catalog.add_resource bucket
 
       File.open(dest1, "w") { |f| f.puts "whatever" }
-      File.symlink(dest1, link)
+      Puppet::FileSystem::File.new(dest1).symlink(link)
 
       md5 = Digest::MD5.hexdigest(File.read(file[:path]))
 
       catalog.apply
 
-      File.readlink(link).should == dest2
-      File.exist?(bucket[:path]).should be_false
+      Puppet::FileSystem::File.new(link).readlink().should == dest2
+      Puppet::FileSystem::File.exist?(bucket[:path]).should be_false
     end
 
     it "should backup directories to the local filesystem by copying the whole directory" do
@@ -574,7 +585,7 @@ describe Puppet::Type.type(:file) do
       end
     end
 
-    it "should be able to recursively make links to other files", :unless => Puppet.features.microsoft_windows? do
+    it "should be able to recursively make links to other files", :if => described_class.defaultprovider.feature?(:manages_symlinks) do
       source = tmpfile("file_link_integration_source")
 
       build_path(source)
@@ -590,13 +601,13 @@ describe Puppet::Type.type(:file) do
       @dirs.each do |path|
         link_path = path.sub(source, dest)
 
-        File.lstat(link_path).should be_directory
+        Puppet::FileSystem::File.new(link_path).lstat.should be_directory
       end
 
       @files.each do |path|
         link_path = path.sub(source, dest)
 
-        File.lstat(link_path).ftype.should == "link"
+        Puppet::FileSystem::File.new(link_path).lstat.ftype.should == "link"
       end
     end
 
@@ -616,13 +627,13 @@ describe Puppet::Type.type(:file) do
       @dirs.each do |path|
         newpath = path.sub(source, dest)
 
-        File.lstat(newpath).should be_directory
+        Puppet::FileSystem::File.new(newpath).lstat.should be_directory
       end
 
       @files.each do |path|
         newpath = path.sub(source, dest)
 
-        File.lstat(newpath).ftype.should == "file"
+        Puppet::FileSystem::File.new(newpath).lstat.ftype.should == "file"
       end
     end
 
@@ -685,8 +696,8 @@ describe Puppet::Type.type(:file) do
             catalog.apply
 
             File.should be_directory(path)
-            File.should_not be_exist(File.join(path, 'one'))
-            File.should be_exist(File.join(path, 'three', 'four'))
+            Puppet::FileSystem::File.exist?(File.join(path, 'one')).should be_false
+            Puppet::FileSystem::File.exist?(File.join(path, 'three', 'four')).should be_true
           end
 
           it "should recursively copy an empty directory" do
@@ -707,7 +718,7 @@ describe Puppet::Type.type(:file) do
             catalog.apply
 
             File.should be_directory(path)
-            File.should_not be_exist(File.join(path, 'a'))
+            Puppet::FileSystem::File.exist?(File.join(path, 'a')).should be_false
           end
 
           it "should only recurse one level" do
@@ -731,9 +742,9 @@ describe Puppet::Type.type(:file) do
 
             catalog.apply
 
-            File.should be_exist(File.join(path, 'a'))
-            File.should_not be_exist(File.join(path, 'a', 'b'))
-            File.should_not be_exist(File.join(path, 'z'))
+            Puppet::FileSystem::File.exist?(File.join(path, 'a')).should be_true
+            Puppet::FileSystem::File.exist?(File.join(path, 'a', 'b')).should be_false
+            Puppet::FileSystem::File.exist?(File.join(path, 'z')).should be_false
           end
         end
 
@@ -830,10 +841,10 @@ describe Puppet::Type.type(:file) do
             catalog.add_resource obj
             catalog.apply
 
-            File.should be_exist(File.join(path, 'a'))
-            File.should_not be_exist(File.join(path, 'a', 'b'))
-            File.should be_exist(File.join(path, 'z'))
-            File.should_not be_exist(File.join(path, 'z', 'y'))
+            Puppet::FileSystem::File.exist?(File.join(path, 'a')).should be_true
+            Puppet::FileSystem::File.exist?(File.join(path, 'a', 'b')).should be_false
+            Puppet::FileSystem::File.exist?(File.join(path, 'z')).should be_true
+            Puppet::FileSystem::File.exist?(File.join(path, 'z', 'y')).should be_false
           end
         end
       end
@@ -897,7 +908,7 @@ describe Puppet::Type.type(:file) do
 
       expected_mode = Puppet.features.microsoft_windows? ? 0644 : 0755
       File.read(dest).should == "foo"
-      (File.stat(dest).mode & 007777).should == expected_mode
+      (Puppet::FileSystem::File.new(dest).stat.mode & 007777).should == expected_mode
     end
 
     it "should be able to copy individual files even if recurse has been specified" do
@@ -949,7 +960,7 @@ describe Puppet::Type.type(:file) do
     catalog.add_resource file
     catalog.apply
 
-    File.should_not be_exist(dest)
+    Puppet::FileSystem::File.exist?(dest).should be_false
   end
 
   describe "when sourcing" do
@@ -991,6 +1002,38 @@ describe Puppet::Type.type(:file) do
     end
 
     describe "on Windows systems", :if => Puppet.features.microsoft_windows? do
+      def expects_sid_granted_full_access_explicitly(path, sid)
+        inherited_ace = Windows::Security::INHERITED_ACE
+
+        aces = get_aces_for_path_by_sid(path, sid)
+        aces.should_not be_empty
+
+        aces.each do |ace|
+          ace.mask.should == Windows::File::FILE_ALL_ACCESS
+          (ace.flags & inherited_ace).should_not == inherited_ace
+        end
+      end
+
+      def expects_system_granted_full_access_explicitly(path)
+        expects_sid_granted_full_access_explicitly(path, @sids[:system])
+      end
+
+      def expects_at_least_one_inherited_ace_grants_full_access(path, sid)
+        inherited_ace = Windows::Security::INHERITED_ACE
+
+        aces = get_aces_for_path_by_sid(path, sid)
+        aces.should_not be_empty
+
+        aces.any? do |ace|
+          ace.mask == Windows::File::FILE_ALL_ACCESS &&
+            (ace.flags & inherited_ace) == inherited_ace
+        end.should be_true
+      end
+
+      def expects_at_least_one_inherited_system_ace_grants_full_access(path)
+        expects_at_least_one_inherited_ace_grants_full_access(path, @sids[:system])
+      end
+
       it "should provide valid default values when ACLs are not supported" do
         Puppet::Util::Windows::Security.stubs(:supports_acl?).with(source).returns false
 
@@ -1008,6 +1051,205 @@ describe Puppet::Type.type(:file) do
         get_group(path).should =~ /^S\-1\-0\-0.*$/
         get_mode(path).should == 0644
       end
+
+      describe "when processing SYSTEM ACEs" do
+        before do
+          @sids = {
+            :current_user => Puppet::Util::Windows::Security.name_to_sid(Sys::Admin.get_login),
+            :system => Win32::Security::SID::LocalSystem,
+            :admin => Puppet::Util::Windows::Security.name_to_sid("Administrator"),
+            :guest => Puppet::Util::Windows::Security.name_to_sid("Guest"),
+            :users => Win32::Security::SID::BuiltinUsers,
+            :power_users => Win32::Security::SID::PowerUsers,
+            :none => Win32::Security::SID::Nobody
+          }
+        end
+
+        describe "on files" do
+          before :each do
+            @file = described_class.new(
+              :path   => path,
+              :ensure => :file,
+              :source => source,
+              :backup => false
+            )
+            catalog.add_resource @file
+          end
+
+          describe "when source permissions are ignored" do
+            before :each do
+              @file[:source_permissions] = :ignore
+            end
+
+            it "preserves the inherited SYSTEM ACE" do
+              catalog.apply
+
+              expects_at_least_one_inherited_system_ace_grants_full_access(path)
+            end
+          end
+
+          describe "when permissions are insync?" do
+            it "preserves the explicit SYSTEM ACE" do
+              FileUtils.touch(path)
+
+              sd = Puppet::Util::Windows::Security.get_security_descriptor(path)
+              sd.protect = true
+              sd.owner = @sids[:none]
+              sd.group = @sids[:none]
+              Puppet::Util::Windows::Security.set_security_descriptor(source, sd)
+              Puppet::Util::Windows::Security.set_security_descriptor(path, sd)
+
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(path)
+            end
+          end
+
+          describe "when permissions are not insync?" do
+            before :each do
+              @file[:owner] = 'None'
+              @file[:group] = 'None'
+            end
+
+            it "replaces inherited SYSTEM ACEs with an uninherited one for an existing file" do
+              FileUtils.touch(path)
+
+              expects_at_least_one_inherited_system_ace_grants_full_access(path)
+
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(path)
+            end
+
+            it "replaces inherited SYSTEM ACEs for a new file with an uninherited one" do
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(path)
+            end
+          end
+
+          describe "created with SYSTEM as the group" do
+            before :each do
+              @file[:owner] = @sids[:users]
+              @file[:group] = @sids[:system]
+              @file[:mode] = 0644
+
+              catalog.apply
+            end
+
+            it "should allow the user to explicitly set the mode to 4" do
+              system_aces = get_aces_for_path_by_sid(path, @sids[:system])
+              system_aces.should_not be_empty
+
+              system_aces.each do |ace|
+                ace.mask.should == Windows::File::FILE_GENERIC_READ
+              end
+            end
+
+            it "prepends SYSTEM ace when changing group from system to power users" do
+              @file[:group] = @sids[:power_users]
+              catalog.apply
+
+              system_aces = get_aces_for_path_by_sid(path, @sids[:system])
+              system_aces.size.should == 1
+            end
+          end
+        end
+
+        describe "on directories" do
+          before :each do
+            @directory = described_class.new(
+              :path   => dir,
+              :ensure => :directory
+            )
+            catalog.add_resource @directory
+          end
+
+          describe "when source permissions are ignored" do
+            before :each do
+              @directory[:source_permissions] = :ignore
+            end
+
+            it "preserves the inherited SYSTEM ACE" do
+              catalog.apply
+
+              expects_at_least_one_inherited_system_ace_grants_full_access(dir)
+            end
+          end
+
+          describe "when permissions are insync?" do
+            it "preserves the explicit SYSTEM ACE" do
+              Dir.mkdir(dir)
+
+              source_dir = tmpdir('source_dir')
+              @directory[:source] = source_dir
+
+              sd = Puppet::Util::Windows::Security.get_security_descriptor(source_dir)
+              sd.protect = true
+              sd.owner = @sids[:none]
+              sd.group = @sids[:none]
+              Puppet::Util::Windows::Security.set_security_descriptor(source_dir, sd)
+              Puppet::Util::Windows::Security.set_security_descriptor(dir, sd)
+
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(dir)
+            end
+          end
+
+          describe "when permissions are not insync?" do
+            before :each do
+              @directory[:owner] = 'None'
+              @directory[:group] = 'None'
+              @directory[:mode] = 0444
+            end
+
+            it "replaces inherited SYSTEM ACEs with an uninherited one for an existing directory" do
+              FileUtils.mkdir(dir)
+
+              expects_at_least_one_inherited_system_ace_grants_full_access(dir)
+
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(dir)
+            end
+
+            it "replaces inherited SYSTEM ACEs with an uninherited one for an existing directory" do
+              catalog.apply
+
+              expects_system_granted_full_access_explicitly(dir)
+            end
+
+            describe "created with SYSTEM as the group" do
+              before :each do
+                @directory[:owner] = @sids[:users]
+                @directory[:group] = @sids[:system]
+                @directory[:mode] = 0644
+
+                catalog.apply
+              end
+
+              it "should allow the user to explicitly set the mode to 4" do
+                system_aces = get_aces_for_path_by_sid(dir, @sids[:system])
+                system_aces.should_not be_empty
+
+                system_aces.each do |ace|
+                  # unlike files, Puppet sets execute bit on directories that are readable
+                  ace.mask.should == Windows::File::FILE_GENERIC_READ | Windows::File::FILE_GENERIC_EXECUTE
+                end
+              end
+
+              it "prepends SYSTEM ace when changing group from system to power users" do
+                @directory[:group] = @sids[:power_users]
+                catalog.apply
+
+                system_aces = get_aces_for_path_by_sid(dir, @sids[:system])
+                system_aces.size.should == 1
+              end
+            end
+          end
+        end
+      end
     end
   end
 
@@ -1056,7 +1298,7 @@ describe Puppet::Type.type(:file) do
     end
 
     it "should purge files that are neither remote nor otherwise managed" do
-      FileTest.should_not be_exist(@purgee)
+      Puppet::FileSystem::File.exist?(@purgee).should be_false
     end
   end