puppet 5.5.22 → 6.0.0

data/lib/puppet/provider/service/systemd.rb

@@ -1,7 +1,5 @@
 # Manage systemd services using systemctl
 
-require 'puppet/file_system'
-
 Puppet::Type.type(:service).provide :systemd, :parent => :base do
   desc "Manages `systemd` services using `systemctl`.
 
@@ -11,7 +9,14 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   commands :systemctl => "systemctl"
 
-  confine :true => Puppet::FileSystem.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd')
+  if Facter.value(:osfamily).downcase == 'debian'
+    # With multiple init systems on Debian, it is possible to have
+    # pieces of systemd around (e.g. systemctl) but not really be
+    # using systemd.  We do not do this on other platforms as it can
+    # cause issues when running in a chroot without /run mounted
+    # (PUP-5577)
+    confine :exists => "/run/systemd/system"
+  end
 
   defaultfor :osfamily => [:archlinux]
   defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8"]
@@ -19,15 +24,16 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   defaultfor :osfamily => :suse
   defaultfor :osfamily => :coreos
   defaultfor :operatingsystem => :amazon, :operatingsystemmajrelease => ["2"]
-  defaultfor :operatingsystem => :debian, :operatingsystemmajrelease => ["8", "stretch/sid", "9", "buster/sid", "10", "bullseye/sid"]
-  defaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["15.04","15.10","16.04","16.10","17.04","17.10","18.04","18.10","19.04","19.10","20.04"]
+  defaultfor :operatingsystem => :debian, :operatingsystemmajrelease => ["8", "stretch/sid", "9", "buster/sid"]
+
+  defaultfor :operatingsystem => :ubuntu
+  notdefaultfor :operatingsystem => :ubuntu, :operatingsystemmajrelease => ["10.04", "12.04", "14.04", "14.10"] # These are using upstart
   defaultfor :operatingsystem => :cumuluslinux, :operatingsystemmajrelease => ["3"]
 
   def self.instances
     i = []
     output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
-    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect|bad|static)\s*$/i).each do |m|
-      Puppet.debug("#{m[0]} marked as bad by `systemctl`. It is recommended to be further checked.") if m[1] == "bad"
+    output.scan(/^(\S+)\s+(disabled|enabled|masked|indirect)\s*$/i).each do |m|
       i << new(:name => m[0])
     end
     return i
@@ -35,29 +41,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     return []
   end
 
-  # Static services cannot be enabled or disabled manually. Indirect services 
-  # should not be enabled or disabled due to limitations in systemd (see 
-  # https://github.com/systemd/systemd/issues/6681).
-  def enabled_insync?(current)
-    case cached_enabled?[:output]
-    when 'static'
-      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
-      return true
-    when 'indirect'
-      Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
-      return true
-    else
-      current == @resource[:enable]
-    end
-  end
-
   # This helper ensures that the enable state cache is always reset
   # after a systemctl enable operation. A particular service state is not guaranteed
   # after such an operation, so the cache must be emptied to prevent inconsistencies
   # in the provider's believed state of the service and the actual state.
   # @param action [String,Symbol] One of 'enable', 'disable', 'mask' or 'unmask'
   def systemctl_change_enable(action)
-    output = systemctl(action, '--', @resource[:name])
+    output = systemctl(action, @resource[:name])
   rescue
     raise Puppet::Error, "Could not #{action} #{self.name}: #{output}", $!.backtrace
   ensure
@@ -70,7 +60,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   def get_start_link_count
     # Start links don't include '.service'. Just search for the service name.
-    if @resource[:name] =~ /\.service/
+    if @resource[:name].match(/\.service/)
       link_name = @resource[:name].split('.')[0]
     else
       link_name = @resource[:name]
@@ -81,14 +71,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
 
   def cached_enabled?
     return @cached_enabled if @cached_enabled
-    cmd = [command(:systemctl), 'is-enabled', '--', @resource[:name]]
-    result = execute(cmd, :failonfail => false)
-    @cached_enabled = { output: result.chomp, exitcode: result.exitstatus }
+    cmd = [command(:systemctl), 'is-enabled', @resource[:name]]
+    @cached_enabled = execute(cmd, :failonfail => false).strip
   end
 
   def enabled?
-    output = cached_enabled?[:output]
-    code = cached_enabled?[:exitcode]
+    output = cached_enabled?
+    code = $CHILD_STATUS.exitstatus
 
     # The masked state is equivalent to the disabled state in terms of
     # comparison so we only care to check if it is masked if we want to keep
@@ -101,7 +90,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
     # The indirect state indicates that the unit is not enabled.
     return :false if output == 'indirect'
     return :true if (code == 0)
-    if (output.empty?) && (code > 0) && (Facter.value(:osfamily).casecmp('debian').zero?)
+    if (output.empty?) && (code > 0) && (Facter.value(:osfamily).downcase == 'debian')
       ret = debian_enabled?
       return ret if ret
     end
@@ -149,20 +138,20 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   end
 
   def restartcmd
-    [command(:systemctl), "restart", '--', @resource[:name]]
+    [command(:systemctl), "restart", @resource[:name]]
   end
 
   def startcmd
     self.unmask
-    [command(:systemctl), "start", '--', @resource[:name]]
+    [command(:systemctl), "start", @resource[:name]]
   end
 
   def stopcmd
-    [command(:systemctl), "stop", '--', @resource[:name]]
+    [command(:systemctl), "stop", @resource[:name]]
   end
 
   def statuscmd
-    [command(:systemctl), "is-active", '--', @resource[:name]]
+    [command(:systemctl), "is-active", @resource[:name]]
   end
 
   def restart

data/lib/puppet/provider/service/upstart.rb

@@ -27,9 +27,7 @@ Puppet::Type.type(:service).provide :upstart, :parent => :debian do
   # We only want to use upstart as our provider if the upstart daemon is running.
   # This can be checked by running `initctl version --quiet` on a machine that has
   # upstart installed.
-  confine :true => lambda { has_initctl? }
-
-  def self.has_initctl?
+  confine :true => begin
     initctl('version', '--quiet')
     true
   rescue

data/lib/puppet/provider/service/windows.rb

@@ -34,15 +34,7 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     raise Puppet::Error.new(_("Cannot enable %{resource_name} for manual start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
   end
 
-  def delayed_start
-    Puppet::Util::Windows::Service.set_startup_mode( @resource[:name], :SERVICE_AUTO_START, true )
-  rescue => detail
-    raise Puppet::Error.new(_("Cannot enable %{resource_name} for delayed start, error was: %{detail}") % { resource_name: @resource[:name], detail: detail }, detail )
-  end
-  
   def enabled?
-    return :false unless Puppet::Util::Windows::Service.exists?(@resource[:name])
-
     start_type = Puppet::Util::Windows::Service.service_start_type(@resource[:name])
     debug("Service #{@resource[:name]} start type is #{start_type}")
     case start_type
@@ -52,8 +44,6 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
         :true
       when :SERVICE_DEMAND_START
         :manual
-      when :SERVICE_DELAYED_AUTO_START
-        :delayed
       when :SERVICE_DISABLED
         :false
       else
@@ -64,13 +54,6 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   end
 
   def start
-    if status == :paused
-      Puppet::Util::Windows::Service.resume(@resource[:name])
-      return
-    end
-
-    # status == :stopped here
-
     if enabled? == :false
       # If disabled and not managing enable, respect disabled and fail.
       if @resource[:enable].nil?
@@ -91,16 +74,13 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
   end
 
   def status
-    return :stopped unless Puppet::Util::Windows::Service.exists?(@resource[:name])
-
     current_state = Puppet::Util::Windows::Service.service_state(@resource[:name])
     state = case current_state
       when :SERVICE_STOPPED,
-           :SERVICE_STOP_PENDING
-        :stopped
-      when :SERVICE_PAUSED,
+           :SERVICE_PAUSED,
+           :SERVICE_STOP_PENDING,
            :SERVICE_PAUSE_PENDING
-        :paused
+        :stopped
       when :SERVICE_RUNNING,
            :SERVICE_CONTINUE_PENDING,
            :SERVICE_START_PENDING

data/lib/puppet/provider/user/aix.rb

@@ -10,7 +10,6 @@
 # See https://puppet.com/docs/puppet/latest/provider_development.html
 # for more information
 require 'puppet/provider/aix_object'
-require 'puppet/util/posix'
 require 'tempfile'
 require 'date'
 
@@ -77,23 +76,13 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     # a String, etc. in the property. This routine does a final check to
     # ensure our value doesn't have whitespace before we convert it to
     # an attribute.
-    def groups_property_to_attribute(groups)
+    def groups_to_groups(groups)
       if groups =~ /\s/
         raise ArgumentError, _("Invalid value %{groups}: Groups must be comma separated!") % { groups: groups }
       end
 
       groups
     end
-
-    # We do not directly use the groups attribute value because that will
-    # always include the primary group, even if our user is not one of its
-    # members. Instead, we retrieve our property value by parsing the etc/group file,
-    # which matches what we do on our other POSIX platforms like Linux and Solaris.
-    #
-    # See https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/group_security.htm
-    def groups_attribute_to_property(provider, _groups)
-      Puppet::Util::POSIX.groups_of(provider.resource[:name]).join(',')
-    end
   end
 
   mapping puppet_property: :comment,
@@ -110,8 +99,7 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
           attribute_to_property: method(:pgrp_to_gid)
 
   mapping puppet_property: :groups, 
-          property_to_attribute: method(:groups_property_to_attribute),
-          attribute_to_property: method(:groups_attribute_to_property)
+          property_to_attribute: method(:groups_to_groups)
 
   mapping puppet_property: :home
   mapping puppet_property: :shell
@@ -133,24 +121,6 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # properties + a getter for the attributes property).
   mk_resource_methods
 
-  # Setting the primary group (pgrp attribute) on AIX causes both the
-  # current and new primary groups to be included in our user's groups,
-  # which is undesirable behavior. Thus, this custom setter resets the
-  # 'groups' property back to its previous value after setting the primary
-  # group.
-  def gid=(value)
-    old_pgrp = gid
-    cur_groups = groups
-
-    set(:gid, value)
-
-    begin
-      self.groups = cur_groups
-    rescue Puppet::Error => detail
-      raise Puppet::Error, _("Could not reset the groups property back to %{cur_groups} after setting the primary group on %{resource}[%{name}]. This means that the previous primary group of %{old_pgrp} and the new primary group of %{new_pgrp} have been added to %{cur_groups}. You will need to manually reset the groups property if this is undesirable behavior. Detail: %{detail}") % { cur_groups: cur_groups, resource: @resource.class.name, name: @resource.name, old_pgrp: old_pgrp, new_pgrp: value, detail: detail }, detail.backtrace
-    end
-  end
-
   # Helper function that parses the password from the given
   # password filehandle. This is here to make testing easier
   # for #password since we cannot configure Mocha to mock out
@@ -243,22 +213,6 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   def create
     super
 
-    # We specify the 'groups' AIX attribute in AixObject's create method
-    # when creating our user. However, this does not always guarantee that
-    # our 'groups' property is set to the right value. For example, the
-    # primary group will always be included in the 'groups' property. This is
-    # bad if we're explicitly managing the 'groups' property under inclusive
-    # membership, and we are not specifying the primary group in the 'groups'
-    # property value.
-    #
-    # Setting the groups property here a second time will ensure that our user is
-    # created and in the right state. Note that this is an idempotent operation,
-    # so if AixObject's create method already set it to the right value, then this
-    # will noop.
-    if (groups = @resource.should(:groups))
-      self.groups = groups
-    end
-
     if (password = @resource.should(:password))
       self.password = password
     end

data/lib/puppet/provider/user/directoryservice.rb

@@ -302,7 +302,7 @@ Puppet::Type.type(:user).provide :directoryservice do
             merge_attribute_with_dscl('Groups', group, 'GroupMembers', @guid)
           end
         else
-          create_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
+          merge_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
         end
       end
     end
@@ -386,7 +386,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 3
+      sleep 2
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -403,7 +403,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 3
+      sleep 2
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -429,14 +429,11 @@ Puppet::Type.type(:user).provide :directoryservice do
   # the case we rescue the error from dscl and alert the user.
   #
   # In the event that the user doesn't HAVE a value for the attribute, the
-  # provider should use the -create option with dscl to add the attribute value
+  # provider should use the -merge option with dscl to add the attribute value
   # for the user record
   ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
-        if self.class.get_os_version.split('.').last.to_i >= 14 && %w(home uid).include?(setter_method)
-          raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
-        end
         begin
           dscl '.', '-change', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], @property_hash[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
@@ -445,7 +442,7 @@ Puppet::Type.type(:user).provide :directoryservice do
         end
       else
         begin
-          dscl '.', '-create', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
+          dscl '.', '-merge', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
           raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " +
                "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
@@ -475,19 +472,10 @@ Puppet::Type.type(:user).provide :directoryservice do
     '/var/db/shadow/hash'
   end
 
-  # This method will create a given value using dscl
-  def create_attribute_with_dscl(path, username, keyname, value)
-    set_attribute_with_dscl('-create', path, username, keyname, value)
-  end
-
   # This method will merge in a given value using dscl
   def merge_attribute_with_dscl(path, username, keyname, value)
-    set_attribute_with_dscl('-merge', path, username, keyname, value)
-  end
-
-  def set_attribute_with_dscl(dscl_command, path, username, keyname, value)
     begin
-      dscl '.', dscl_command, "/#{path}/#{username}", keyname, value
+      dscl '.', '-merge', "/#{path}/#{username}", keyname, value
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not set the dscl #{keyname} key with value: #{value} - #{detail.inspect}", detail.backtrace
     end
@@ -503,7 +491,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def next_system_id(min_id=20)
     dscl_output = dscl '.', '-list', '/Users', 'uid'
     # We're ok with throwing away negative uids here. Also, remove nil values.
-    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l =~ /^\d+$/ }
+    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l.match(/^\d+$/) }
     ids = user_ids.compact!.sort! { |a,b| a.to_f <=> b.to_f }
     # We're just looking for an unused id in our sorted array.
     ids.each_index do |i|
@@ -571,32 +559,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') < 0
-      write_users_plist_to_disk(users_plist)
-    else
-      write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
-    end
-  end
-
-  # This method writes the ShadowHashData plist in a temporary file,
-  # then imports it using dsimport. macOS versions 10.15 and newer do
-  # not support directly managing binary plists, so we have to use an
-  # intermediary.
-  # dsimport is an archaic utilitary with hard-to-find documentation
-  #
-  # See http://web.archive.org/web/20090106120111/http://support.apple.com/kb/TA21305?viewlocale=en_US
-  # for information regarding the dsimport syntax
-  def write_and_import_shadow_hash_data(data_plist)
-    Tempfile.create("dsimport_#{@resource.name}", :encoding => Encoding::ASCII) do |dsimport_file|
-      dsimport_file.write <<-DSIMPORT
-0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData
-#{@resource.name}:#{Base64.strict_encode64(data_plist)}
-      DSIMPORT
-      dsimport_file.flush
-      # Delete the user's existing ShadowHashData, since dsimport appends, not replaces
-      dscl('.', 'delete', "/Users/#{@resource.name}", 'ShadowHashData')
-      dsimport(dsimport_file.path, '/Local/Default', 'M')
-    end
+    write_users_plist_to_disk(users_plist)
   end
 
   # This method accepts an argument of a hex password hash, and base64

data/lib/puppet/provider/user/hpux.rb

@@ -29,7 +29,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
 
   def modifycmd(param,value)
      cmd = super(param, value)
-     cmd.insert(1,"-F")
+     cmd << "-F"
      if trusted then
        # Append an additional command to reset the password age to 0
        # until a workaround with expiry module can be found for trusted

data/lib/puppet/provider/user/pw.rb

@@ -66,11 +66,11 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
 
   # use pw to update password hash
   def password=(cryptopw)
-    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash [redacted]"
+    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
     stdin, _, _ = Open3.popen3("pw user mod #{@resource[:name]} -H 0")
     stdin.puts(cryptopw)
     stdin.close
-    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash [redacted]"
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
   end
 
   # get password from /etc/master.passwd
@@ -78,19 +78,10 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
     Puppet.debug "checking password for user '#{@resource[:name]}' method called"
     current_passline = `getent passwd #{@resource[:name]}`
     current_password = current_passline.chomp.split(':')[1] if current_passline
-    Puppet.debug "finished password for user '#{@resource[:name]}' method called : [redacted]"
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called : '#{current_password}'"
     current_password
   end
 
-  def has_sensitive_data?(property = nil)
-    #Check for sensitive values?
-    properties = property ? [property] : Puppet::Type.type(:user).validproperties
-    properties.any? do |prop|
-      p = @resource.parameter(prop)
-      p && p.respond_to?(:is_sensitive) && p.is_sensitive
-    end
-  end
-
   # Get expiry from system and convert to Puppet-style date
   def expiry
     expiry = self.get(:expiry)