puppet 3.6.2 → 3.7.0

data/lib/puppet/type/exec.rb

@@ -77,9 +77,27 @@ module Puppet
       defaultto "0"
 
       attr_reader :output
-      desc "The expected return code(s).  An error will be returned if the
-        executed command returns something else.  Defaults to 0. Can be
-        specified as an array of acceptable return codes or a single value."
+      desc "The expected exit code(s).  An error will be returned if the
+        executed command has some other exit code.  Defaults to 0. Can be
+        specified as an array of acceptable exit codes or a single value.
+
+        On POSIX systems, exit codes are always integers between 0 and 255.
+
+        On Windows, **most** exit codes should be integers between 0
+        and 2147483647.
+
+        Larger exit codes on Windows can behave inconsistently across different
+        tools. The Win32 APIs define exit codes as 32-bit unsigned integers, but
+        both the cmd.exe shell and the .NET runtime cast them to signed
+        integers. This means some tools will report negative numbers for exit
+        codes above 2147483647. (For example, cmd.exe reports 4294967295 as -1.)
+        Since Puppet uses the plain Win32 APIs, it will report the very large
+        number instead of the negative number, which might not be what you
+        expect if you got the exit code from a cmd.exe session.
+
+        Microsoft recommends against using negative/very large exit codes, and
+        you should avoid them when possible. To convert a negative exit code to
+        the positive one Puppet will use, add it to 4294967296."
 
       # Make output a bit prettier
       def change_to_s(currentvalue, newvalue)
@@ -183,10 +201,12 @@ module Puppet
         Please note that the $HOME environment variable is not automatically set
         when using this attribute."
 
-      # Most validation is handled by the SUIDManager class.
       validate do |user|
-        self.fail "Only root can execute commands as other users" unless Puppet.features.root?
-        self.fail "Unable to execute commands as other users on Windows" if Puppet.features.microsoft_windows?
+        if Puppet.features.microsoft_windows?
+          self.fail "Unable to execute commands as other users on Windows"
+        elsif !Puppet.features.root? && resource.current_username() != user
+          self.fail "Only root can execute commands as other users"
+        end
       end
     end
 
@@ -382,7 +402,7 @@ module Puppet
     newcheck(:unless) do
       desc <<-'EOT'
         If this parameter is set, then this `exec` will run unless
-        the command returns 0.  For example:
+        the command has an exit code of 0.  For example:
 
             exec { "/bin/echo root >> /usr/lib/cron/cron.allow":
               path   => "/usr/bin:/usr/sbin:/bin",
@@ -394,6 +414,8 @@ module Puppet
 
         Note that this command follows the same rules as the main command,
         which is to say that it must be fully qualified if the path is not set.
+        It also uses the same provider as the main command, so any behavior
+        that differs by provider will match.
       EOT
 
       validate do |cmds|
@@ -424,7 +446,7 @@ module Puppet
     newcheck(:onlyif) do
       desc <<-'EOT'
         If this parameter is set, then this `exec` will only run if
-        the command returns 0.  For example:
+        the command has an exit code of 0.  For example:
 
             exec { "logrotate":
               path   => "/usr/bin:/usr/sbin:/bin",
@@ -435,6 +457,8 @@ module Puppet
 
         Note that this command follows the same rules as the main command,
         which is to say that it must be fully qualified if the path is not set.
+        It also uses the same provider as the main command, so any behavior
+        that differs by provider will match.
 
         Also note that onlyif can take an array as its value, e.g.:
 
@@ -560,5 +584,9 @@ module Puppet
         end
       end
     end
+
+    def current_username
+      Etc.getpwuid(Process.uid).name
+    end
   end
 end

data/lib/puppet/type/file.rb

@@ -20,8 +20,7 @@ Puppet::Type.newtype(:file) do
   @doc = "Manages files, including their content, ownership, and permissions.
 
     The `file` type can manage normal files, directories, and symlinks; the
-    type should be specified in the `ensure` attribute. Note that symlinks cannot
-    be managed on Windows systems.
+    type should be specified in the `ensure` attribute.
 
     File contents can be managed directly with the `content` attribute, or
     downloaded from a remote source using the `source` attribute; the latter
@@ -126,17 +125,34 @@ Puppet::Type.newtype(:file) do
   end
 
   newparam(:recurse) do
-    desc "Whether and how to do recursive file management. Options are:
-
-      * `inf,true` --- Regular style recursion on both remote and local
-        directory structure.  See `recurselimit` to specify a limit to the
-        recursion depth.
-      * `remote` --- Descends recursively into the remote (source) directory
-        but not the local (destination) directory. Allows copying of
-        a few files into a directory containing many
-        unmanaged files without scanning all the local files.
-        This can only be used when a source parameter is specified.
-      * `false` --- Default of no recursion.
+    desc "Whether to recursively manage the _contents_ of a directory. This attribute
+      is only used when `ensure => directory` is set. The allowed values are:
+
+      * `false` --- The default behavior. The contents of the directory will not be
+        automatically managed.
+      * `remote` --- If the `source` attribute is set, Puppet will automatically
+        manage the contents of the source directory (or directories), ensuring
+        that equivalent files and directories exist on the target system and
+        that their contents match.
+
+        Using `remote` will disable the `purge` attribute, but results in faster
+        catalog application than `recurse => true`.
+
+        The `source` attribute is mandatory when `recurse => remote`.
+      * `true` --- If the `source` attribute is set, this behaves similarly to
+        `recurse => remote`, automatically managing files from the source directory.
+
+        This also enables the `purge` attribute, which can delete unmanaged
+        files from a directory. See the description of `purge` for more details.
+
+        The `source` attribute is not mandatory when using `recurse => true`, so you
+        can enable purging in directories where all files are managed individually.
+
+        (Note: `inf` is a deprecated synonym for `true`.)
+
+      By default, setting recurse to `remote` or `true` will manage _all_
+      subdirectories. You can use the `recurselimit` attribute to limit the
+      recursion depth.
     "
 
     newvalues(:true, :false, :inf, :remote)
@@ -155,7 +171,24 @@ Puppet::Type.newtype(:file) do
   end
 
   newparam(:recurselimit) do
-    desc "How deeply to do recursive management."
+    desc "How far Puppet should descend into subdirectories, when using
+      `ensure => directory` and either `recurse => true` or `recurse => remote`.
+      The recursion limit affects which files will be copied from the `source`
+      directory, as well as which files can be purged when `purge => true`.
+
+      Setting `recurselimit => 0` is the same as setting `recurse => false` ---
+      Puppet will manage the directory, but all of its contents will be treated
+      as unmanaged.
+
+      Setting `recurselimit => 1` will manage files and directories that are
+      directly inside the directory, but will not manage the contents of any
+      subdirectories.
+
+      Setting `recurselimit => 2` will manage the direct contents of the
+      directory, as well as the contents of the _first_ level of subdirectories.
+
+      And so on --- 3 will manage the contents of the second level of
+      subdirectories, etc."
 
     newvalues(/^[0-9]+$/)
 
@@ -218,7 +251,7 @@ Puppet::Type.newtype(:file) do
 
   newparam(:purge, :boolean => true, :parent => Puppet::Parameter::Boolean) do
     desc "Whether unmanaged files should be purged. This option only makes
-      sense when managing directories with `recurse => true`.
+      sense when `ensure => directory` and `recurse => true`.
 
       * When recursively duplicating an entire directory with the `source`
         attribute, `purge => true` will automatically purge any files
@@ -228,7 +261,14 @@ Puppet::Type.newtype(:file) do
         specifically managed.
 
       If you have a filebucket configured, the purged files will be uploaded,
-      but if you do not, this will destroy data."
+      but if you do not, this will destroy data.
+
+      Unless `force => true` is set, purging will **not** delete directories,
+      although it will delete the files they contain.
+
+      If `recurselimit` is set and you aren't using `force => true`, purging
+      will obey the recursion limit; files in any subdirectories deeper than the
+      limit will be treated as unmanaged and left alone."
 
     defaultto :false
   end

data/lib/puppet/type/file/content.rb

@@ -38,6 +38,7 @@ module Puppet
 
       ...but for larger files, this attribute is more useful when combined with the
       [template](http://docs.puppetlabs.com/references/latest/function.html#template)
+      or [file](http://docs.puppetlabs.com/references/latest/function.html#file)
       function.
     EOT
 
@@ -206,9 +207,8 @@ module Puppet
     end
 
     def get_from_source(source_or_content, &block)
-      source = source_or_content.uri
-
-      request = Puppet::Indirector::Request.new(:file_content, :find, source.to_s, nil, :environment => resource.catalog.environment)
+      source = source_or_content.metadata.source
+      request = Puppet::Indirector::Request.new(:file_content, :find, source, nil, :environment => resource.catalog.environment)
 
       request.do_request(:fileserver) do |req|
         connection = Puppet::Network::HttpPool.http_instance(req.server, req.port)

data/lib/puppet/type/file/mode.rb

@@ -10,9 +10,14 @@ module Puppet
 
     desc <<-'EOT'
       The desired permissions mode for the file, in symbolic or numeric
-      notation. Puppet uses traditional Unix permission schemes and translates
+      notation. This value should be specified as a quoted string; do not use
+      un-quoted numbers to represent file modes.
+
+      The `file` type uses traditional Unix permission schemes and translates
       them to equivalent permissions for systems which represent permissions
-      differently, including Windows.
+      differently, including Windows. For detailed ACL controls on Windows,
+      you can leave `mode` unmanaged and use
+      [the puppetlabs/acl module.](https://forge.puppetlabs.com/puppetlabs/acl)
 
       Numeric modes should use the standard four-digit octal notation of
       `<setuid/setgid/sticky><owner><group><other>` (e.g. 0644). Each of the
@@ -60,6 +65,10 @@ module Puppet
     EOT
 
     validate do |value|
+      if !value.is_a?(String)
+        Puppet.deprecation_warning("Non-string values for the file mode property are deprecated. It must be a string, " \
+          "either a symbolic mode like 'o+w,a+r' or an octal representation like '0644' or '755'.")
+      end
       unless value.nil? or valid_symbolic_mode?(value)
         raise Puppet::Error, "The file mode specification is invalid: #{value.inspect}"
       end
@@ -77,7 +86,7 @@ module Puppet
 
     def desired_mode_from_current(desired, current)
       current = current.to_i(8) if current.is_a? String
-      is_a_directory = @resource.stat and @resource.stat.directory?
+      is_a_directory = @resource.stat && @resource.stat.directory?
       symbolic_mode_to_int(desired, current, is_a_directory)
     end
 

data/lib/puppet/type/file/source.rb

@@ -225,7 +225,10 @@ module Puppet
     def copy_source_value(metadata_method)
       param_name = (metadata_method == :checksum) ? :content : metadata_method
       if resource[param_name].nil? or resource[param_name] == :absent
-        resource[param_name] = metadata.send(metadata_method)
+        value = metadata.send(metadata_method)
+        # Force the mode value in file resources to be a string containing octal.
+        value = value.to_s(8) if param_name == :mode && value.is_a?(Numeric)
+        resource[param_name] = value
       end
     end
   end

data/lib/puppet/type/group.rb

@@ -168,7 +168,7 @@ module Puppet
     newparam(:forcelocal, :boolean => true,
              :required_features => :libuser,
              :parent => Puppet::Parameter::Boolean) do
-      desc "Forces the mangement of local accounts when accounts are also
+      desc "Forces the management of local accounts when accounts are also
             being managed by some other NSS"
       defaultto false
     end

data/lib/puppet/type/mount.rb

@@ -206,7 +206,7 @@ module Puppet
 
     newproperty(:dump) do
       desc "Whether to dump the mount.  Not all platform support this.
-        Valid values are `1` or `0`. or `2` on FreeBSD, Default is `0`."
+        Valid values are `1` or `0` (or `2` on FreeBSD). Default is `0`."
 
       if Facter.value(:operatingsystem) == "FreeBSD"
         newvalue(%r{(0|1|2)})
@@ -214,8 +214,6 @@ module Puppet
         newvalue(%r{(0|1)})
       end
 
-      newvalue(%r{(0|1)})
-
       defaultto {
         0 if @resource.managed?
       }

data/lib/puppet/type/resources.rb

@@ -19,11 +19,11 @@ Puppet::Type.newtype(:resources) do
   end
 
   newparam(:purge, :boolean => true, :parent => Puppet::Parameter::Boolean) do
-    desc "Purge unmanaged resources.  This will delete any resource
-      that is not specified in your configuration
-      and is not required by any specified resources.
-      Purging ssh_authorized_keys this way is deprecated; see the
-      purge_ssh_keys parameter of the user type for a better alternative."
+    desc "Whether to purge unmanaged resources.  When set to `true`, this will
+      delete any resource that is not specified in your configuration and is not
+      autorequired by any managed resources. **Note:** The `ssh_authorized_key`
+      resource type can't be purged this way; instead, see the `purge_ssh_keys`
+      attribute of the `user` type."
 
     defaultto :false
 
@@ -39,7 +39,7 @@ Puppet::Type.newtype(:resources) do
 
   newparam(:unless_system_user) do
     desc "This keeps system users from being purged.  By default, it
-      does not purge users whose UIDs are less than or equal to 500, but you can specify
+      does not purge users whose UIDs are less than the minimum UID for the system (typically 500 or 1000), but you can specify
       a different UID as the inclusive limit."
 
     newvalues(:true, :false, /^\d+$/)
@@ -49,7 +49,7 @@ Puppet::Type.newtype(:resources) do
       when /^\d+/
         Integer(value)
       when :true, true
-        500
+        @resource.class.system_users_max_uid
       when :false, false
         false
       when Integer; value
@@ -60,7 +60,7 @@ Puppet::Type.newtype(:resources) do
 
     defaultto {
       if @resource[:name] == "user"
-        500
+        @resource.class.system_users_max_uid
       else
         nil
       end
@@ -68,26 +68,24 @@ Puppet::Type.newtype(:resources) do
   end
 
   newparam(:unless_uid) do
-     desc "This keeps specific uids or ranges of uids from being purged when purge is true.
-       Accepts ranges, integers and (mixed) arrays of both."
-
-     munge do |value|
-       case value
-       when /^\d+/
-         [Integer(value)]
-       when Integer
-         [value]
-       when Range
-         [value]
-       when Array
-         value
-       when /^\[\d+/
-         value.split(',').collect{|x| x.include?('..') ? Integer(x.split('..')[0])..Integer(x.split('..')[1]) : Integer(x) }
-       else
-         raise ArgumentError, "Invalid value #{value.inspect}"
-       end
-     end
-   end
+    desc 'This keeps specific uids or ranges of uids from being purged when purge is true.
+      Accepts integers, integer strings, and arrays of integers or integer strings.
+      To specify a range of uids, consider using the range() function from stdlib.'
+
+    munge do |value|
+      value = [value] unless value.is_a? Array
+      value.flatten.collect do |v|
+        case v
+          when Integer
+            v
+          when String
+            Integer(v)
+          else
+            raise ArgumentError, "Invalid value #{v.inspect}."
+        end
+      end
+    end
+  end
 
   def check(resource)
     @checkmethod ||= "#{self[:name]}_check"
@@ -136,6 +134,13 @@ Puppet::Type.newtype(:resources) do
     @resource_type
   end
 
+  def self.deprecate_params(title,params)
+    return unless params
+    if title == 'cron' and ! params.select { |param| param.name.intern == :purge and param.value == true }.empty?
+      Puppet.deprecation_warning("Change notice: purging cron entries will be more aggressive in future versions, take care when updating your agents. See http://links.puppetlabs.com/puppet-aggressive-cron-purge")
+    end
+  end
+
   # Make sure we don't purge users with specific uids
   def user_check(resource)
     return true unless self[:name] == "user"
@@ -146,13 +151,7 @@ Puppet::Type.newtype(:resources) do
     unless_uids = self[:unless_uid]
 
     return false if system_users.include?(resource[:name])
-
-    if unless_uids && unless_uids.length > 0
-      unless_uids.each do |unless_uid|
-        return false if unless_uid == current_uid
-        return false if unless_uid.respond_to?('include?') && unless_uid.include?(current_uid)
-      end
-    end
+    return false if unless_uids && unless_uids.include?(current_uid)
 
     current_uid > self[:unless_system_user]
   end
@@ -160,4 +159,29 @@ Puppet::Type.newtype(:resources) do
   def system_users
     %w{root nobody bin noaccess daemon sys}
   end
+
+  def self.system_users_max_uid
+    return @system_users_max_uid if @system_users_max_uid
+
+    # First try to read the minimum user id from login.defs
+    if Puppet::FileSystem.exist?('/etc/login.defs')
+      @system_users_max_uid = Puppet::FileSystem.each_line '/etc/login.defs' do |line|
+        break $1.to_i - 1 if line =~ /^\s*UID_MIN\s+(\d+)(\s*#.*)?$/
+      end
+    end
+
+    # Otherwise, use a sensible default based on the OS family
+    @system_users_max_uid ||= case Facter.value(:osfamily)
+      when 'OpenBSD', 'FreeBSD'
+        999
+      else
+        499
+    end
+
+    @system_users_max_uid
+  end
+
+  def self.reset_system_users_max_uid!
+    @system_users_max_uid = nil
+  end
 end

data/lib/puppet/type/ssh_authorized_key.rb

@@ -1,24 +1,50 @@
 module Puppet
   newtype(:ssh_authorized_key) do
-    @doc = "Manages SSH authorized keys. Currently only type 2 keys are
-    supported.
+    @doc = "Manages SSH authorized keys. Currently only type 2 keys are supported.
 
-    **Autorequires:** If Puppet is managing the user account in which this
-    SSH key should be installed, the `ssh_authorized_key` resource will autorequire
-    that user."
+      In their native habitat, SSH keys usually appear as a single long line. This
+      resource type requires you to split that line into several attributes. Thus, a
+      key that appears in your `~/.ssh/id_rsa.pub` file like this...
+
+          ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ== nick@magpie.puppetlabs.lan
+
+      ...would translate to the following resource:
+
+          ssh_authorized_key { 'nick@magpie.puppetlabs.lan':
+            user => 'nick',
+            type => 'ssh-rsa',
+            key  => 'AAAAB3NzaC1yc2EAAAABIwAAAQEAy5mtOAMHwA2ZAIfW6Ap70r+I4EclYHEec5xIN59ROUjss23Skb1OtjzYpVPaPH8mSdSmsN0JHaBLiRcu7stl4O8D8zA4mz/vw32yyQ/Kqaxw8l0K76k6t2hKOGqLTY4aFbFISV6GDh7MYLn8KU7cGp96J+caO5R5TqtsStytsUhSyqH+iIDh4e4+BrwTc6V4Y0hgFxaZV5d18mLA4EPYKeG5+zyBCVu+jueYwFqM55E0tHbfiaIN9IzdLV+7NEEfdLkp6w2baLKPqWUBmuvPF1Mn3FwaFLjVsMT3GQeMue6b3FtUdTDeyAYoTxrsRo/WnDkS6Pa3YhrFwjtUqXfdaQ==',
+          }
+
+      To ensure that only the currently approved keys are present, you can purge
+      unmanaged SSH keys on a per-user basis. Do this with the `user` resource
+      type's `purge_ssh_keys` attribute:
+
+          user { 'nick':
+            ensure         => present,
+            purge_ssh_keys => true,
+          }
+
+      This will remove any keys in `~/.ssh/authorized_keys` that aren't being
+      managed with `ssh_authorized_key` resources. See the documentation of the
+      `user` type for more details.
+
+      **Autorequires:** If Puppet is managing the user account in which this
+      SSH key should be installed, the `ssh_authorized_key` resource will autorequire
+      that user."
 
     ensurable
 
     newparam(:name) do
       desc "The SSH key comment. This attribute is currently used as a
-      system-wide primary key and therefore has to be unique."
+        system-wide primary key and therefore has to be unique."
 
       isnamevar
 
     end
 
     newproperty(:type) do
-      desc "The encryption type used: ssh-dss or ssh-rsa."
+      desc "The encryption type used."
 
       newvalues :'ssh-dss', :'ssh-rsa', :'ecdsa-sha2-nistp256', :'ecdsa-sha2-nistp384', :'ecdsa-sha2-nistp521', :'ssh-ed25519'
 
@@ -28,9 +54,15 @@ module Puppet
     end
 
     newproperty(:key) do
-      desc "The public key itself; generally a long string of hex characters. The key attribute
-      may not contain whitespace: Omit key headers (e.g. 'ssh-rsa') and key identifiers
-      (e.g. 'joe@joescomputer.local') found in the public key file."
+      desc "The public key itself; generally a long string of hex characters. The `key`
+        attribute may not contain whitespace.
+
+        Make sure to omit the following in this attribute (and specify them in
+        other attributes):
+
+        * Key headers (e.g. 'ssh-rsa') --- put these in the `type` attribute.
+        * Key identifiers / comments (e.g. 'joe@joescomputer.local') --- put these in
+          the `name` attribute/resource title."
 
       validate do |value|
         raise Puppet::Error, "Key must not contain whitespace: #{value}" if value =~ /\s/
@@ -38,15 +70,15 @@ module Puppet
     end
 
     newproperty(:user) do
-      desc "The user account in which the SSH key should be installed.
-      The resource will automatically depend on this user."
+      desc "The user account in which the SSH key should be installed. The resource
+        will autorequire this user if it is being managed as a `user` resource."
     end
 
     newproperty(:target) do
       desc "The absolute filename in which to store the SSH key. This
-      property is optional and should only be used in cases where keys
-      are stored in a non-standard location (i.e.` not in
-      `~user/.ssh/authorized_keys`)."
+        property is optional and should only be used in cases where keys
+        are stored in a non-standard location (i.e.` not in
+        `~user/.ssh/authorized_keys`)."
 
       defaultto :absent
 
@@ -69,7 +101,7 @@ module Puppet
     end
 
     newproperty(:options, :array_matching => :all) do
-      desc "Key options, see sshd(8) for possible values. Multiple values
+      desc "Key options; see sshd(8) for possible values. Multiple values
         should be specified as an array."
 
       defaultto do :absent end
@@ -111,5 +143,11 @@ module Puppet
       # If neither target nor user is defined, this is an error
       raise Puppet::Error, "Attribute 'user' or 'target' is mandatory"
     end
+
+    # regular expression suitable for use by a ParsedFile based provider
+    REGEX = /^(?:(.+) )?(ssh-dss|ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) ([^ ]+) ?(.*)$/
+    def self.keyline_regex
+      REGEX
+    end
   end
 end