puppet 6.0.0 → 6.0.1

data/lib/puppet/provider/exec.rb

@@ -4,71 +4,71 @@ require 'puppet/util/execution'
 class Puppet::Provider::Exec < Puppet::Provider
   include Puppet::Util::Execution
 
-  def run(command, check = false)
-    output = nil
-    sensitive = resource.parameters[:command].sensitive
+  def environment
+    env = {}
 
-    checkexe(command)
+    if (path = resource[:path])
+      env[:PATH] = path.join(File::PATH_SEPARATOR)
+    end
 
-    if dir = resource[:cwd]
-      unless File.directory?(dir)
-        if check
-          dir = nil
-        else
-          self.fail _("Working directory '%{dir}' does not exist") % { dir: dir }
-        end
+    return env unless (envlist = resource[:environment])
+
+    envlist = [envlist] unless envlist.is_a? Array
+    envlist.each do |setting|
+      unless (match = /^(\w+)=((.|\n)+)$/.match(setting))
+        warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
+        next
+      end
+      var = match[1]
+      value = match[2]
+
+      if env.include?(var) || env.include?(var.to_sym)
+        warning _("Overriding environment setting '%{var}' with '%{value}'") % { var: var, value: value }
       end
+
+      env[var] = value
     end
 
-    dir ||= Dir.pwd
+    env
+  end
+
+  def run(command, check = false)
+    output = nil
+    sensitive = resource.parameters[:command].sensitive
+
+    checkexe(command)
 
     debug "Executing#{check ? " check": ""} '#{sensitive ? '[redacted]' : command}'"
-    begin
-      # Do our chdir
-      Dir.chdir(dir) do
-        environment = {}
-
-        environment[:PATH] = resource[:path].join(File::PATH_SEPARATOR) if resource[:path]
-
-        if envlist = resource[:environment]
-          envlist = [envlist] unless envlist.is_a? Array
-          envlist.each do |setting|
-            if setting =~ /^(\w+)=((.|\n)+)$/
-              env_name = $1
-              value = $2
-              if environment.include?(env_name) || environment.include?(env_name.to_sym)
-                warning _("Overriding environment setting '%{env_name}' with '%{value}'") % { env_name: env_name, value: value }
-              end
-              environment[env_name] = value
-            else
-              warning _("Cannot understand environment setting %{setting}") % { setting: setting.inspect }
-            end
-          end
-        end
-
-        # Ruby 2.1 and later interrupt execution in a way that bypasses error
-        # handling by default. Passing Timeout::Error causes an exception to be
-        # raised that can be rescued inside of the block by cleanup routines.
-        #
-        # This is backwards compatible all the way to Ruby 1.8.7.
-        Timeout::timeout(resource[:timeout], Timeout::Error) do
-          # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
-          # default/system locale will be respected.  Callers may override this behavior by setting locale-related
-          # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
-          output = Puppet::Util::Execution.execute(command, :failonfail => false, :combine => true,
-                                  :uid => resource[:user], :gid => resource[:group],
-                                  :override_locale => false,
-                                  :custom_environment => environment,
-                                  :sensitive => sensitive)
-        end
-        # The shell returns 127 if the command is missing.
-        if output.exitstatus == 127
-          raise ArgumentError, output
-        end
 
-      end
-    rescue Errno::ENOENT => detail
-      self.fail Puppet::Error, detail.to_s, detail
+    # Ruby 2.1 and later interrupt execution in a way that bypasses error
+    # handling by default. Passing Timeout::Error causes an exception to be
+    # raised that can be rescued inside of the block by cleanup routines.
+    #
+    # This is backwards compatible all the way to Ruby 1.8.7.
+    Timeout::timeout(resource[:timeout], Timeout::Error) do
+      # If we're running a command that's meant to be a check on whether we should run
+      # our actual command (e.g. like a command passed to the :onlyif or :unless properties),
+      # then we should not set the cwd when executing the check's corresponding command.
+      cwd = check ? nil : resource[:cwd]
+      cwd ||= Dir.pwd
+
+      # note that we are passing "false" for the "override_locale" parameter, which ensures that the user's
+      # default/system locale will be respected.  Callers may override this behavior by setting locale-related
+      # environment variables (LANG, LC_ALL, etc.) in their 'environment' configuration.
+      output = Puppet::Util::Execution.execute(
+        command,
+        :failonfail => false,
+        :combine => true,
+        :cwd => cwd,
+        :uid => resource[:user], :gid => resource[:group],
+        :override_locale => false,
+        :custom_environment => environment(),
+        :sensitive => sensitive
+      )
+    end
+    # The shell returns 127 if the command is missing.
+    if output.exitstatus == 127
+      raise ArgumentError, output
     end
 
     # Return output twice as processstatus was returned before, but only exitstatus was ever called.

data/lib/puppet/provider/group/aix.rb

@@ -53,24 +53,10 @@ Puppet::Type.type(:group).provide :aix, :parent => Puppet::Provider::AixObject d
 
       group_hash
     end
-
-    # Define some Puppet Property => AIX Attribute (and vice versa)
-    # conversion functions here. This is so we can unit test them.
-
-    def members_to_users(members)
-      return members unless members.is_a?(Array)
-      members.join(',')
-    end
-
-    def users_to_members(users)
-      users.split(',')
-    end
   end
 
   mapping puppet_property: :members,
-          aix_attribute: :users,
-          property_to_attribute: method(:members_to_users),
-          attribute_to_property: method(:users_to_members)
+          aix_attribute: :users
 
   numeric_mapping puppet_property: :gid,
                   aix_attribute: :id

data/lib/puppet/provider/group/pw.rb

@@ -9,7 +9,10 @@ Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService:
   defaultfor :operatingsystem => [:freebsd, :dragonfly]
   confine    :operatingsystem => [:freebsd, :dragonfly]
 
-  options :members, :flag => "-M", :method => :mem
+  options :members,
+          :flag    => "-M",
+          :method  => :mem,
+          :unmunge => proc { |members| members.join(',') }
 
   verify :gid, _("GID must be an integer") do |value|
     value.is_a? Integer
@@ -26,9 +29,6 @@ Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService:
 
     if members = @resource.should(:members)
       unless members == :absent
-        if members.is_a?(Array)
-          members = members.join(",")
-        end
         cmd << "-M" << members
       end
     end
@@ -39,10 +39,6 @@ Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService:
   end
 
   def modifycmd(param, value)
-    # members may be an array, need a comma separated list
-    if param == :members and value.is_a?(Array)
-      value = value.join(",")
-    end
     super(param, value)
   end
 end

data/lib/puppet/provider/group/windows_adsi.rb

@@ -22,10 +22,12 @@ Puppet::Type.type(:group).provide :windows_adsi do
 
     # Cannot use munge of the group property to canonicalize @should
     # since the default array_matching comparison is not commutative
-
-    current_sids = current.map(&:sid)
     # dupes automatically weeded out when hashes built
-    specified_sids = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should).keys.to_a
+    current_members = Puppet::Util::Windows::ADSI::User.name_sid_hash(current)
+    specified_members = Puppet::Util::Windows::ADSI::User.name_sid_hash(should)
+
+    current_sids = current_members.keys.to_a
+    specified_sids = specified_members.keys.to_a
 
     if @resource[:auth_membership]
       current_sids.sort == specified_sids.sort
@@ -63,7 +65,8 @@ Puppet::Type.type(:group).provide :windows_adsi do
   end
 
   def members
-    group.members
+    @members ||= Puppet::Util::Windows::ADSI::User.name_sid_hash(group.members)
+    @members.keys
   end
 
   def members=(members)

data/lib/puppet/provider/nameservice.rb

@@ -247,31 +247,7 @@ class Puppet::Provider::NameService < Puppet::Provider
   # The list of all groups the user is a member of.  Different
   # user mgmt systems will need to override this method.
   def groups
-    groups = []
-
-    # Reset our group list
-    Puppet::Etc.setgrent
-
-    user = @resource[:name]
-
-    # Now iterate across all of the groups, adding each one our
-    # user is a member of
-    while group = Puppet::Etc.getgrent
-      members = group.mem
-
-      groups << group.name if members.include? user
-    end
-
-    # We have to close the file, so each listing is a separate
-    # reading of the file.
-    Puppet::Etc.endgrent
-
-    uniq_groups = groups.uniq
-    if groups != uniq_groups
-      debug("Removing any duplicate group entries")
-    end
-    # remove any double listed groups
-    uniq_groups.join(",")
+    Puppet::Util::POSIX.groups_of(@resource[:name]).join(',')
   end
 
   # Convert the Etc struct into a hash.

data/lib/puppet/provider/nameservice/directoryservice.rb

@@ -116,7 +116,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
       ds_value = input_hash[key]
       case ds_to_ns_attribute_map[ds_attribute]
         when :members
-          ds_value = ds_value # only members uses arrays so far
+          ds_value = ds_value.join(',')
         when :gid, :uid
           # OS X stores objects like uid/gid as strings.
           # Try casting to an integer for these cases to be
@@ -344,8 +344,10 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
 
   def set(param, value)
     self.class.validate(param, value)
-    current_members = @property_value_cache_hash[:members]
     if param == :members
+      current_members = @property_value_cache_hash[:members].split(',')
+      value = value.split(',')
+
       # If we are meant to be authoritative for the group membership
       # then remove all existing members who haven't been specified
       # in the manifest.
@@ -409,7 +411,7 @@ class Puppet::Provider::NameService::DirectoryService < Puppet::Provider::NameSe
       end
       if value != "" and not value.nil?
         if property == :members
-          add_members(nil, value)
+          add_members(nil, value.split(','))
         else
           exec_arg_vector = self.class.get_exec_preamble("-create", @resource[:name])
           exec_arg_vector << ns_to_ds_attribute_map[property.intern]

data/lib/puppet/provider/package/portage.rb

@@ -117,7 +117,7 @@ Puppet::Type.type(:package).provide :portage, :parent => Puppet::Provider::Packa
       if match
         result_fields.zip(match.captures) do |field, value|
           # some fields can be empty or (null) (if we are not passed a category in the package name for instance)
-          if value == '(null)'
+          if value == '(null)' || value == '<unset>'
             package_info[field] = nil
           elsif !value or value.empty?
             package_info[field] = nil
@@ -133,7 +133,7 @@ Puppet::Type.type(:package).provide :portage, :parent => Puppet::Provider::Packa
   end
 
   def qatom_output_format
-    '"[%{CATEGORY}] [%{PN}] [%{PV}] [%[PR]] [%[SLOT]] [%[pfx]] [%[sfx]]"'
+    '"[%[CATEGORY]] [%[PN]] [%[PV]] [%[PR]] [%[SLOT]] [%[pfx]] [%[sfx]]"'
   end
 
   def qatom_result_format

data/lib/puppet/provider/service/launchd.rb

@@ -196,6 +196,22 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
     Puppet::Util::Plist.read_plist_file(path)
   end
 
+  # Read overrides plist, retrying if necessary
+  def self.read_overrides
+    i = 1
+    overrides = nil
+    loop do
+      Puppet.debug(_("Reading overrides plist, attempt %{i}") % {i: i}) if i > 1
+      overrides = read_plist(launchd_overrides)
+      break unless overrides.nil?
+      raise Puppet::Error.new(_('Unable to read overrides plist, too many attempts')) if i == 20
+      Puppet.info(_('Overrides file could not be read, trying again.'))
+      Kernel.sleep(0.1)
+      i += 1
+    end
+    overrides
+  end
+
   # Clean out the @property_hash variable containing the cached list of services
   def flush
     @property_hash.clear
@@ -300,7 +316,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
     _, job_plist = plist_from_label(resource[:name])
     job_plist_disabled = job_plist["Disabled"] if job_plist.has_key?("Disabled")
 
-    if FileTest.file?(self.class.launchd_overrides) and overrides = self.class.read_plist(self.class.launchd_overrides)
+    if FileTest.file?(self.class.launchd_overrides) and overrides = self.class.read_overrides
       if overrides.has_key?(resource[:name])
         if self.class.get_os_version < 14
           overrides_disabled = overrides[resource[:name]]["Disabled"] if overrides[resource[:name]].has_key?("Disabled")
@@ -324,7 +340,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   # rather than dealing with launchctl as it is unable to change the Disabled flag
   # without actually loading/unloading the job.
   def enable
-    overrides = self.class.read_plist(self.class.launchd_overrides)
+    overrides = self.class.read_overrides
     if self.class.get_os_version < 14
       overrides[resource[:name]] = { "Disabled" => false }
     else
@@ -334,7 +350,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   end
 
   def disable
-    overrides = self.class.read_plist(self.class.launchd_overrides)
+    overrides = self.class.read_overrides
     if self.class.get_os_version < 14
       overrides[resource[:name]] = { "Disabled" => true }
     else

data/lib/puppet/provider/user/aix.rb

@@ -10,6 +10,7 @@
 # See https://puppet.com/docs/puppet/latest/provider_development.html
 # for more information
 require 'puppet/provider/aix_object'
+require 'puppet/util/posix'
 require 'tempfile'
 require 'date'
 
@@ -76,13 +77,23 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
     # a String, etc. in the property. This routine does a final check to
     # ensure our value doesn't have whitespace before we convert it to
     # an attribute.
-    def groups_to_groups(groups)
+    def groups_property_to_attribute(groups)
       if groups =~ /\s/
         raise ArgumentError, _("Invalid value %{groups}: Groups must be comma separated!") % { groups: groups }
       end
 
       groups
     end
+
+    # We do not directly use the groups attribute value because that will
+    # always include the primary group, even if our user is not one of its
+    # members. Instead, we retrieve our property value by parsing the etc/group file,
+    # which matches what we do on our other POSIX platforms like Linux and Solaris.
+    #
+    # See https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/group_security.htm
+    def groups_attribute_to_property(provider, _groups)
+      Puppet::Util::POSIX.groups_of(provider.resource[:name]).join(',')
+    end
   end
 
   mapping puppet_property: :comment,
@@ -99,7 +110,8 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
           attribute_to_property: method(:pgrp_to_gid)
 
   mapping puppet_property: :groups, 
-          property_to_attribute: method(:groups_to_groups)
+          property_to_attribute: method(:groups_property_to_attribute),
+          attribute_to_property: method(:groups_attribute_to_property)
 
   mapping puppet_property: :home
   mapping puppet_property: :shell
@@ -121,6 +133,24 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   # properties + a getter for the attributes property).
   mk_resource_methods
 
+  # Setting the primary group (pgrp attribute) on AIX causes both the
+  # current and new primary groups to be included in our user's groups,
+  # which is undesirable behavior. Thus, this custom setter resets the
+  # 'groups' property back to its previous value after setting the primary
+  # group.
+  def gid=(value)
+    old_pgrp = gid
+    cur_groups = groups
+
+    set(:gid, value)
+
+    begin
+      self.groups = cur_groups
+    rescue Puppet::Error => detail
+      raise Puppet::Error, _("Could not reset the groups property back to %{cur_groups} after setting the primary group on %{resource}[%{name}]. This means that the previous primary group of %{old_pgrp} and the new primary group of %{new_pgrp} have been added to %{cur_groups}. You will need to manually reset the groups property if this is undesirable behavior. Detail: %{detail}") % { cur_groups: cur_groups, resource: @resource.class.name, name: @resource.name, old_pgrp: old_pgrp, new_pgrp: value, detail: detail }, detail.backtrace
+    end
+  end
+
   # Helper function that parses the password from the given
   # password filehandle. This is here to make testing easier
   # for #password since we cannot configure Mocha to mock out
@@ -213,6 +243,22 @@ Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
   def create
     super
 
+    # We specify the 'groups' AIX attribute in AixObject's create method
+    # when creating our user. However, this does not always guarantee that
+    # our 'groups' property is set to the right value. For example, the
+    # primary group will always be included in the 'groups' property. This is
+    # bad if we're explicitly managing the 'groups' property under inclusive
+    # membership, and we are not specifying the primary group in the 'groups'
+    # property value.
+    #
+    # Setting the groups property here a second time will ensure that our user is
+    # created and in the right state. Note that this is an idempotent operation,
+    # so if AixObject's create method already set it to the right value, then this
+    # will noop.
+    if (groups = @resource.should(:groups))
+      self.groups = groups
+    end
+
     if (password = @resource.should(:password))
       self.password = password
     end

data/lib/puppet/type/group.rb

@@ -1,6 +1,7 @@
 require 'etc'
 require 'facter'
 require 'puppet/property/keyvalue'
+require 'puppet/property/list'
 require 'puppet/parameter/boolean'
 
 module Puppet
@@ -81,41 +82,84 @@ module Puppet
       end
     end
 
-    newproperty(:members, :array_matching => :all, :required_features => :manages_members) do
+    newproperty(:members, :parent => Puppet::Property::List, :required_features => :manages_members) do
       desc "The members of the group. For platforms or directory services where group
         membership is stored in the group objects, not the users. This parameter's
         behavior can be configured with `auth_membership`."
 
-      def change_to_s(currentvalue, newvalue)
-        currentvalue = currentvalue.join(",") if currentvalue != :absent
-        newvalue = newvalue.join(",")
-        super(currentvalue, newvalue)
+      validate do |value|
+        unless value.is_a?(String)
+          raise ArgumentError, _("The members property must be specified as either an array of strings, or as a single string consisting of a comma-separated list of members")
+        end
+
+        if value.is_a?(Integer) || value =~ /^\d+$/
+          raise ArgumentError, _("User names must be provided, not UID numbers.")
+        end
+
+        if value.empty?
+          raise ArgumentError, _("User names must not be empty. If you want to specify \"no users\" pass an empty array")
+        end
+
+        if provider.respond_to?(:member_valid?)
+          return provider.member_valid?(value)
+        end
       end
 
-      def insync?(current)
-        if provider.respond_to?(:members_insync?)
-          return provider.members_insync?(current, @should)
+      def inclusive?
+        @resource[:auth_membership]
+      end
+
+      def change_to_s(currentvalue, newvalue)
+        newvalue = newvalue.split(",") if newvalue != :absent
+
+        if provider.respond_to?(:members_to_s)
+          # for Windows ADSI
+          # de-dupe the "newvalue" when the sync event message is generated,
+          # due to final retrieve called after the resource has been modified
+          newvalue = provider.members_to_s(newvalue).split(',').uniq
         end
 
-        super(current)
+        super(currentvalue, newvalue)
       end
 
-      def is_to_s(currentvalue)
+      # override Puppet::Property::List#retrieve
+      def retrieve
         if provider.respond_to?(:members_to_s)
-          currentvalue = '' if currentvalue.nil?
-          currentvalue = currentvalue.is_a?(Array) ? currentvalue : currentvalue.split(',')
+          # Windows ADSI members returns SIDs, but retrieve needs names
+          # must return qualified names for SIDs for "is" value and puppet resource
+          return provider.members_to_s(provider.members).split(',')
+        end
+
+        super
+      end
 
-          return provider.members_to_s(currentvalue)
+      # The members property should also accept a comma separated
+      # list of members (a String parameter) for backwards
+      # compatibility. Unfortunately, the List property would treat
+      # our comma separated list of members as a single-element Array.
+      # This override of should= ensures that a comma separated list of
+      # members is munged to an array of members, which is what we want.
+      # Note that we cannot use `munge` because that will pass in each
+      # array element instead of the entire array if the members property
+      # is specified as an array of members, which would cause each member
+      # to be munged into an array for that case. This is undesirable
+      # behavior.
+      def should=(values)
+        super(values)
+
+        if @should.length == 1 && @should.first.include?(delimiter)
+          @should = @should.first.split(delimiter)
         end
 
-        super(currentvalue)
+        @should
       end
-      alias :should_to_s :is_to_s
 
-      validate do |value|
-        if provider.respond_to?(:member_valid?)
-          return provider.member_valid?(value)
+      def insync?(current)
+        if provider.respond_to?(:members_insync?)
+          return provider.members_insync?(current, @should)
         end
+
+        super(current)
       end
     end