puppet 5.5.16-universal-darwin → 5.5.21-universal-darwin

data/spec/unit/provider/selmodule_spec.rb

@@ -6,78 +6,149 @@
 require 'spec_helper'
 require 'stringio'
 
-provider_class = Puppet::Type.type(:selmodule).provider(:semodule)
+describe Puppet::Type.type(:selmodule).provider(:semodule) do
+  let(:resource) { instance_double('resource', name: name) }
+  let(:provider) { described_class.new(resource) }
 
-describe provider_class do
   before :each do
-    @resource = double("resource", :name => "foo")
-    allow(@resource).to receive(:[]).and_return("foo")
-    @provider = provider_class.new(@resource)
+    allow(resource).to receive(:[]).and_return name
   end
 
-  describe "exists? method" do
-    it "should find a module if it is already loaded" do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield(StringIO.new("bar\t1.2.3\nfoo\t4.4.4\nbang\t1.0.0\n"))
-      expect(@provider.exists?).to eq(:true)
+  def loaded_modules
+    {
+      'bar'  => '1.2.3',
+      'foo'  => '4.4.4',
+      'bang' => '1.0.0',
+    }
+  end
+
+  def semodule_list_output
+    loaded_modules.map{|k,v| "#{k}\t#{v}"}.join("\n")
+  end
+
+  describe 'selmodules_loaded' do
+    let(:name) { 'foo' }
+
+    it 'should return raise an exception when running selmodule raises an exception' do
+      provider.class.loaded_modules = nil # Reset loaded_modules before test
+      allow(provider.class).to receive(:command).with(:semodule).and_return '/usr/sbin/semodule'
+      allow(provider.class).to receive(:execpipe).with('/usr/sbin/semodule --list')
+        .and_yield(StringIO.new("this is\nan error")).and_raise(Puppet::ExecutionFailure, 'it failed')
+      expect { provider.selmodules_loaded }
+        .to raise_error(Puppet::Error, /Could not list policy modules: ".*" failed with "this is an error"/)
+    end
+
+    it 'should return empty hash if no modules are loaded' do
+      provider.class.loaded_modules = nil # Reset loaded_modules before test
+      allow(provider.class).to receive(:command).with(:semodule).and_return '/usr/sbin/semodule'
+      allow(provider.class).to receive(:execpipe).with('/usr/sbin/semodule --list').and_yield StringIO.new('')
+      expect(provider.selmodules_loaded).to eq(Hash.new())
+    end
+
+    it 'should return hash of loaded modules' do
+      provider.class.loaded_modules = nil # Reset loaded_modules before test
+      allow(provider.class).to receive(:command).with(:semodule).and_return '/usr/sbin/semodule'
+      allow(provider.class).to receive(:execpipe).with('/usr/sbin/semodule --list').and_yield StringIO.new(semodule_list_output)
+      expect(provider.selmodules_loaded).to eq(loaded_modules)
+    end
+
+    it 'should return cached hash of loaded modules' do
+      allow(provider.class).to receive(:loaded_modules).and_return loaded_modules
+      allow(provider.class).to receive(:command).with(:semodule).and_return '/usr/sbin/semodule'
+      allow(provider.class).to receive(:execpipe).with('/usr/sbin/semodule --list').and_yield StringIO.new("test\t1.0.0")
+      expect(provider.selmodules_loaded).to eq(loaded_modules)
     end
 
-    it "should return nil if not loaded" do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield(StringIO.new("bar\t1.2.3\nbang\t1.0.0\n"))
-      expect(@provider.exists?).to be_nil
+    it 'should return cached hash of loaded modules and not raise an exception' do
+      allow(provider.class).to receive(:loaded_modules).and_return loaded_modules
+      allow(provider.class).to receive(:command).with(:semodule).and_return '/usr/sbin/semodule'
+      allow(provider.class).to receive(:execpipe).with('/usr/sbin/semodule --list')
+        .and_yield(StringIO.new('this should not be called')).and_raise(Puppet::ExecutionFailure, 'it failed')
+      expect(provider.selmodules_loaded).to eq(loaded_modules)
     end
+  end
+
+  describe 'exists? method' do
+    context 'with name foo' do
+      let(:name) { 'foo' }
+
+      it 'should return false if no modules are loaded' do
+        allow(provider).to receive(:selmodules_loaded).and_return Hash.new()
+        expect(provider.exists?).to eq(false)
+      end
+
+      it 'should find a module if it is already loaded' do
+        allow(provider).to receive(:selmodules_loaded).and_return loaded_modules
+        expect(provider.exists?).to eq(true)
+      end
+    end
+
+    context 'with name foobar' do
+      let(:name) { 'foobar' }
 
-    it "should return nil if module with same suffix is loaded" do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield(StringIO.new("bar\t1.2.3\nmyfoo\t1.0.0\n"))
-      expect(@provider.exists?).to be_nil
+      it 'should return false if not loaded' do
+        allow(provider).to receive(:selmodules_loaded).and_return loaded_modules
+        expect(provider.exists?).to eq(false)
+      end
     end
 
-    it "should return nil if no modules are loaded" do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield(StringIO.new(""))
-      expect(@provider.exists?).to be_nil
+    context 'with name myfoo' do
+      let(:name) { 'myfoo' }
+
+      it 'should return false if module with same suffix is loaded' do
+        allow(provider).to receive(:selmodules_loaded).and_return loaded_modules
+        expect(provider.exists?).to eq(false)
+      end
     end
   end
 
-  describe "selmodversion_file" do
-    it "should return 1.5.0 for the example policy file" do
-      expect(@provider).to receive(:selmod_name_to_filename).and_return("#{File.dirname(__FILE__)}/selmodule-example.pp")
-      expect(@provider.selmodversion_file).to eq("1.5.0")
+  describe 'selmodversion_file' do
+    let(:name) { 'foo' }
+
+    it 'should return 1.5.0 for the example policy file' do
+      allow(provider).to receive(:selmod_name_to_filename).and_return "#{File.dirname(__FILE__)}/selmodule-example.pp"
+      expect(provider.selmodversion_file).to eq('1.5.0')
     end
   end
 
-  describe "syncversion" do
-    it "should return :true if loaded and file modules are in sync" do
-      expect(@provider).to receive(:selmodversion_loaded).and_return("1.5.0")
-      expect(@provider).to receive(:selmodversion_file).and_return("1.5.0")
-      expect(@provider.syncversion).to eq(:true)
+  describe 'syncversion' do
+    let(:name) { 'foo' }
+
+    it 'should return :true if loaded and file modules are in sync' do
+      allow(provider).to receive(:selmodversion_loaded).and_return '1.5.0'
+      allow(provider).to receive(:selmodversion_file).and_return '1.5.0'
+      expect(provider.syncversion).to eq(:true)
     end
 
-    it "should return :false if loaded and file modules are not in sync" do
-      expect(@provider).to receive(:selmodversion_loaded).and_return("1.4.0")
-      expect(@provider).to receive(:selmodversion_file).and_return("1.5.0")
-      expect(@provider.syncversion).to eq(:false)
+    it 'should return :false if loaded and file modules are not in sync' do
+      allow(provider).to receive(:selmodversion_loaded).and_return '1.4.0'
+      allow(provider).to receive(:selmodversion_file).and_return '1.5.0'
+      expect(provider.syncversion).to eq(:false)
     end
 
-    it "should return before checking file version if no loaded policy" do
-      expect(@provider).to receive(:selmodversion_loaded).and_return(nil)
-      expect(@provider.syncversion).to eq(:false)
+    it 'should return before checking file version if no loaded policy' do
+      allow(provider).to receive(:selmodversion_loaded).and_return nil
+      expect(provider.syncversion).to eq(:false)
     end
   end
 
-  describe "selmodversion_loaded" do
-    it "should return the version of a loaded module" do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield(StringIO.new("bar\t1.2.3\nfoo\t4.4.4\nbang\t1.0.0\n"))
-      expect(@provider.selmodversion_loaded).to eq("4.4.4")
+  describe 'selmodversion_loaded' do
+    context 'with name foo' do
+      let(:name) { 'foo' }
+
+      it 'should return the version of a loaded module' do
+        allow(provider).to receive(:selmodules_loaded).and_return loaded_modules
+        expect(provider.selmodversion_loaded).to eq('4.4.4')
+      end
     end
 
-    it 'should return raise an exception when running selmodule raises an exception' do
-      expect(@provider).to receive(:command).with(:semodule).and_return("/usr/sbin/semodule")
-      expect(@provider).to receive(:execpipe).with("/usr/sbin/semodule --list").and_yield("this is\nan error").and_raise(Puppet::ExecutionFailure, 'it failed')
-      expect {@provider.selmodversion_loaded}.to raise_error(Puppet::ExecutionFailure, /Could not list policy modules: ".*" failed with "this is an error"/)
+    context 'with name foobar' do
+      let(:name) { 'foobar' }
+
+      it 'should return nil if module is not loaded' do
+        allow(provider).to receive(:selmodules_loaded).and_return loaded_modules
+        expect(provider.selmodversion_loaded).to be_nil
+      end
     end
   end
 end

data/spec/unit/provider/service/daemontools_spec.rb

@@ -160,4 +160,28 @@ describe Puppet::Type.type(:service).provider(:daemontools) do
       expect(@provider.status).to  eq(:stopped)
     end
   end
+
+  context '.instances' do
+    before do
+      allow(described_class).to receive(:defpath).and_return(path)
+    end
+
+    context 'when defpath is nil' do
+      let(:path) { nil }
+
+      it 'returns info message' do
+        expect(Puppet).to receive(:info).with(/daemontools is unsuitable because service directory is nil/)
+        described_class.instances
+      end
+    end
+
+    context 'when defpath does not exist' do
+      let(:path) { '/inexistent_path' }
+
+      it 'returns notice about missing path' do
+        expect(Puppet).to receive(:notice).with(/Service path #{path} does not exist/)
+        described_class.instances
+      end
+    end
+  end
 end

data/spec/unit/provider/service/launchd_spec.rb

@@ -125,6 +125,8 @@ describe Puppet::Type.type(:service).provider(:launchd) do
   end
 
   describe "when starting the service" do
+    let(:services) { "12345 0 #{joblabel}"  }
+
     it "should call any explicit 'start' command" do
       resource[:start] = "/bin/false"
       expect(subject).to receive(:texecute).with(:start, ["/bin/false"], true)
@@ -132,6 +134,7 @@ describe Puppet::Type.type(:service).provider(:launchd) do
     end
 
     it "should look for the relevant plist once" do
+      allow(provider).to receive(:launchctl).with(:list).and_return(services)
       expect(subject).to receive(:plist_from_label).and_return([joblabel, {}]).once
       expect(subject).to receive(:enabled?).and_return(:true)
       expect(subject).to receive(:execute).with([:launchctl, :load, "-w", joblabel])
@@ -139,6 +142,7 @@ describe Puppet::Type.type(:service).provider(:launchd) do
     end
 
     it "should execute 'launchctl load' once without writing to the plist if the job is enabled" do
+      allow(provider).to receive(:launchctl).with(:list).and_return(services)
       expect(subject).to receive(:plist_from_label).and_return([joblabel, {}])
       expect(subject).to receive(:enabled?).and_return(:true)
       expect(subject).to receive(:execute).with([:launchctl, :load, "-w", joblabel]).once
@@ -242,6 +246,30 @@ describe Puppet::Type.type(:service).provider(:launchd) do
     end
   end
 
+  describe "when a service is unavailable" do
+    let(:map) { {"some.random.job" => "/path/to/job.plist"} }
+    
+    before :each do
+      allow(provider).to receive(:make_label_to_path_map).and_return(map)
+    end
+
+    it "should fail when searching for the unavailable service" do
+      expect { provider.jobsearch("NOSUCH") }.to raise_error(Puppet::Error)
+    end
+
+    it "should return false when enabling the service" do
+      expect(subject.enabled?).to eq(:false)
+    end
+
+    it "should fail when starting the service" do
+      expect { subject.start }.to raise_error(Puppet::Error)
+    end
+
+    it "should fail when starting the service" do
+      expect { subject.stop }.to raise_error(Puppet::Error)
+    end
+  end
+
   [[10, "10.6"], [13, "10.9"]].each do |kernel, version|
     describe "when enabling the service on OS X #{version}" do
       it "should write to the global launchd overrides file once" do

data/spec/unit/provider/service/runit_spec.rb

@@ -134,4 +134,28 @@ describe Puppet::Type.type(:service).provider(:runit) do
       expect(@provider.status).to eq(:stopped)
     end
   end
+
+  context '.instances' do
+    before do
+      allow(described_class).to receive(:defpath).and_return(path)
+    end
+
+    context 'when defpath is nil' do
+      let(:path) { nil }
+
+      it 'returns info message' do
+        expect(Puppet).to receive(:info).with(/runit is unsuitable because service directory is nil/)
+        described_class.instances
+      end
+    end
+
+    context 'when defpath does not exist' do
+      let(:path) { '/inexistent_path' }
+
+      it 'returns notice about missing path' do
+        expect(Puppet).to receive(:notice).with(/Service path #{path} does not exist/)
+        described_class.instances
+      end
+    end
+  end
 end

data/spec/unit/provider/service/systemd_spec.rb

@@ -151,9 +151,19 @@ describe Puppet::Type.type(:service).provider(:systemd) do
         autovt@.service
         avahi-daemon.service
         blk-availability.service
+        apparmor.service
+        umountnfs.service
+        urandom.service
+        brandbot.service
       })
     end
-  end
+
+    it "should print a debug message when a service with the state `bad` is found" do
+      expect(described_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services')))
+      expect(Puppet).to receive(:debug).with("apparmor.service marked as bad by `systemctl`. It is recommended to be further checked.")
+      described_class.instances
+    end
+  end 
 
   describe "#start" do
     it "should use the supplied start command if specified" do
@@ -164,15 +174,15 @@ describe Puppet::Type.type(:service).provider(:systemd) do
 
     it "should start the service with systemctl start otherwise" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:systemctl).with(:unmask, 'sshd.service')
-      expect(provider).to receive(:execute).with(['/bin/systemctl','start','sshd.service'], {:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
+      expect(provider).to receive(:systemctl).with(:unmask, '--', 'sshd.service')
+      expect(provider).to receive(:execute).with(['/bin/systemctl','start', '--', 'sshd.service'], {:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
       provider.start
     end
 
     it "should show journald logs on failure" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:systemctl).with(:unmask, 'sshd.service')
-      expect(provider).to receive(:execute).with(['/bin/systemctl','start','sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
+      expect(provider).to receive(:systemctl).with(:unmask, '--', 'sshd.service')
+      expect(provider).to receive(:execute).with(['/bin/systemctl','start', '--', 'sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
         .and_raise(Puppet::ExecutionFailure, "Failed to start sshd.service: Unit sshd.service failed to load: Invalid argument. See system logs and 'systemctl status sshd.service' for details.")
       journalctl_logs = <<-EOS
 -- Logs begin at Tue 2016-06-14 11:59:21 UTC, end at Tue 2016-06-14 21:45:02 UTC. --
@@ -194,13 +204,13 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
 
     it "should stop the service with systemctl stop otherwise" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','stop','sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','stop', '--', 'sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
       provider.stop
     end
 
     it "should show journald logs on failure" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','stop','sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
+      expect(provider).to receive(:execute).with(['/bin/systemctl','stop', '--', 'sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
         .and_raise(Puppet::ExecutionFailure, "Failed to stop sshd.service: Unit sshd.service failed to load: Invalid argument. See system logs and 'systemctl status sshd.service' for details.")
       journalctl_logs = <<-EOS
 -- Logs begin at Tue 2016-06-14 11:59:21 UTC, end at Tue 2016-06-14 21:45:02 UTC. --
@@ -216,52 +226,54 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#enabled?" do
     it "should return :true if the service is enabled" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("enabled\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("enabled\n", 0))
       expect(provider.enabled?).to eq(:true)
     end
 
     it "should return :true if the service is static" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("static\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("static\n", 0))
       expect(provider.enabled?).to eq(:true)
     end
 
     it "should return :false if the service is disabled" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("disabled\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("disabled\n", 1))
       expect(provider.enabled?).to eq(:false)
     end
 
     it "should return :false if the service is indirect" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("indirect\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("indirect\n", 0))
       expect(provider.enabled?).to eq(:false)
     end
 
-    it "should return :false if the service is masked and the resource is attempting to be disabled" do
-      provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => false))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("masked\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
-      expect(provider.enabled?).to eq(:false)
-    end
+    context "when masked" do
+      it "should return :false if the resource is attempting to be disabled" do
+        provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => false))
+        expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                              and_return(Puppet::Util::Execution::ProcessOutput.new("masked\n", 1))
+        expect(provider.enabled?).to eq(:false)
+      end
 
-    it "should return :mask if the service is masked and the resource is attempting to be masked" do
-      provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => 'mask'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled','sshd.service'], :failonfail => false).and_return("masked\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
-      expect(provider.enabled?).to eq(:mask)
+      it "should return :mask if the resource is attempting to be masked" do
+        provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => 'mask'))
+        expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'sshd.service'], :failonfail => false).
+                              and_return(Puppet::Util::Execution::ProcessOutput.new("masked\n", 1))
+        expect(provider.enabled?).to eq(:mask)
+      end
     end
   end
 
   describe "#enable" do
     it "should run systemctl enable to enable a service" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:systemctl).with(:unmask, 'sshd.service')
-      expect(provider).to receive(:systemctl).with(:enable, 'sshd.service')
+      expect(provider).to receive(:systemctl).with(:unmask, '--', 'sshd.service')
+      expect(provider).to receive(:systemctl).with(:enable, '--', 'sshd.service')
       provider.enable
     end
   end
@@ -269,7 +281,7 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#disable" do
     it "should run systemctl disable to disable a service" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:systemctl).with(:disable, 'sshd.service')
+      expect(provider).to receive(:systemctl).with(:disable, '--', 'sshd.service')
       provider.disable
     end
   end
@@ -280,8 +292,8 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
       # :disable is the only call in the provider that uses a symbol instead of
       # a string.
       # This should be made consistent in the future and all tests updated.
-      expect(provider).to receive(:systemctl).with(:disable, 'sshd.service')
-      expect(provider).to receive(:systemctl).with(:mask, 'sshd.service')
+      expect(provider).to receive(:systemctl).with(:disable, '--', 'sshd.service')
+      expect(provider).to receive(:systemctl).with(:mask, '--', 'sshd.service')
       provider.mask
     end
   end
@@ -291,7 +303,7 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#status" do
     it "should return running if if the command returns 0" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-active','sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("active\n")
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-active','--','sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("active\n")
       allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
       expect(provider.status).to eq(:running)
     end
@@ -299,7 +311,7 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     [-10,-1,3,10].each { |ec|
       it "should return stopped if the command returns something non-0" do
         provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-        expect(provider).to receive(:execute).with(['/bin/systemctl','is-active','sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("inactive\n")
+        expect(provider).to receive(:execute).with(['/bin/systemctl','is-active','--','sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("inactive\n")
         allow($CHILD_STATUS).to receive(:exitstatus).and_return(ec)
         expect(provider.status).to eq(:stopped)
       end
@@ -317,20 +329,20 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#restart" do
     it "should use the supplied restart command if specified" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd', :restart => '/bin/foo'))
-      expect(provider).not_to receive(:execute).with(['/bin/systemctl','restart','sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
+      expect(provider).not_to receive(:execute).with(['/bin/systemctl','restart','--','sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
       expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
       provider.restart
     end
 
     it "should restart the service with systemctl restart" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','restart','sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
+      expect(provider).to receive(:execute).with(['/bin/systemctl','restart','--','sshd.service'], :failonfail => true, :override_locale => false, :squelch => false, :combine => true)
       provider.restart
     end
 
     it "should show journald logs on failure" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','restart','sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
+      expect(provider).to receive(:execute).with(['/bin/systemctl','restart', '--', 'sshd.service'],{:failonfail => true, :override_locale => false, :squelch => false, :combine => true})
         .and_raise(Puppet::ExecutionFailure, "Failed to restart sshd.service: Unit sshd.service failed to load: Invalid argument. See system logs and 'systemctl status sshd.service' for details.")
       journalctl_logs = <<-EOS
 -- Logs begin at Tue 2016-06-14 11:59:21 UTC, end at Tue 2016-06-14 21:45:02 UTC. --
@@ -372,6 +384,67 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     end
   end
 
+  describe "#insync_enabled?" do
+    let(:provider) do
+      described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :enable => false))
+    end
+
+    before do
+      allow(provider).to receive(:cached_enabled?).and_return({ output: service_state, exitcode: 0 })
+    end
+
+    context 'when service state is static' do
+      let(:service_state) { 'static' }
+
+      it 'is always enabled_insync even if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is always enabled_insync even if current value is not the same as expected' do
+        expect(provider).to be_enabled_insync(:true)
+      end
+
+      it 'logs a debug messsage' do
+        expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
+        provider.enabled_insync?(:true)
+      end
+    end
+
+    context 'when service state is indirect' do
+      let(:service_state) { 'indirect' }
+
+      it 'is always enabled_insync even if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is always enabled_insync even if current value is not the same as expected' do
+        expect(provider).to be_enabled_insync(:true)
+      end
+
+      it 'logs a debug messsage' do
+        expect(Puppet).to receive(:debug).with("Service sshd.service is in 'indirect' state and cannot be enabled/disabled")
+        provider.enabled_insync?(:true)
+      end
+    end
+
+    context 'when service state is enabled' do
+      let(:service_state) { 'enabled' }
+
+      it 'is enabled_insync if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
+      end
+
+      it 'is not enabled_insync if current value is not the same as expected' do
+        expect(provider).not_to be_enabled_insync(:true)
+      end
+
+      it 'logs no debug messsage' do
+        expect(Puppet).not_to receive(:debug)
+        provider.enabled_insync?(:true)
+      end
+    end
+  end
+
   describe "#get_start_link_count" do
     it "should strip the '.service' from the search if present in the resource name" do
       provider = described_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))