puppet 5.3.4 → 6.29.0

data/lib/puppet/provider/file/posix.rb

@@ -8,6 +8,11 @@ Puppet::Type.type(:file).provide :posix do
   include Puppet::Util::Warnings
 
   require 'etc'
+  require 'puppet/util/selinux'
+
+  def self.post_resource_eval
+    Selinux.matchpathcon_fini if Puppet::Util::SELinux.selinux_support?
+  end
 
   def uid2name(id)
     return id.to_s if id.is_a?(Symbol) or id.is_a?(String)
@@ -53,7 +58,8 @@ Puppet::Type.type(:file).provide :posix do
   end
 
   def owner
-    unless stat = resource.stat
+    stat = resource.stat
+    unless stat
       return :absent
     end
 
@@ -86,7 +92,8 @@ Puppet::Type.type(:file).provide :posix do
   end
 
   def group
-    return :absent unless stat = resource.stat
+    stat = resource.stat
+    return :absent unless stat
 
     currentvalue = stat.gid
 
@@ -117,7 +124,8 @@ Puppet::Type.type(:file).provide :posix do
   end
 
   def mode
-    if stat = resource.stat
+    stat = resource.stat
+    if stat
       return (stat.mode & 007777).to_s(8).rjust(4, '0')
     else
       return :absent

data/lib/puppet/provider/file/windows.rb

@@ -6,7 +6,7 @@ Puppet::Type.type(:file).provide :windows do
 
   include Puppet::Util::Warnings
 
-  if Puppet.features.microsoft_windows?
+  if Puppet::Util::Platform.windows?
     require 'puppet/util/windows'
     include Puppet::Util::Windows::Security
   end
@@ -71,7 +71,9 @@ Puppet::Type.type(:file).provide :windows do
 
   def mode=(value)
     begin
-      set_mode(value.to_i(8), resource[:path])
+      managing_owner = !resource[:owner].nil?
+      managing_group = !resource[:group].nil?
+      set_mode(value.to_i(8), resource[:path], true, managing_owner, managing_group)
     rescue => detail
       error = Puppet::Error.new(_("failed to set mode %{mode} on %{path}: %{message}") % { mode: mode, path: resource[:path], message: detail.message })
       error.set_backtrace detail.backtrace
@@ -86,6 +88,52 @@ Puppet::Type.type(:file).provide :windows do
     end
   end
 
+  # munge the windows group permissions if the user or group are set to SYSTEM
+  #
+  # when SYSTEM user is the group or user and the resoure is not managing them then treat
+  # the resource as insync if System has FullControl access.
+  #
+  # @param [String] current - the current mode returned by the resource
+  # @param [String] should  - what the mode should be
+  #
+  # @return [String, nil] munged mode or nil if the resource should be out of sync
+  def munge_windows_system_group(current, should)
+    [
+      {
+        'type'        => 'group',
+        'resource'    => resource[:group],
+        'set_to_user' => group,
+        'fullcontrol' => "070".to_i(8),
+        'remove_mask' => "707".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "070".to_i(8)),
+      },
+      {
+        'type'        => 'owner',
+        'resource'    => resource[:owner],
+        'set_to_user' => owner,
+        'fullcontrol' => "700".to_i(8),
+        'remove_mask' => "077".to_i(8),
+        'should_mask' => (should[0].to_i(8) & "700".to_i(8)),
+      }
+    ].each do |mode_part|
+      if mode_part['resource'].nil? && (mode_part['set_to_user'] == Puppet::Util::Windows::SID::LocalSystem)
+        if (current.to_i(8) & mode_part['fullcontrol']) == mode_part['fullcontrol']
+          # Since the group is LocalSystem, and the permissions are FullControl,
+          # replace the value returned with the value expected. This will treat
+          # this specific situation as "insync"
+          current = ( (current.to_i(8) & mode_part['remove_mask']) | mode_part['should_mask'] ).to_s(8).rjust(4, '0')
+        else
+          # If the SYSTEM account does _not_ have FullControl in this scenario, we should
+          # force the resource out of sync no matter what.
+          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          Puppet.debug { _("%{resource_name}: %{mode_part_type} set to SYSTEM. SYSTEM permissions cannot be set below FullControl ('7')") % { resource_name: resource[:name], mode_part_type: mode_part['type']} }
+          return nil
+        end
+      end
+    end
+    current
+  end
+
   attr_reader :file
   private
   def file

data/lib/puppet/provider/group/aix.rb

@@ -1,10 +1,6 @@
-#
 # Group Puppet provider for AIX. It uses standard commands to manage groups:
 #  mkgroup, rmgroup, lsgroup, chgroup
-#
-# Author::    Hector Rivas Gandara <keymon@gmail.com>
-#
-require 'puppet/provider/aixobject'
+require 'puppet/provider/aix_object'
 
 Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject do
   desc "Group management for AIX."
@@ -13,131 +9,91 @@ Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject d
   defaultfor :operatingsystem => :aix
   confine :operatingsystem => :aix
 
-  # Provider features
-  has_features :manages_aix_lam
-  has_features :manages_members
-
   # Commands that manage the element
   commands :list      => "/usr/sbin/lsgroup"
   commands :add       => "/usr/bin/mkgroup"
   commands :delete    => "/usr/sbin/rmgroup"
   commands :modify    => "/usr/bin/chgroup"
 
-  # Group attributes to ignore
-  def self.attribute_ignore
-    []
-  end
-
-  # AIX attributes to properties mapping.
-  #
-  # Valid attributes to be managed by this provider.
-  # It is a list with of hash
-  #  :aix_attr      AIX command attribute name
-  #  :puppet_prop   Puppet property name
-  #  :to            Method to adapt puppet property to aix command value. Optional.
-  #  :from          Method to adapt aix command value to puppet property. Optional
-  self.attribute_mapping = [
-    #:name => :name,
-    {:aix_attr => :id,       :puppet_prop => :gid },
-    {:aix_attr => :users,    :puppet_prop => :members,
-      :from => :users_from_attr},
-    {:aix_attr => :attributes, :puppet_prop => :attributes},
-  ]
-
-  #--------------
-  # Command definition
-
-  # Return the IA module arguments based on the resource param ia_load_module
-  def get_ia_module_args
-    if @resource[:ia_load_module]
-      ["-R", @resource[:ia_load_module].to_s]
-    else
-      []
-    end
-  end
-
-  def lscmd(value=@resource[:name])
-    [self.class.command(:list)] +
-      self.get_ia_module_args +
-      [ value]
-  end
-
-  def lsallcmd()
-    lscmd("ALL")
-  end
-
-  def addcmd(extra_attrs = [])
-    # Here we use the @resource.to_hash to get the list of provided parameters
-    # Puppet does not call to self.<parameter>= method if it does not exists.
+  # Provider features
+  has_features :manages_aix_lam
+  has_features :manages_members
+  has_features :manages_local_users_and_groups
+
+  class << self
+    # Used by the AIX user provider. Returns a hash of:
+    #   {
+    #     :name => <group_name>,
+    #     :gid  => <gid>
+    #   }
     #
-    # It gets an extra list of arguments to add to the user.
-    [self.class.command(:add) ] +
-      self.get_ia_module_args +
-      self.hash2args(@resource.to_hash) +
-      extra_attrs + [@resource[:name]]
-  end
+    # that matches the group, which can either be the group name or
+    # the gid. Takes an optional set of ia_module_args
+    def find(group, ia_module_args = [])
+      groups = list_all(ia_module_args)
+
+      id_property = mappings[:puppet_property][:id]
+
+      if group.is_a?(String)
+        # Find by name
+        group_hash = groups.find { |cur_group| cur_group[:name] == group }
+      else
+        # Find by gid
+        group_hash = groups.find do |cur_group|
+          id_property.convert_attribute_value(cur_group[:id]) == group
+        end
+      end
 
-  def modifycmd(hash = property_hash)
-    args = self.hash2args(hash)
-    return nil if args.empty?
+      unless group_hash
+        raise ArgumentError, _("No AIX group exists with a group name or gid of %{group}!") % { group: group }
+      end
 
-    [self.class.command(:modify)] +
-      self.get_ia_module_args +
-      args + [@resource[:name]]
-  end
+      # Convert :id => :gid
+      id = group_hash.delete(:id)
+      group_hash[:gid] = id_property.convert_attribute_value(id)
 
-  def deletecmd
-    [self.class.command(:delete)] +
-      self.get_ia_module_args +
-      [@resource[:name]]
-  end
+      group_hash
+    end
 
+    # Define some Puppet Property => AIX Attribute (and vice versa)
+    # conversion functions here. This is so we can unit test them.
 
-  #--------------
-  # Overwrite get_arguments to add the attributes' arguments
-  def get_arguments(key, value, mapping, objectinfo)
-    # In the case of attributes, return a list of key=value
-    if key == :attributes
-      unless value and value.is_a? Hash
-        raise Puppet::Error, _("Attributes must be a list of pairs key=value on %{resource}[%{name}]") %
-            { resource: @resource.class.name, name: @resource.name }
+    def members_to_users(provider, members)
+      members = members.split(',') if members.is_a?(String)
+      unless provider.resource[:auth_membership]
+        current_members = provider.members
+        current_members = [] if current_members == :absent
+        members = (members + current_members).uniq
       end
-      return value.select { |k,v| true }.map { |pair| pair.join("=") }
-    end
-    super(key, value, mapping, objectinfo)
-  end
 
-  def filter_attributes(hash)
-    # Return only not managed attributes.
-    hash.select {
-        |k,v| !self.class.attribute_mapping_from.include?(k) and
-                !self.class.attribute_ignore.include?(k)
-      }.inject({}) {
-        |h, array| h[array[0]] = array[1]; h
-      }
-  end
-
-  def attributes
-    filter_attributes(getosinfo(false))
-  end
+      members.join(',')
+    end
 
-  def attributes=(attr_hash)
-    #self.class.validate(param, value)
-    param = :attributes
-    cmd = modifycmd({param => filter_attributes(attr_hash)})
-    if cmd
-      begin
-        execute(cmd)
-      rescue Puppet::ExecutionFailure  => detail
-        raise Puppet::Error, _("Could not set %{param} on %{resource}[%{name}]: %{detail}") % { param: param, resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
-      end
+    def users_to_members(users)
+      users.split(',')
     end
   end
 
-  # Force convert users it a list.
-  def users_from_attr(value)
-    (value.is_a? String) ? value.split(',') : value
+  mapping puppet_property: :members,
+          aix_attribute: :users,
+          property_to_attribute: method(:members_to_users),
+          attribute_to_property: method(:users_to_members)
+
+  numeric_mapping puppet_property: :gid,
+                  aix_attribute: :id
+
+  # Now that we have all of our mappings, let's go ahead and make
+  # the resource methods (property getters + setters for our mapped
+  # properties + a getter for the attributes property).
+  mk_resource_methods
+
+  # We could add this to the top-level members property since the
+  # implementation is not platform-specific; however, it is best
+  # to do it this way so that we do not accidentally break something.
+  # This is ok for now, since we do plan on moving this and the
+  # auth_membership management over to the property class in a future
+  # Puppet release.
+  def members_insync?(current, should)
+    current.sort == @resource.parameter(:members).actual_should(current, should)
   end
-
-
 end

data/lib/puppet/provider/group/groupadd.rb

@@ -4,18 +4,22 @@ require 'puppet/util/libuser'
 Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameService::ObjectAdd do
   desc "Group management via `groupadd` and its ilk. The default for most platforms.
 
-  "
+ To use the `forcelocal` parameter, you need to install the `libuser` package (providing
+  `/usr/sbin/lgroupadd` and `/usr/sbin/luseradd`)."
 
   commands :add => "groupadd", :delete => "groupdel", :modify => "groupmod"
 
-  has_feature :system_groups unless %w{HP-UX Solaris}.include? Facter.value(:operatingsystem)
+  has_feature :system_groups unless %w{HP-UX Solaris}.include? Puppet.runtime[:facter].value(:operatingsystem)
 
   verify :gid, _("GID must be an integer") do |value|
     value.is_a? Integer
   end
 
-  optional_commands :localadd => "lgroupadd"
-  has_feature :libuser if Puppet.features.libuser?
+  optional_commands :localadd => "lgroupadd", :localdelete => "lgroupdel", :localmodify => "lgroupmod"
+
+  has_feature :manages_local_users_and_groups, :manages_members if Puppet.features.libuser?
+
+  options :members, :flag => '-M', :method => :mem
 
   def exists?
     return !!localgid if @resource.forcelocal?
@@ -27,25 +31,9 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     get(:gid)
   end
 
-  def findgroup(key, value)
-    group_file = "/etc/group"
-    group_keys = ['group_name', 'password', 'gid', 'user_list']
-    index = group_keys.index(key)
-    File.open(group_file) do |f|
-      f.each_line do |line|
-         group = line.split(":")
-         if group[index] == value
-             f.close
-             return group
-         end
-      end
-    end
-    false
-  end
-
   def localgid
-    group = findgroup('group_name', resource[:name])
-    return group[2] if group
+    group = findgroup(:group_name, resource[:name])
+    return group[:gid] if group
     false
   end
 
@@ -55,7 +43,7 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     # to ensure consistent behaviour of the useradd provider when
     # using both useradd and luseradd
     if not @resource.allowdupe? and @resource.forcelocal?
-       if @resource.should(:gid) and findgroup('gid', @resource.should(:gid).to_s)
+       if @resource.should(:gid) and findgroup(:gid, @resource.should(:gid).to_s)
            raise(Puppet::Error, _("GID %{resource} already exists, use allowdupe to force group creation") % { resource: @resource.should(:gid).to_s })
        end
     elsif @resource.allowdupe? and not @resource.forcelocal?
@@ -64,6 +52,11 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     []
   end
 
+  def create
+    super
+    set(:members, @resource[:members]) if @resource[:members]
+  end
+
   def addcmd
     if @resource.forcelocal?
       cmd = [command(:localadd)]
@@ -72,7 +65,8 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
       cmd = [command(:add)]
     end
 
-    if gid = @resource.should(:gid)
+    gid = @resource.should(:gid)
+    if gid
       unless gid == :absent
         cmd << flag(:gid) << gid
       end
@@ -82,4 +76,78 @@ Puppet::Type.type(:group).provide :groupadd, :parent => Puppet::Provider::NameSe
     cmd << @resource[:name]
     cmd
   end
+
+  def validate_members(members)
+    members.each do |member|
+      member.split(',').each do |user|
+        Etc.getpwnam(user.strip)
+      end
+    end
+  end
+
+  def modifycmd(param, value)
+    if @resource.forcelocal? || @resource[:members]
+      cmd = [command(:localmodify)]
+      @custom_environment = Puppet::Util::Libuser.getenv
+    else
+      cmd = [command(:modify)]
+    end
+
+    if param == :members
+      validate_members(value)
+      value = members_to_s(value)
+      purge_members if @resource[:auth_membership] && !members.empty?
+    end
+
+    cmd << flag(param) << value
+    # TODO the group type only really manages gid, so there are currently no
+    # tests for this behavior
+    cmd += check_allow_dup if param == :gid
+    cmd << @resource[:name]
+
+    cmd
+  end
+
+  def deletecmd
+    if @resource.forcelocal?
+      @custom_environment = Puppet::Util::Libuser.getenv
+      [command(:localdelete), @resource[:name]]
+    else
+      [command(:delete), @resource[:name]]
+    end
+  end
+
+  def members_insync?(current, should)
+    current.uniq.sort == @resource.parameter(:members).actual_should(current, should)
+  end
+
+  def members_to_s(current)
+    return '' if current.nil? || !current.kind_of?(Array)
+    current.join(',')
+  end
+
+  def purge_members
+    localmodify('-m', members_to_s(members), @resource.name)
+  end
+
+  private
+
+  def findgroup(key, value)
+    group_file = '/etc/group'
+    group_keys = [:group_name, :password, :gid, :user_list]
+
+    unless @groups
+      unless Puppet::FileSystem.exist?(group_file)
+        raise Puppet::Error.new("Forcelocal set for group resource '#{resource[:name]}', but #{group_file} does not exist")
+      end
+
+      @groups = []
+      Puppet::FileSystem.each_line(group_file) do |line|
+        group = line.chomp.split(':')
+        @groups << Hash[group_keys.zip(group)]
+      end
+    end
+
+    @groups.find { |param| param[key] == value } || false
+  end
 end

data/lib/puppet/provider/group/ldap.rb

@@ -24,9 +24,11 @@ Puppet::Type.type(:group).provide :ldap, :parent => Puppet::Provider::Ldap do
   provider = self
   manager.generates(:gidNumber).with do
     largest = 500
-    if existing = provider.manager.search
-        existing.each do |hash|
-        next unless value = hash[:gid]
+    existing = provider.manager.search
+    if existing
+      existing.each do |hash|
+        value = hash[:gid]
+        next unless value
         num = value[0].to_i
         largest = num if num > largest
       end
@@ -36,7 +38,8 @@ Puppet::Type.type(:group).provide :ldap, :parent => Puppet::Provider::Ldap do
 
   # Convert a group name to an id.
   def self.name2id(group)
-    return nil unless result = manager.search("cn=#{group}") and result.length > 0
+    result = manager.search("cn=#{group}")
+    return nil unless result and result.length > 0
 
     # Only use the first result.
     group = result[0]

data/lib/puppet/provider/group/pw.rb

@@ -18,13 +18,15 @@ Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService:
   def addcmd
     cmd = [command(:pw), "groupadd", @resource[:name]]
 
-    if gid = @resource.should(:gid)
+    gid = @resource.should(:gid)
+    if gid
       unless gid == :absent
         cmd << flag(:gid) << gid
       end
     end
 
-    if members = @resource.should(:members)
+    members = @resource.should(:members)
+    if members
       unless members == :absent
         if members.is_a?(Array)
           members = members.join(",")

data/lib/puppet/provider/group/windows_adsi.rb

@@ -24,11 +24,11 @@ Puppet::Type.type(:group).provide :windows_adsi do
     # since the default array_matching comparison is not commutative
 
     # dupes automatically weeded out when hashes built
-    current_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current)
-    specified_users = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
+    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
+    specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
 
-    current_sids = current_users.keys.to_a
-    specified_sids = specified_users.keys.to_a
+    current_sids = current_members.keys.to_a
+    specified_sids = specified_members.keys.to_a
 
     if @resource[:auth_membership]
       current_sids.sort == specified_sids.sort
@@ -40,7 +40,7 @@ Puppet::Type.type(:group).provide :windows_adsi do
   def members_to_s(users)
     return '' if users.nil? or !users.kind_of?(Array)
     users = users.map do |user_name|
-      sid = Puppet::Util::Windows::SID.name_to_sid_object(user_name)
+      sid = Puppet::Util::Windows::SID.name_to_principal(user_name)
       if !sid
         resource.debug("#{user_name} (unresolvable to SID)")
         next user_name
@@ -52,13 +52,13 @@ Puppet::Type.type(:group).provide :windows_adsi do
         account = sid.account
       end
       resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
-      "#{sid.domain}\\#{account}"
+      sid.domain ? "#{sid.domain}\\#{account}" : account
     end
     return users.join(',')
   end
 
   def member_valid?(user_name)
-    ! Puppet::Util::Windows::SID.name_to_sid_object(user_name).nil?
+    ! Puppet::Util::Windows::SID.name_to_principal(user_name).nil?
   end
 
   def group
@@ -66,7 +66,11 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    group.members
+    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
+
+    # @members.keys returns an array of SIDs. We need to convert those SIDs into
+    # names so that `puppet resource` prints the right output.
+    members_to_s(@members.keys).split(',')
   end
 
   def members=(members)

data/lib/puppet/provider/ldap.rb

@@ -10,7 +10,8 @@ class Puppet::Provider::Ldap < Puppet::Provider
 
   # Look up all instances at our location.  Yay.
   def self.instances
-    return [] unless list = manager.search
+    list = manager.search
+    return [] unless list
 
     list.collect { |entry| new(entry) }
   end
@@ -29,7 +30,8 @@ class Puppet::Provider::Ldap < Puppet::Provider
   # Query all of our resources from ldap.
   def self.prefetch(resources)
     resources.each do |name, resource|
-      if result = manager.find(name)
+      result = manager.find(name)
+      if result
         result[:ensure] = :present
         resource.provider = new(result)
       else
@@ -45,7 +47,8 @@ class Puppet::Provider::Ldap < Puppet::Provider
   def create
     @property_hash[:ensure] = :present
     self.class.resource_type.validproperties.each do |property|
-      if val = resource.should(property)
+      val = resource.should(property)
+      if val
         if property.to_s == 'gid'
           self.gid = val
         else
@@ -126,7 +129,8 @@ class Puppet::Provider::Ldap < Puppet::Provider
   # LAK:NOTE This is normally not used, because we rely on prefetching.
   def query
     # Use the module function.
-    unless attributes = manager.find(name)
+    attributes = manager.find(name)
+    unless attributes
       @ldap_properties = {}
       return nil
     end

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -289,7 +289,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
     end
     dscl_out = dscl(dscl_args)
     # We're ok with throwing away negative uids here.
-    ids = dscl_out.split.compact.collect { |l| l.to_i if l.match(/^\d+$/) }
+    ids = dscl_out.split.compact.collect { |l| l.to_i if l =~ /^\d+$/ }
     ids.compact!.sort! { |a,b| a.to_f <=> b.to_f }
     # We're just looking for an unused id in our sorted array.
     ids.each_index do |i|
@@ -313,10 +313,13 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
         # have a string and need to convert it to a number
         if @resource.should(name)
           @resource.property(name).sync
-        elsif value = autogen(name)
-          self.send(name.to_s + "=", value)
         else
-          next
+          value = autogen(name)
+          if value
+            self.send(name.to_s + "=", value)
+          else
+            next
+          end
         end
       end
     end
@@ -393,7 +396,8 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
       fail(_("Could not set GeneratedUID for %{resource} %{name}: %{detail}") % { resource: @resource.class.name, name: @resource.name, detail: detail })
     end
 
-    if value = @resource.should(:password) and value != ""
+    value = @resource.should(:password)
+    if value && value != ""
       self.class.set_password(@resource[:name], guid, value)
     end
 
@@ -402,10 +406,10 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
       next if property == :ensure
       value = @resource.should(property)
       if property == :gid and value.nil?
-        value = self.class.next_system_id(id_type='gid')
+        value = self.class.next_system_id('gid')
       end
       if property == :uid and value.nil?
-        value = self.class.next_system_id(id_type='uid')
+        value = self.class.next_system_id('uid')
       end
       if value != "" and not value.nil?
         if property == :members
@@ -431,7 +435,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
         cmd = [:dseditgroup, "-o", "edit", "-n", ".", "-d", member, @resource[:name]]
         begin
           execute(cmd)
-        rescue Puppet::ExecutionFailure => detail
+        rescue Puppet::ExecutionFailure
           # TODO: We're falling back to removing the member using dscl due to rdar://8481241
           # This bug causes dseditgroup to fail to remove a member if that member doesn't exist
           cmd = [:dscl, ".", "-delete", "/Groups/#{@resource.name}", "GroupMembership", member]