puppet 4.0.0 → 4.5.0

data/spec/integration/type/package_spec.rb

@@ -28,7 +28,11 @@ describe Puppet::Type.type(:package), "when choosing a default package provider"
         :yum
       end
     when 'Fedora'
-      :yum
+      if Puppet::Util::Package.versioncmp(Facter.value(:operatingsystemmajrelease), '22') >= 0
+        :dnf
+      else
+        :yum
+      end
     when 'FreeBSD'
       :ports
     when 'OpenBSD'
@@ -54,6 +58,7 @@ end
 
 describe Puppet::Type.type(:package), "when packages with the same name are sourced" do
   before :each do
+    Process.stubs(:euid).returns 0
     @provider = stub(
       'provider',
       :class           => Puppet::Type.type(:package).defaultprovider,
@@ -125,3 +130,69 @@ describe Puppet::Type.type(:package), "when packages with the same name are sour
   end
 end
 
+describe Puppet::Type.type(:package), 'logging package state transitions' do
+
+  let(:catalog) { Puppet::Resource::Catalog.new }
+  let(:provider) { stub('provider', :class => Puppet::Type.type(:package).defaultprovider, :clear => nil, :validate_source => nil) }
+
+  before :each do
+    Process.stubs(:euid).returns 0
+    provider.stubs(:satisfies?).with([:purgeable]).returns(true)
+    provider.class.stubs(:instances).returns([])
+    provider.stubs(:install).returns nil
+    provider.stubs(:uninstall).returns nil
+    provider.stubs(:purge).returns nil
+    Puppet::Type.type(:package).defaultprovider.stubs(:new).returns(provider)
+  end
+
+  after :each do
+    Puppet::Type.type(:package).defaultprovider = nil
+  end
+
+  # Map of old state -> {new state -> change}
+  states = {
+    # 'installed' transitions to 'removed' or 'purged'
+    :installed => {
+      :installed => nil,
+      :absent    => 'removed',
+      :purged    => 'purged'
+    },
+    # 'absent' transitions to 'created' or 'purged'
+    :absent => {
+      :installed => 'created',
+      :absent    => nil,
+      :purged    => 'purged'
+    },
+    # 'purged' transitions to 'created'
+    :purged => {
+      :installed => 'created',
+      :absent    => nil,
+      :purged    => nil
+    }
+  }
+
+  states.each do |old, new_states|
+    describe "#{old} package" do
+
+      before :each do
+        provider.stubs(:properties).returns(:ensure => old)
+      end
+
+      new_states.each do |new, status|
+        it "ensure => #{new} should log #{status ? status : 'nothing'}" do
+          catalog.add_resource(described_class.new(:name => 'yay', :ensure => new))
+          catalog.apply
+
+          logs = catalog.apply.report.logs
+          if status
+            expect(logs.first.source).to eq("/Package[yay]/ensure")
+            expect(logs.first.message).to eq(status)
+          else
+            expect(logs.first).to be_nil
+          end
+        end
+      end
+    end
+  end
+end
+

data/spec/integration/type/tidy_spec.rb

@@ -1,16 +1,32 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 
+require 'puppet_spec/compiler'
 require 'puppet_spec/files'
 require 'puppet/file_bucket/dipper'
 
 describe Puppet::Type.type(:tidy) do
   include PuppetSpec::Files
+  include PuppetSpec::Compiler
 
   before do
     Puppet::Util::Storage.stubs(:store)
   end
 
+  it "should be able to recursively remove directories" do
+    dir = tmpfile("tidy_testing")
+    FileUtils.mkdir_p(File.join(dir, "foo", "bar"))
+
+    apply_compiled_manifest(<<-MANIFEST)
+      tidy { '#{dir}':
+        recurse => true,
+        rmdirs  => true,
+      }
+    MANIFEST
+
+    expect(Puppet::FileSystem.directory?(dir)).to be_falsey
+  end
+
   # Testing #355.
   it "should be able to remove dead links", :if => Puppet.features.manages_symlinks? do
     dir = tmpfile("tidy_link_testing")
@@ -19,15 +35,11 @@ describe Puppet::Type.type(:tidy) do
     Dir.mkdir(dir)
     Puppet::FileSystem.symlink(target, link)
 
-    tidy = Puppet::Type.type(:tidy).new :path => dir, :recurse => true
-
-    catalog = Puppet::Resource::Catalog.new
-    catalog.add_resource(tidy)
-    # avoid crude failures because of nil resources that result
-    # from implicit containment and lacking containers
-    catalog.stubs(:container_of).returns tidy
-
-    catalog.apply
+    apply_compiled_manifest(<<-MANIFEST)
+      tidy { '#{dir}':
+        recurse => true,
+      }
+    MANIFEST
 
     expect(Puppet::FileSystem.symlink?(link)).to be_falsey
   end

data/spec/integration/util/execution_spec.rb

@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Puppet::Util::Execution do
+  include PuppetSpec::Files
+
   describe "#execpipe" do
     it "should set LANG to C avoid localized output", :if => !Puppet.features.microsoft_windows? do
       out = ""
@@ -14,4 +16,24 @@ describe Puppet::Util::Execution do
       expect(out).to eq("C")
     end
   end
+
+  describe "#execute (Windows)", :if => Puppet.features.microsoft_windows? do
+    let(:utf8text) do
+      # Japanese Lorem Ipsum snippet
+      "utf8testfile" + [227, 131, 171, 227, 131, 147, 227, 131, 179, 227, 131, 132, 227,
+                        130, 162, 227, 130, 166, 227, 130, 167, 227, 131, 150, 227, 130,
+                        162, 227, 129, 181, 227, 129, 185, 227, 129, 139, 227, 130, 137,
+                        227, 129, 154, 227, 130, 187, 227, 130, 183, 227, 131, 147, 227,
+                        131, 170, 227, 131, 134].pack('c*').force_encoding(Encoding::UTF_8)
+    end
+    let(:temputf8filename) do
+      script_containing(utf8text, :windows => "@ECHO OFF\nECHO #{utf8text}\nEXIT 100")
+    end
+
+    it "should execute with non-english characters in command line" do
+      result = Puppet::Util::Execution.execute("cmd /c \"#{temputf8filename}\"", :failonfail => false)
+      expect(temputf8filename.encoding.name).to eq('UTF-8')
+      expect(result.exitstatus).to eq(100)
+    end
+  end
 end

data/spec/integration/util/rdoc/parser_spec.rb

@@ -2,7 +2,7 @@
 require 'spec_helper'
 require 'puppet/util/rdoc'
 
-describe "RDoc::Parser" do
+describe "RDoc::Parser", :unless => Puppet.features.microsoft_windows? do
   require 'puppet_spec/files'
   include PuppetSpec::Files
 

data/spec/integration/util/settings_spec.rb

@@ -44,6 +44,32 @@ describe Puppet::Settings do
     expect(Puppet::FileSystem.stat(settings[:maindir]).mode & 007777).to eq(0750)
   end
 
+  it "will properly parse a UTF-8 configuration file" do
+    rune_utf8 = "\u16A0\u16C7\u16BB" # ᚠᛇᚻ
+    config = tmpfile("config")
+    define_settings(:main,
+      :config => {
+        :type => :file,
+        :default => config,
+        :desc => "a"
+      },
+      :environment => {
+        :default => 'dingos',
+        :desc => 'test',
+      }
+    )
+
+    File.open(config, 'w') do |file|
+      file.puts <<-EOF
+[main]
+environment=#{rune_utf8}
+      EOF
+    end
+
+    settings.initialize_global_settings
+    expect(settings[:environment]).to eq(rune_utf8)
+  end
+
   it "reparses configuration if configuration file is touched", :if => !Puppet.features.microsoft_windows? do
     config = tmpfile("config")
     define_settings(:main,

data/spec/integration/util/windows/principal_spec.rb

@@ -0,0 +1,201 @@
+#!/usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe Puppet::Util::Windows::SID::Principal, :if => Puppet.features.microsoft_windows? do
+
+  let (:system_bytes) { [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0] }
+  let (:administrator_bytes) { [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] }
+
+  describe ".lookup_account_name" do
+    it "should create an instance from a well-known account name" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('SYSTEM')
+      expect(principal.account).to eq('SYSTEM')
+      expect(principal.sid_bytes).to eq(system_bytes)
+      expect(principal.sid).to eq('S-1-5-18')
+      expect(principal.domain).to eq('NT AUTHORITY')
+      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+
+      # Windows API LookupAccountSid behaves differently if current user is SYSTEM
+      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
+        account_type = :SidTypeWellKnownGroup
+      else
+        account_type = :SidTypeUser
+      end
+
+      expect(principal.account_type).to eq(account_type)
+    end
+
+    it "should create an instance from a well-known account prefixed with NT AUTHORITY" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('NT AUTHORITY\\SYSTEM')
+      expect(principal.account).to eq('SYSTEM')
+      expect(principal.sid_bytes).to eq(system_bytes)
+      expect(principal.sid).to eq('S-1-5-18')
+      expect(principal.domain).to eq('NT AUTHORITY')
+      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+
+      # Windows API LookupAccountSid behaves differently if current user is SYSTEM
+      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
+        account_type = :SidTypeWellKnownGroup
+      else
+        account_type = :SidTypeUser
+      end
+
+      expect(principal.account_type).to eq(account_type)
+    end
+
+    it "should create an instance from a local account prefixed with hostname" do
+      current_user_name = Puppet::Util::Windows::ADSI::User.current_user_name
+      running_as_system = (current_user_name == 'SYSTEM')
+      username = running_as_system ? 'Administrator' : current_user_name
+
+      user_exists = Puppet::Util::Windows::ADSI::User.exists?(".\\#{username}")
+
+      # when running as SYSTEM (in Jenkins CI), then Administrator should be used
+      # otherwise running in AppVeyor there is no Administrator and a the current local user can be used
+      skip if (running_as_system && !user_exists)
+
+      hostname = Socket.gethostname
+
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name("#{hostname}\\#{username}")
+      expect(principal.account).to match(/^#{Regexp.quote(username)}$/i)
+      # skip SID and bytes in this case since the most interesting thing here is domain_account
+      expect(principal.domain).to match(/^#{Regexp.quote(hostname)}$/i)
+      expect(principal.domain_account).to match(/^#{Regexp.quote(hostname)}\\#{Regexp.quote(username)}$/i)
+      expect(principal.account_type).to eq(:SidTypeUser)
+    end
+
+    it "should create an instance from a well-known group alias" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('Administrators')
+      expect(principal.account).to eq('Administrators')
+      expect(principal.sid_bytes).to eq(administrator_bytes)
+      expect(principal.sid).to eq('S-1-5-32-544')
+      expect(principal.domain).to eq('BUILTIN')
+      expect(principal.domain_account).to eq('BUILTIN\\Administrators')
+      expect(principal.account_type).to eq(:SidTypeAlias)
+    end
+
+    it "should raise an error when trying to lookup an account that doesn't exist" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        principal.lookup_account_name('ConanTheBarbarian')
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountNameW/)
+    end
+
+    it "should return a BUILTIN domain principal for empty account names" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('')
+      expect(principal.account_type).to eq(:SidTypeDomain)
+      expect(principal.sid).to eq('S-1-5-32')
+      expect(principal.account).to eq('BUILTIN')
+      expect(principal.domain).to eq('BUILTIN')
+      expect(principal.domain_account).to eq('BUILTIN')
+    end
+
+    it "should return a BUILTIN domain principal for BUILTIN account names" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_name('BUILTIN')
+      expect(principal.account_type).to eq(:SidTypeDomain)
+      expect(principal.sid).to eq('S-1-5-32')
+      expect(principal.account).to eq('BUILTIN')
+      expect(principal.domain).to eq('BUILTIN')
+      expect(principal.domain_account).to eq('BUILTIN')
+    end
+
+  end
+
+  describe ".lookup_account_sid" do
+    it "should create an instance from a well-known account SID" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(system_bytes)
+      expect(principal.account).to eq('SYSTEM')
+      expect(principal.sid_bytes).to eq(system_bytes)
+      expect(principal.sid).to eq('S-1-5-18')
+      expect(principal.domain).to eq('NT AUTHORITY')
+      expect(principal.domain_account).to eq('NT AUTHORITY\\SYSTEM')
+
+      # Windows API LookupAccountSid behaves differently if current user is SYSTEM
+      if Puppet::Util::Windows::ADSI::User.current_user_name != 'SYSTEM'
+        account_type = :SidTypeWellKnownGroup
+      else
+        account_type = :SidTypeUser
+      end
+
+      expect(principal.account_type).to eq(account_type)
+    end
+
+    it "should create an instance from a well-known group SID" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid(administrator_bytes)
+      expect(principal.account).to eq('Administrators')
+      expect(principal.sid_bytes).to eq(administrator_bytes)
+      expect(principal.sid).to eq('S-1-5-32-544')
+      expect(principal.domain).to eq('BUILTIN')
+      expect(principal.domain_account).to eq('BUILTIN\\Administrators')
+      expect(principal.account_type).to eq(:SidTypeAlias)
+    end
+
+    it "should raise an error when trying to lookup nil" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        principal.lookup_account_sid(nil)
+      }.to raise_error(Puppet::Util::Windows::Error, /must not be nil/)
+    end
+
+    it "should raise an error when trying to lookup non-byte array" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        principal.lookup_account_sid('ConanTheBarbarian')
+      }.to raise_error(Puppet::Util::Windows::Error, /array/)
+    end
+
+    it "should raise an error when trying to lookup an empty array" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        principal.lookup_account_sid([])
+      }.to raise_error(Puppet::Util::Windows::Error, /at least 1 byte long/)
+    end
+
+    # https://technet.microsoft.com/en-us/library/cc962011.aspx
+    # "... The structure used in all SIDs created by Windows NT and Windows 2000 is revision level 1. ..."
+    # Therefore a value of zero for the revision, is not a valid SID
+    it "should raise an error when trying to lookup completely invalid SID bytes" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        principal.lookup_account_sid([0])
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  The parameter is incorrect/)
+    end
+
+    it "should raise an error when trying to lookup a valid SID that doesn't have a matching account" do
+      principal = Puppet::Util::Windows::SID::Principal
+      expect {
+        # S-1-1-1 which is not a valid account
+        principal.lookup_account_sid([1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0])
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  No mapping between account names and security IDs was done/)
+    end
+
+    it "should return a domain principal for BUILTIN SID S-1-5-32" do
+      principal = Puppet::Util::Windows::SID::Principal.lookup_account_sid([1, 1, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0])
+      expect(principal.account_type).to eq(:SidTypeDomain)
+      expect(principal.sid).to eq('S-1-5-32')
+      expect(principal.account).to eq('BUILTIN')
+      expect(principal.domain).to eq('BUILTIN')
+      expect(principal.domain_account).to eq('BUILTIN')
+    end
+  end
+
+  describe "it should create matching Principal objects" do
+    let(:builtin_sid) { [1, 1, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0] }
+    let(:sid_principal) { Puppet::Util::Windows::SID::Principal.lookup_account_sid(builtin_sid) }
+
+    ['.', 'builtin', ''].each do |name|
+      it "when comparing the one looked up via SID S-1-5-32 to one looked up via non-canonical name #{name} for the BUILTIN domain" do
+        name_principal = Puppet::Util::Windows::SID::Principal.lookup_account_name(name)
+
+        # compares canonical sid
+        expect(sid_principal).to eq(name_principal)
+
+        # compare all properties that have public accessors
+        sid_principal.public_methods(false).reject { |m| m == :== }.each do |method|
+          expect(sid_principal.send(method)).to eq(name_principal.send(method))
+        end
+      end
+    end
+  end
+end

data/spec/integration/util/windows/process_spec.rb

@@ -31,4 +31,35 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
       expect { Puppet::Util::Windows::Process.lookup_privilege_value('foo') }.to raise_error(Puppet::Util::Windows::Error, fail_msg)
     end
   end
+
+  describe "when setting environment variables" do
+    it "can properly handle env var values with = in them" do
+      begin
+        name = SecureRandom.uuid
+        value = 'foo=bar'
+
+        Puppet::Util::Windows::Process.set_environment_variable(name, value)
+
+        env = Puppet::Util::Windows::Process.get_environment_strings
+
+        expect(env[name]).to eq(value)
+      ensure
+        Puppet::Util::Windows::Process.set_environment_variable(name, nil)
+      end
+    end
+
+    it "can properly handle empty env var values" do
+      begin
+        name = SecureRandom.uuid
+
+        Puppet::Util::Windows::Process.set_environment_variable(name, '')
+
+        env = Puppet::Util::Windows::Process.get_environment_strings
+
+        expect(env[name]).to eq('')
+      ensure
+        Puppet::Util::Windows::Process.set_environment_variable(name, nil)
+      end
+    end
+  end
 end

data/spec/{unit → integration}/util/windows/registry_spec.rb

@@ -2,10 +2,30 @@
 require 'spec_helper'
 require 'puppet/util/windows'
 
-describe Puppet::Util::Windows::Registry, :if => Puppet::Util::Platform.windows? do
+if Puppet::Util::Platform.windows?
+describe Puppet::Util::Windows::Registry do
   subject do
     class TestRegistry
       include Puppet::Util::Windows::Registry
+      extend FFI::Library
+
+      ffi_lib :advapi32
+      attach_function :RegSetValueExW,
+        [:handle, :pointer, :dword, :dword, :pointer, :dword], :win32_long
+
+      def write_corrupt_dword(reg, valuename)
+        # Normally DWORDs contain 4 bytes.  This bad data only has 2
+        bad_data = [0, 0]
+        FFI::Pointer.from_string_to_wide_string(valuename) do |name_ptr|
+          FFI::MemoryPointer.new(:uchar, bad_data.length) do |data_ptr|
+            data_ptr.write_array_of_uchar(bad_data)
+            if RegSetValueExW(reg.hkey, name_ptr, 0,
+              Win32::Registry::REG_DWORD, data_ptr, data_ptr.size) != 0
+                raise Puppet::Util::Windows::Error.new("Failed to write registry value")
+            end
+          end
+        end
+      end
     end
 
     TestRegistry.new
@@ -163,5 +183,75 @@ describe Puppet::Util::Windows::Registry, :if => Puppet::Util::Platform.windows?
         end
       end
     end
+
+    context "when reading values" do
+      let (:hklm) { Win32::Registry::HKEY_LOCAL_MACHINE }
+      let (:puppet_key) { "SOFTWARE\\Puppet Labs"}
+      let (:subkey_name) { "PuppetRegistryTest" }
+      let (:value_name) { SecureRandom.uuid }
+
+      after(:each) do
+        hklm.open(puppet_key, Win32::Registry::KEY_ALL_ACCESS) do |reg|
+          subject.delete_key(reg, subkey_name)
+        end
+      end
+
+      [
+        {:name => 'REG_SZ', :type => Win32::Registry::REG_SZ, :value => 'reg sz string'},
+        {:name => 'REG_EXPAND_SZ', :type => Win32::Registry::REG_EXPAND_SZ, :value => 'reg expand string'},
+        {:name => 'REG_MULTI_SZ', :type => Win32::Registry::REG_MULTI_SZ, :value => ['string1', 'string2']},
+        {:name => 'REG_BINARY', :type => Win32::Registry::REG_BINARY, :value => 'abinarystring'},
+        {:name => 'REG_DWORD', :type => Win32::Registry::REG_DWORD, :value => 0xFFFFFFFF},
+        {:name => 'REG_DWORD_BIG_ENDIAN', :type => Win32::Registry::REG_DWORD_BIG_ENDIAN, :value => 0xFFFF},
+        {:name => 'REG_QWORD', :type => Win32::Registry::REG_QWORD, :value => 0xFFFFFFFFFFFFFFFF},
+      ].each do |pair|
+        it "should return #{pair[:name]} values" do
+          hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg|
+            reg.write(value_name, pair[:type], pair[:value])
+          end
+
+          hklm.open("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_READ) do |reg|
+            vals = subject.values(reg)
+
+            expect(vals).to have_key(value_name)
+            subject.each_value(reg) do |subkey, type, data|
+              expect(type).to eq(pair[:type])
+            end
+
+            written = vals[value_name]
+            expect(written).to eq(pair[:value])
+          end
+        end
+      end
+    end
+
+    context "when reading corrupt values" do
+      let (:hklm) { Win32::Registry::HKEY_LOCAL_MACHINE }
+      let (:puppet_key) { "SOFTWARE\\Puppet Labs"}
+      let (:subkey_name) { "PuppetRegistryTest" }
+      let (:value_name) { SecureRandom.uuid }
+
+      before(:each) do
+        hklm.create("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg_key|
+          subject.write_corrupt_dword(reg_key, value_name)
+        end
+      end
+
+      after(:each) do
+        hklm.open(puppet_key, Win32::Registry::KEY_ALL_ACCESS) do |reg_key|
+          subject.delete_key(reg_key, subkey_name)
+        end
+      end
+
+      it "should return nil for a corrupt DWORD" do
+        hklm.open("#{puppet_key}\\#{subkey_name}", Win32::Registry::KEY_ALL_ACCESS) do |reg_key|
+          vals = subject.values(reg_key)
+
+          expect(vals).to have_key(value_name)
+          expect(vals[value_name]).to be_nil
+        end
+      end
+    end
   end
 end
+end

data/spec/integration/util/windows/security_spec.rb

@@ -14,14 +14,13 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
   before :all do
     @sids = {
       :current_user => Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name),
-      :system => Win32::Security::SID::LocalSystem,
-      :admin => Puppet::Util::Windows::SID.name_to_sid("Administrator"),
-      :administrators => Win32::Security::SID::BuiltinAdministrators,
+      :system => Puppet::Util::Windows::SID::LocalSystem,
+      :administrators => Puppet::Util::Windows::SID::BuiltinAdministrators,
       :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
-      :users => Win32::Security::SID::BuiltinUsers,
-      :power_users => Win32::Security::SID::PowerUsers,
-      :none => Win32::Security::SID::Nobody,
-      :everyone => Win32::Security::SID::Everyone
+      :users => Puppet::Util::Windows::SID::BuiltinUsers,
+      :power_users => Puppet::Util::Windows::SID::PowerUsers,
+      :none => Puppet::Util::Windows::SID::Nobody,
+      :everyone => Puppet::Util::Windows::SID::Everyone
     }
     # The TCP/IP NetBIOS Helper service (aka 'lmhosts') has ended up
     # disabled on some VMs for reasons we couldn't track down. This
@@ -239,6 +238,24 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
               expect(ace.mask).to eq(klass::FILE_ALL_ACCESS)
               expect(ace).not_to be_inherited
             end
+
+            if Puppet::FileSystem.directory?(path)
+              system_aces.each do |ace|
+                expect(ace).to be_object_inherit
+                expect(ace).to be_container_inherit
+              end
+
+              # it's critically important that this file be default created
+              # and that this file not have it's owner / group / mode set by winsec
+              nested_file = File.join(path, 'nested_file')
+              File.new(nested_file, 'w').close
+
+              system_aces = winsec.get_aces_for_path_by_sid(nested_file, sids[:system])
+              # even when SYSTEM is the owner (in CI), there should be an inherited SYSTEM
+              expect(system_aces.any? do |ace|
+                ace.mask == klass::FILE_ALL_ACCESS && ace.inherited?
+              end).to be_truthy
+            end
           end
 
           describe "for modes that require deny aces" do
@@ -387,9 +404,14 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
 
         describe "#owner=" do
+          it "should accept the guest sid" do
+            winsec.set_owner(sids[:guest], path)
+            expect(winsec.get_owner(path)).to eq(sids[:guest])
+          end
+
           it "should accept a user sid" do
-            winsec.set_owner(sids[:admin], path)
-            expect(winsec.get_owner(path)).to eq(sids[:admin])
+            winsec.set_owner(sids[:current_user], path)
+            expect(winsec.get_owner(path)).to eq(sids[:current_user])
           end
 
           it "should accept a group sid" do
@@ -407,14 +429,19 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         end
 
         describe "#group=" do
+          it "should accept the test group" do
+            winsec.set_group(sids[:guest], path)
+            expect(winsec.get_group(path)).to eq(sids[:guest])
+          end
+
           it "should accept a group sid" do
             winsec.set_group(sids[:power_users], path)
             expect(winsec.get_group(path)).to eq(sids[:power_users])
           end
 
           it "should accept a user sid" do
-            winsec.set_group(sids[:admin], path)
-            expect(winsec.get_group(path)).to eq(sids[:admin])
+            winsec.set_group(sids[:current_user], path)
+            expect(winsec.get_group(path)).to eq(sids[:current_user])
           end
 
           it "should combine owner and group rights when they are the same sid" do
@@ -451,7 +478,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             user = Puppet::Util::Windows::ADSI::User.create("puppet#{rand(10000)}")
             user.commit
             begin
-              sid = Puppet::Util::Windows::ADSI::User.new(user.name).sid.to_s
+              sid = Puppet::Util::Windows::ADSI::User.new(user.name).sid.sid
               winsec.set_owner(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
             ensure
@@ -467,7 +494,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             group = Puppet::Util::Windows::ADSI::Group.create("puppet#{rand(10000)}")
             group.commit
             begin
-              sid = Puppet::Util::Windows::ADSI::Group.new(group.name).sid.to_s
+              sid = Puppet::Util::Windows::ADSI::Group.new(group.name).sid.sid
               winsec.set_group(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXG, path)
             ensure