puppet 3.3.2 → 3.4.0.rc1

data/spec/integration/type/tidy_spec.rb

@@ -12,12 +12,12 @@ describe Puppet::Type.type(:tidy) do
   end
 
   # Testing #355.
-  it "should be able to remove dead links", :unless => Puppet.features.microsoft_windows? do
+  it "should be able to remove dead links", :if => Puppet.features.manages_symlinks? do
     dir = tmpfile("tidy_link_testing")
     link = File.join(dir, "link")
     target = tmpfile("no_such_file_tidy_link_testing")
     Dir.mkdir(dir)
-    File.symlink(target, link)
+    Puppet::FileSystem::File.new(target).symlink(link)
 
     tidy = Puppet::Type.type(:tidy).new :path => dir, :recurse => true
 
@@ -26,6 +26,6 @@ describe Puppet::Type.type(:tidy) do
 
     catalog.apply
 
-    FileTest.should_not be_symlink(link)
+    Puppet::FileSystem::File.new(link).symlink?.should be_false
   end
 end

data/spec/integration/util/rdoc/parser_spec.rb

@@ -1,60 +1,261 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
+require 'puppet/util/rdoc'
 
-describe "RDoc::Parser", :if => Puppet.features.rdoc1? do
+describe "RDoc::Parser" do
   require 'puppet_spec/files'
   include PuppetSpec::Files
 
-  before :all do
-    require 'puppet/resource/type_collection'
-    require 'puppet/util/rdoc/parser'
-    require 'puppet/util/rdoc'
-    require 'puppet/util/rdoc/code_objects'
-    require 'rdoc/options'
-    require 'rdoc/rdoc'
+  let(:document_all) { false }
+  let(:tmp_dir) { tmpdir('rdoc_parser_tmp') }
+  let(:doc_dir) { File.join(tmp_dir, 'doc') }
+  let(:manifests_dir) { File.join(tmp_dir, 'manifests') }
+  let(:modules_dir) { File.join(tmp_dir, 'modules') }
+
+  let(:modules_and_manifests) do
+    {
+      :site => [
+        File.join(manifests_dir, 'site.pp'),
+        <<-EOF
+# The test class comment
+class test {
+  # The virtual resource comment
+  @notify { virtual: }
+  # The a_notify_resource comment
+  notify { a_notify_resource:
+    message => "a_notify_resource message"
+  }
+}
+
+# The includes_another class comment
+class includes_another {
+  include another
+}
+
+# The requires_another class comment
+class requires_another {
+  require another
+}
+
+# node comment
+node foo {
+  include test
+  $a_var = "var_value"
+  realize Notify[virtual]
+  notify { bar: }
+}
+        EOF
+      ],
+      :module_readme => [
+        File.join(modules_dir, 'a_module', 'README'),
+        <<-EOF
+The a_module README docs.
+        EOF
+      ],
+      :module_init => [
+        File.join(modules_dir, 'a_module', 'manifests', 'init.pp'),
+        <<-EOF
+# The a_module class comment
+class a_module {}
+
+class another {}
+        EOF
+      ],
+      :module_type => [
+        File.join(modules_dir, 'a_module', 'manifests', 'a_type.pp'),
+        <<-EOF
+# The a_type type comment
+define a_module::a_type() {}
+        EOF
+      ],
+      :module_plugin => [
+        File.join(modules_dir, 'a_module', 'lib', 'puppet', 'type', 'a_plugin.rb'),
+        <<-EOF
+# The a_plugin type comment
+Puppet::Type.newtype(:a_plugin) do
+  @doc = "Not presented"
+end
+        EOF
+      ],
+      :module_function => [
+        File.join(modules_dir, 'a_module', 'lib', 'puppet', 'parser', 'a_function.rb'),
+        <<-EOF
+# The a_function function comment
+module Puppet::Parser::Functions
+  newfunction(:a_function, :type => :rvalue) do
+    return
+  end
+end
+        EOF
+      ],
+      :module_fact => [
+        File.join(modules_dir, 'a_module', 'lib', 'facter', 'a_fact.rb'),
+        <<-EOF
+# The a_fact fact comment
+Facter.add("a_fact") do
+end
+        EOF
+      ],
+    }
   end
 
-  before :each do
-    tmpdir = tmpfile('rdoc_parser_tmp')
-    Dir.mkdir(tmpdir)
-    @parsedfile = File.join(tmpdir, 'init.pp')
+  def write_file(file, content)
+    FileUtils.mkdir_p(File.dirname(file))
+    File.open(file, 'w') do |f|
+      f.puts(content)
+    end
+  end
 
-    File.open(@parsedfile, 'w') do |f|
-      f.puts '# comment'
-      f.puts 'class ::test {}'
+  def prepare_manifests_and_modules
+    modules_and_manifests.each do |key,array|
+      write_file(*array)
     end
+  end
+
+  def file_exists_and_matches_content(file, *content_patterns)
+    Puppet::FileSystem::File.exist?(file).should(be_true, "Cannot find #{file}")
+    content_patterns.each do |pattern|
+      content = File.read(file)
+      content.should match(pattern)
+    end
+  end
 
-    @top_level = stub_everything 'toplevel', :file_relative_name => @parsedfile
-    @module = stub_everything 'module'
-    @puppet_top_level = RDoc::PuppetTopLevel.new(@top_level)
-    RDoc::PuppetTopLevel.stubs(:new).returns(@puppet_top_level)
-    @puppet_top_level.expects(:add_module).returns(@module)
-    @parser = RDoc::Parser.new(@top_level, @parsedfile, nil, Options.instance, RDoc::Stats.new)
+  def some_file_exists_with_matching_content(glob, *content_patterns)
+    Dir.glob(glob).select do |f|
+      contents = File.read(f)
+      content_patterns.all? { |p| p.match(contents) }
+    end.should_not(be_empty, "Could not match #{content_patterns} in any of the files found in #{glob}")
   end
 
-  after(:each) do
-    File.unlink(@parsedfile)
+  before :each do
+    prepare_manifests_and_modules
+    Puppet.settings[:document_all] = document_all
+    Puppet.settings[:modulepath] = modules_dir
+    Puppet::Util::RDoc.rdoc(doc_dir, [modules_dir, manifests_dir])
   end
 
-  def get_test_class(toplevel)
-    # toplevel -> main -> test
-    toplevel.classes[0].classes[0]
+  module RdocTesters
+    def has_module_rdoc(module_name, *other_test_patterns)
+      file_exists_and_matches_content(module_path(module_name), /Module:? +#{module_name}/i, *other_test_patterns)
+    end
+
+    def has_node_rdoc(module_name, node_name, *other_test_patterns)
+      file_exists_and_matches_content(node_path(module_name, node_name), /#{node_name}/, /node comment/, *other_test_patterns)
+    end
+
+    def has_defined_type(module_name, type_name)
+      file_exists_and_matches_content(module_path(module_name), /#{type_name}.*?\(\s*\)/m, "The .*?#{type_name}.*? type comment")
+    end
+
+    def has_class_rdoc(module_name, class_name, *other_test_patterns)
+      file_exists_and_matches_content(class_path(module_name, class_name), /#{class_name}.*? class comment/, *other_test_patterns)
+    end
+
+    def has_plugin_rdoc(module_name, type, name)
+      file_exists_and_matches_content(plugin_path(module_name, type, name), /The .*?#{name}.*?\s*#{type} comment/m, /Type.*?#{type}/m)
+    end
   end
 
-  it "should parse to RDoc data structure" do
-    @parser.expects(:document_class).with { |n,k,c| n == "::test" and k.is_a?(Puppet::Resource::Type) }
-    @parser.scan
+  shared_examples_for :an_rdoc_site do
+    it "documents the __site__ module" do
+      has_module_rdoc("__site__")
+    end
+
+    it "documents the __site__::test class" do
+      has_class_rdoc("__site__", "test")
+    end
+
+    it "documents the __site__::foo node" do
+      has_node_rdoc("__site__", "foo")
+    end
+
+    it "documents the a_module module" do
+      has_module_rdoc("a_module", /The .*?a_module.*? .*?README.*?docs/m)
+    end
+
+    it "documents the a_module::a_module class" do
+      has_class_rdoc("a_module", "a_module")
+    end
+
+    it "documents the a_module::a_type defined type" do
+      has_defined_type("a_module", "a_type")
+    end
+
+    it "documents the a_module::a_plugin type" do
+      has_plugin_rdoc("a_module", :type, 'a_plugin')
+    end
+
+    it "documents the a_module::a_function function" do
+      has_plugin_rdoc("a_module", :function, 'a_function')
+    end
+
+    it "documents the a_module::a_fact fact" do
+      has_plugin_rdoc("a_module", :fact, 'a_fact')
+    end
+
+    it "documents included classes" do
+      has_class_rdoc("__site__", "includes_another", /Included.*?another/m)
+    end
   end
 
-  it "should get a PuppetClass for the main class" do
-    @parser.scan.classes[0].should be_a(RDoc::PuppetClass)
+  shared_examples_for :an_rdoc1_site do
+    it "documents required classes" do
+      has_class_rdoc("__site__", "requires_another", /Required Classes.*?another/m)
+    end
+
+    it "documents realized resources" do
+      has_node_rdoc("__site__", "foo", /Realized Resources.*?Notify\[virtual\]/m)
+    end
+
+    it "documents global variables" do
+      has_node_rdoc("__site__", "foo", /Global Variables.*?a_var.*?=.*?var_value/m)
+    end
+
+    describe "when document_all is true" do
+      let(:document_all) { true }
+
+      it "documents virtual resource declarations" do
+        has_class_rdoc("__site__", "test", /Resources.*?Notify\[virtual\]/m, /The virtual resource comment/)
+      end
+
+      it "documents resources" do
+        has_class_rdoc("__site__", "test", /Resources.*?Notify\[a_notify_resource\]/m, /message => "a_notify_resource message"/, /The a_notify_resource comment/)
+      end
+    end
   end
 
-  it "should produce a PuppetClass whose name is test" do
-    get_test_class(@parser.scan).name.should == "test"
+  describe "rdoc1 support", :if => Puppet.features.rdoc1? do
+    def module_path(module_name); "#{doc_dir}/classes/#{module_name}.html" end
+    def node_path(module_name, node_name);  "#{doc_dir}/nodes/**/*.html" end
+    def class_path(module_name, class_name); "#{doc_dir}/classes/#{module_name}/#{class_name}.html" end
+    def plugin_path(module_name, type, name); "#{doc_dir}/plugins/#{name}.html" end
+
+    include RdocTesters
+
+    def has_node_rdoc(module_name, node_name, *other_test_patterns)
+      some_file_exists_with_matching_content(node_path(module_name, node_name), /#{node_name}/, /node comment/, *other_test_patterns)
+    end
+
+    it_behaves_like :an_rdoc_site
+    it_behaves_like :an_rdoc1_site
+
+    it "references nodes and classes in the __site__ module" do
+      file_exists_and_matches_content("#{doc_dir}/classes/__site__.html", /Node.*__site__::foo/, /Class.*__site__::test/)
+    end
+
+    it "references functions, facts, and type plugins in the a_module module" do
+      file_exists_and_matches_content("#{doc_dir}/classes/a_module.html", /a_function/, /a_fact/, /a_plugin/, /Class.*a_module::a_module/)
+    end
   end
 
-  it "should produce a PuppetClass whose comment is 'comment'" do
-    get_test_class(@parser.scan).comment.should == "comment\n"
+  describe "rdoc2 support", :if => !Puppet.features.rdoc1? do
+    def module_path(module_name); "#{doc_dir}/#{module_name}.html" end
+    def node_path(module_name, node_name);  "#{doc_dir}/#{module_name}/__nodes__/#{node_name}.html" end
+    def class_path(module_name, class_name); "#{doc_dir}/#{module_name}/#{class_name}.html" end
+    def plugin_path(module_name, type, name); "#{doc_dir}/#{module_name}/__#{type}s__.html" end
+
+    include RdocTesters
+
+    it_behaves_like :an_rdoc_site
   end
 end

data/spec/integration/util/settings_spec.rb

@@ -41,7 +41,7 @@ describe Puppet::Settings do
 
     settings.use(:main)
 
-    expect(File.stat(settings[:maindir]).mode & 007777).to eq(Puppet.features.microsoft_windows? ? 0755 : 0750)
+    expect(Puppet::FileSystem::File.new(settings[:maindir]).stat.mode & 007777).to eq(Puppet.features.microsoft_windows? ? 0755 : 0750)
   end
 
   it "reparses configuration if configuration file is touched", :if => !Puppet.features.microsoft_windows? do

data/spec/integration/util/windows/process_spec.rb

@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby
+
+require 'spec_helper'
+require 'facter'
+
+describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_windows?  do
+  describe "as an admin" do
+    it "should have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on Vista / 2008+",
+      :if => Facter.value(:kernelmajversion).to_f >= 6.0 && Puppet.features.microsoft_windows? do
+      # this is a bit of a lame duck test since it requires running user to be admin
+      # a better integration test would create a new user with the privilege and verify
+      Puppet::Util::Windows::User.should be_admin
+      Puppet::Util::Windows::Process.process_privilege_symlink?.should be_true
+    end
+
+    it "should not have the SeCreateSymbolicLinkPrivilege necessary to create symlinks on 2003 and earlier",
+      :if => Facter.value(:kernelmajversion).to_f < 6.0 && Puppet.features.microsoft_windows? do
+      Puppet::Util::Windows::User.should be_admin
+      Puppet::Util::Windows::Process.process_privilege_symlink?.should be_false
+    end
+  end
+end

data/spec/integration/util/windows/security_spec.rb

@@ -16,31 +16,64 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
   before :all do
     @sids = {
       :current_user => Puppet::Util::Windows::Security.name_to_sid(Sys::Admin.get_login),
+      :system => Win32::Security::SID::LocalSystem,
       :admin => Puppet::Util::Windows::Security.name_to_sid("Administrator"),
+      :administrators => Win32::Security::SID::BuiltinAdministrators,
       :guest => Puppet::Util::Windows::Security.name_to_sid("Guest"),
       :users => Win32::Security::SID::BuiltinUsers,
       :power_users => Win32::Security::SID::PowerUsers,
+      :none => Win32::Security::SID::Nobody,
+      :everyone => Win32::Security::SID::Everyone
     }
   end
 
   let (:sids) { @sids }
   let (:winsec) { WindowsSecurityTester.new }
 
+  def set_group_depending_on_current_user(path)
+    if sids[:current_user] == sids[:system]
+      # if the current user is SYSTEM, by setting the group to
+      # guest, SYSTEM is automagically given full control, so instead
+      # override that behavior with SYSTEM as group and a specific mode
+      winsec.set_group(sids[:system], path)
+      mode = winsec.get_mode(path)
+      winsec.set_mode(mode & ~WindowsSecurityTester::S_IRWXG, path)
+    else
+      winsec.set_group(sids[:guest], path)
+    end
+  end
+
   shared_examples_for "only child owner" do
     it "should allow child owner" do
-      check_child_owner
+      winsec.set_owner(sids[:guest], parent)
+      winsec.set_group(sids[:current_user], parent)
+      winsec.set_mode(0700, parent)
+
+      check_delete(path)
     end
 
     it "should deny parent owner" do
-      lambda { check_parent_owner }.should raise_error(Errno::EACCES)
+      winsec.set_owner(sids[:guest], path)
+      winsec.set_group(sids[:current_user], path)
+      winsec.set_mode(0700, path)
+
+      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
 
     it "should deny group" do
-      lambda { check_group }.should raise_error(Errno::EACCES)
+      winsec.set_owner(sids[:guest], path)
+      winsec.set_group(sids[:current_user], path)
+      winsec.set_mode(0700, path)
+
+      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
 
     it "should deny other" do
-      lambda { check_other }.should raise_error(Errno::EACCES)
+      winsec.set_owner(sids[:guest], path)
+      winsec.set_group(sids[:current_user], path)
+      winsec.set_mode(0700, path)
+
+      lambda { check_delete(path) }.should raise_error(Errno::EACCES)
     end
   end
 
@@ -63,7 +96,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
         after :each do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU, parent)
-          winsec.set_mode(WindowsSecurityTester::S_IRWXU, path) if File.exists?(path)
+          winsec.set_mode(WindowsSecurityTester::S_IRWXU, path) if Puppet::FileSystem::File.exist?(path)
         end
 
         describe "#supports_acl?" do
@@ -122,6 +155,26 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           end
         end
 
+        it "should preserve inherited full control for SYSTEM when setting owner and group" do
+          # new file has SYSTEM
+          system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
+          system_aces.should_not be_empty
+
+          # when running under SYSTEM account, multiple ACEs come back
+          # so we only care that we have at least one of these
+          system_aces.any? do |ace|
+            ace.mask == Windows::File::FILE_ALL_ACCESS
+          end.should be_true
+
+          # changing the owner/group will no longer make the SD protected
+          winsec.set_group(sids[:power_users], path)
+          winsec.set_owner(sids[:administrators], path)
+
+          system_aces.find do |ace|
+            ace.mask == Windows::File::FILE_ALL_ACCESS && ace.inherited?
+          end.should_not be_nil
+        end
+
         describe "#mode=" do
           (0000..0700).step(0100) do |mode|
             it "should enforce mode #{mode.to_s(8)}" do
@@ -151,6 +204,28 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             end
           end
 
+          it "should preserve full control for SYSTEM when setting mode" do
+            # new file has SYSTEM
+            system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
+            system_aces.should_not be_empty
+
+            # when running under SYSTEM account, multiple ACEs come back
+            # so we only care that we have at least one of these
+            system_aces.any? do |ace|
+              ace.mask == WindowsSecurityTester::FILE_ALL_ACCESS
+            end.should be_true
+
+            # changing the mode will make the SD protected
+            winsec.set_group(sids[:none], path)
+            winsec.set_mode(0600, path)
+
+            # and should have a non-inherited SYSTEM ACE(s)
+            system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
+            system_aces.each do |ace|
+              ace.mask.should == Windows::File::FILE_ALL_ACCESS && ! ace.inherited?
+            end
+          end
+
           describe "for modes that require deny aces" do
             it "should map everyone to group and owner" do
               winsec.set_mode(0426, path)
@@ -167,6 +242,8 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
           describe "for read-only objects" do
             before :each do
+              winsec.set_group(sids[:none], path)
+              winsec.set_mode(0600, path)
               winsec.add_attributes(path, WindowsSecurityTester::FILE_ATTRIBUTE_READONLY)
               (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
             end
@@ -176,9 +253,17 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
               (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should == 0
             end
 
-            it "should leave them read-only if no sid has write permission" do
+            it "should leave them read-only if no sid has write permission and should allow full access for SYSTEM" do
               winsec.set_mode(WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IXGRP, path)
               (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
+
+              system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
+
+              # when running under SYSTEM account, and set_group / set_owner hasn't been called
+              # SYSTEM full access will be restored
+              system_aces.any? do |ace|
+                ace.mask == Windows::File::FILE_ALL_ACCESS
+              end.should be_true
             end
           end
 
@@ -189,31 +274,39 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
         describe "#mode" do
           it "should report when extra aces are encounted" do
-            winsec.set_acl(path, true) do |acl|
-              (544..547).each do |rid|
-                winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL, "S-1-5-32-#{rid}")
-              end
+            sd = winsec.get_security_descriptor(path)
+            (544..547).each do |rid|
+              sd.dacl.allow("S-1-5-32-#{rid}", WindowsSecurityTester::STANDARD_RIGHTS_ALL)
             end
+            winsec.set_security_descriptor(path, sd)
+
             mode = winsec.get_mode(path)
-            (mode & WindowsSecurityTester::S_IEXTRA).should_not == 0
+            (mode & WindowsSecurityTester::S_IEXTRA).should == WindowsSecurityTester::S_IEXTRA
           end
 
-          it "should warn if a deny ace is encountered" do
-            winsec.set_acl(path) do |acl|
-              winsec.add_access_denied_ace(acl, WindowsSecurityTester::FILE_GENERIC_WRITE, sids[:guest])
-              winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL, sids[:current_user])
-            end
-
-            Puppet.expects(:warning).with("Unsupported access control entry type: 0x1")
+          it "should return deny aces" do
+            sd = winsec.get_security_descriptor(path)
+            sd.dacl.deny(sids[:guest], WindowsSecurityTester::FILE_GENERIC_WRITE)
+            winsec.set_security_descriptor(path, sd)
 
-            winsec.get_mode(path)
+            guest_aces = winsec.get_aces_for_path_by_sid(path, sids[:guest])
+            guest_aces.find do |ace|
+              ace.type == WindowsSecurityTester::ACCESS_DENIED_ACE_TYPE
+            end.should_not be_nil
           end
 
           it "should skip inherit-only ace" do
-            winsec.set_acl(path) do |acl|
-              winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL, sids[:current_user])
-              winsec.add_access_allowed_ace(acl, WindowsSecurityTester::FILE_GENERIC_READ, Win32::Security::SID::Everyone, WindowsSecurityTester::INHERIT_ONLY_ACE | WindowsSecurityTester::OBJECT_INHERIT_ACE)
-            end
+            sd = winsec.get_security_descriptor(path)
+            dacl = Puppet::Util::Windows::AccessControlList.new
+            dacl.allow(
+              sids[:current_user], WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL
+            )
+            dacl.allow(
+              sids[:everyone],
+              WindowsSecurityTester::FILE_GENERIC_READ,
+              WindowsSecurityTester::INHERIT_ONLY_ACE | WindowsSecurityTester::OBJECT_INHERIT_ACE
+            )
+            winsec.set_security_descriptor(path, sd)
 
             (winsec.get_mode(path) & WindowsSecurityTester::S_IRWXO).should == 0
           end
@@ -224,9 +317,14 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
 
         describe "inherited access control entries" do
-          it "should be absent when the access control list is protected" do
+          it "should be absent when the access control list is protected, and should not remove SYSTEM" do
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
-            (winsec.get_mode(path) & WindowsSecurityTester::S_IEXTRA).should == 0
+
+            mode = winsec.get_mode(path)
+            [ WindowsSecurityTester::S_IEXTRA,
+              WindowsSecurityTester::S_ISYSTEM_MISSING ].each do |flag|
+              (mode & flag).should_not == flag
+            end
           end
 
           it "should be present when the access control list is unprotected" do
@@ -234,13 +332,20 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             allow = WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL
             inherit = WindowsSecurityTester::OBJECT_INHERIT_ACE | WindowsSecurityTester::CONTAINER_INHERIT_ACE
 
-            winsec.set_acl(parent, true) do |acl|
-              winsec.add_access_allowed_ace(acl, allow, "S-1-1-0", inherit) # everyone
-
-              (544..547).each do |rid|
-                winsec.add_access_allowed_ace(acl, WindowsSecurityTester::STANDARD_RIGHTS_ALL, "S-1-5-32-#{rid}", inherit)
-              end
+            sd = winsec.get_security_descriptor(parent)
+            sd.dacl.allow(
+              "S-1-1-0", #everyone
+              allow,
+              inherit
+            )
+            (544..547).each do |rid|
+              sd.dacl.allow(
+                "S-1-5-32-#{rid}",
+                WindowsSecurityTester::STANDARD_RIGHTS_ALL,
+                inherit
+              )
             end
+            winsec.set_security_descriptor(parent, sd)
 
             # unprotect child, it should inherit from parent
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path, false)
@@ -252,13 +357,13 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
       describe "for an administrator", :if => Puppet.features.root? do
         before :each do
           winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
-          winsec.set_group(sids[:guest], path)
+          set_group_depending_on_current_user(path)
           winsec.set_owner(sids[:guest], path)
           lambda { File.open(path, 'r') }.should raise_error(Errno::EACCES)
         end
 
         after :each do
-          if File.exists?(path)
+          if Puppet::FileSystem::File.exist?(path)
             winsec.set_owner(sids[:current_user], path)
             winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
           end
@@ -295,16 +400,18 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             winsec.get_group(path).should == sids[:admin]
           end
 
-          it "should allow owner and group to be the same sid" do
-            winsec.set_mode(0610, path)
+          it "should combine owner and group rights when they are the same sid" do
             winsec.set_owner(sids[:power_users], path)
             winsec.set_group(sids[:power_users], path)
+            winsec.set_mode(0610, path)
 
             winsec.get_owner(path).should == sids[:power_users]
             winsec.get_group(path).should == sids[:power_users]
             # note group execute permission added to user ace, and then group rwx value
             # reflected to match
-            winsec.get_mode(path).to_s(8).should == "770"
+
+            # Exclude missing system ace, since that's not relevant
+            (winsec.get_mode(path) & 0777).to_s(8).should == "770"
           end
 
           it "should raise an exception if an invalid sid is provided" do
@@ -355,10 +462,14 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
 
         describe "#mode" do
-          it "should deny all access when the DACL is empty" do
-            winsec.set_acl(path, true) { |acl| }
+          it "should deny all access when the DACL is empty, including SYSTEM" do
+            sd = winsec.get_security_descriptor(path)
+            # don't allow inherited aces to affect the test
+            protect = true
+            new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, [], protect)
+            winsec.set_security_descriptor(path, new_sd)
 
-            winsec.get_mode(path).should == 0
+            winsec.get_mode(path).should == WindowsSecurityTester::S_ISYSTEM_MISSING
           end
 
           # REMIND: ruby crashes when trying to set a NULL DACL
@@ -378,103 +489,121 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             winsec.set_mode(0777, path, false)
           end
 
-          def check_child_owner
-            winsec.set_group(sids[:guest], parent)
-            winsec.set_owner(sids[:guest], parent)
+          describe "is writable and executable" do
+            describe "and sticky bit is set" do
+              it "should allow child owner" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(01700, parent)
 
-            check_delete(path)
-          end
+                check_delete(path)
+              end
 
-        def check_parent_owner
-          winsec.set_group(sids[:guest], path)
-          winsec.set_owner(sids[:guest], path)
+              it "should allow parent owner" do
+                winsec.set_owner(sids[:current_user], parent)
+                winsec.set_group(sids[:guest], parent)
+                winsec.set_mode(01700, parent)
 
-          check_delete(path)
-        end
+                winsec.set_owner(sids[:current_user], path)
+                winsec.set_group(sids[:guest], path)
+                winsec.set_mode(0700, path)
 
-        def check_group
-          winsec.set_group(sids[:current_user], path)
-          winsec.set_owner(sids[:guest], path)
+                check_delete(path)
+              end
 
-          winsec.set_owner(sids[:guest], parent)
+              it "should deny group" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(01770, parent)
 
-          check_delete(path)
-        end
+                winsec.set_owner(sids[:guest], path)
+                winsec.set_group(sids[:current_user], path)
+                winsec.set_mode(0700, path)
 
-        def check_other
-          winsec.set_group(sids[:guest], path)
-          winsec.set_owner(sids[:guest], path)
+                lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+              end
 
-          winsec.set_owner(sids[:guest], parent)
+              it "should deny other" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(01777, parent)
 
-          check_delete(path)
-        end
+                winsec.set_owner(sids[:guest], path)
+                winsec.set_group(sids[:current_user], path)
+                winsec.set_mode(0700, path)
 
-        describe "is writable and executable" do
-          describe "and sticky bit is set" do
-            before :each do
-              winsec.set_mode(01777, parent)
+                lambda { check_delete(path) }.should raise_error(Errno::EACCES)
+              end
             end
 
-            it "should allow child owner" do
-              check_child_owner
-            end
+            describe "and sticky bit is not set" do
+              it "should allow child owner" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(0700, parent)
 
-            it "should allow parent owner" do
-              check_parent_owner
-            end
+                check_delete(path)
+              end
 
-            it "should deny group" do
-              lambda { check_group }.should raise_error(Errno::EACCES)
-            end
+              it "should allow parent owner" do
+                winsec.set_owner(sids[:current_user], parent)
+                winsec.set_group(sids[:guest], parent)
+                winsec.set_mode(0700, parent)
 
-            it "should deny other" do
-              lambda { check_other }.should raise_error(Errno::EACCES)
-            end
-          end
+                winsec.set_owner(sids[:current_user], path)
+                winsec.set_group(sids[:guest], path)
+                winsec.set_mode(0700, path)
 
-          describe "and sticky bit is not set" do
-            before :each do
-              winsec.set_mode(0777, parent)
-            end
+                check_delete(path)
+              end
 
-            it "should allow child owner" do
-              check_child_owner
-            end
+              it "should allow group" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(0770, parent)
 
-            it "should allow parent owner" do
-              check_parent_owner
-            end
+                winsec.set_owner(sids[:guest], path)
+                winsec.set_group(sids[:current_user], path)
+                winsec.set_mode(0700, path)
 
-            it "should allow group" do
-              check_group
-            end
+                check_delete(path)
+              end
 
-            it "should allow other" do
-              check_other
+              it "should allow other" do
+                winsec.set_owner(sids[:guest], parent)
+                winsec.set_group(sids[:current_user], parent)
+                winsec.set_mode(0777, parent)
+
+                winsec.set_owner(sids[:guest], path)
+                winsec.set_group(sids[:current_user], path)
+                winsec.set_mode(0700, path)
+
+                check_delete(path)
+              end
             end
           end
-        end
 
-        describe "is not writable" do
-          before :each do
-            winsec.set_mode(0555, parent)
+          describe "is not writable" do
+            before :each do
+              winsec.set_group(sids[:current_user], parent)
+              winsec.set_mode(0555, parent)
+            end
+
+            it_behaves_like "only child owner"
           end
 
-          it_behaves_like "only child owner"
-        end
+          describe "is not executable" do
+            before :each do
+              winsec.set_group(sids[:current_user], parent)
+              winsec.set_mode(0666, parent)
+            end
 
-        describe "is not executable" do
-          before :each do
-            winsec.set_mode(0666, parent)
+            it_behaves_like "only child owner"
           end
-
-          it_behaves_like "only child owner"
         end
       end
     end
   end
-  end
 
   describe "file" do
     let (:parent) do
@@ -603,9 +732,90 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         Dir.mkdir(newdir)
 
         [newfile, newdir].each do |p|
-          winsec.get_mode(p).to_s(8).should == mode640.to_s(8)
+          mode = winsec.get_mode(p)
+          (mode & 07777).to_s(8).should == mode640.to_s(8)
         end
       end
     end
   end
+
+  context "security descriptor" do
+    let(:path) { tmpfile('sec_descriptor') }
+    let(:read_execute) { 0x201FF }
+    let(:synchronize)  { 0x100000 }
+
+    before :each do
+      FileUtils.touch(path)
+    end
+
+    it "preserves aces for other users" do
+      dacl = Puppet::Util::Windows::AccessControlList.new
+      sids_in_dacl = [sids[:current_user], sids[:users]]
+      sids_in_dacl.each do |sid|
+        dacl.allow(sid, read_execute)
+      end
+      sd = Puppet::Util::Windows::SecurityDescriptor.new(sids[:guest], sids[:guest], dacl, true)
+      winsec.set_security_descriptor(path, sd)
+
+      aces = winsec.get_security_descriptor(path).dacl.to_a
+      aces.map(&:sid).should == sids_in_dacl
+      aces.map(&:mask).all? { |mask| mask == read_execute }.should be_true
+    end
+
+    it "changes the sid for all aces that were assigned to the old owner" do
+      sd = winsec.get_security_descriptor(path)
+      sd.owner.should_not == sids[:guest]
+
+      sd.dacl.allow(sd.owner, read_execute)
+      sd.dacl.allow(sd.owner, synchronize)
+
+      sd.owner = sids[:guest]
+      winsec.set_security_descriptor(path, sd)
+
+      dacl = winsec.get_security_descriptor(path).dacl
+      aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
+      # only non-inherited aces will be reassigned to guest, so
+      # make sure we find at least the two we added
+      aces.size.should >= 2
+    end
+
+    it "preserves INHERIT_ONLY_ACEs" do
+      # inherit only aces can only be set on directories
+      dir = tmpdir('inheritonlyace')
+
+      inherit_flags = Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE |
+        Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
+        Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
+
+      sd = winsec.get_security_descriptor(dir)
+      sd.dacl.allow(sd.owner, Windows::File::FILE_ALL_ACCESS, inherit_flags)
+      winsec.set_security_descriptor(dir, sd)
+
+      sd = winsec.get_security_descriptor(dir)
+
+      winsec.set_owner(sids[:guest], dir)
+
+      sd = winsec.get_security_descriptor(dir)
+      sd.dacl.find do |ace|
+        ace.sid == sids[:guest] && ace.inherit_only?
+      end.should_not be_nil
+    end
+
+    context "when managing mode" do
+      it "removes aces for sids that are neither the owner nor group" do
+        # add a guest ace, it's never owner or group
+        sd = winsec.get_security_descriptor(path)
+        sd.dacl.allow(sids[:guest], read_execute)
+        winsec.set_security_descriptor(path, sd)
+
+        # setting the mode, it should remove extra aces
+        winsec.set_mode(0770, path)
+
+        # make sure it's gone
+        dacl = winsec.get_security_descriptor(path).dacl
+        aces = dacl.find_all { |ace| ace.sid == sids[:guest] }
+        aces.should be_empty
+      end
+    end
+  end
 end