puppet 7.31.0-universal-darwin → 8.0.1-universal-darwin

data/spec/unit/util/rubygems_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+require 'puppet/util/rubygems'
+
+describe Puppet::Util::RubyGems::Source do
+  let(:gem_path) { File.expand_path('/foo/gems') }
+  let(:gem_lib) { File.join(gem_path, 'lib') }
+  let(:fake_gem) { double(:full_gem_path => gem_path) }
+
+  describe "::new" do
+    it "returns NoGemsSource if rubygems is not present" do
+      expect(described_class).to receive(:has_rubygems?).and_return(false)
+      expect(described_class.new).to be_kind_of(Puppet::Util::RubyGems::NoGemsSource)
+    end
+
+    it "returns Gems18Source if Gem::Specification responds to latest_specs" do
+      expect(described_class).to receive(:has_rubygems?).and_return(true)
+      expect(described_class.new).to be_kind_of(Puppet::Util::RubyGems::Gems18Source)
+    end
+  end
+
+  describe '::NoGemsSource' do
+    before(:each) { allow(described_class).to receive(:source).and_return(Puppet::Util::RubyGems::NoGemsSource) }
+
+    it "#directories returns an empty list" do
+      expect(described_class.new.directories).to eq([])
+    end
+
+    it "#clear_paths returns nil" do
+      expect(described_class.new.clear_paths).to be_nil
+    end
+  end
+
+  describe '::Gems18Source' do
+    before(:each) { allow(described_class).to receive(:source).and_return(Puppet::Util::RubyGems::Gems18Source) }
+
+    it "#directories returns the lib subdirs of Gem::Specification.stubs" do
+      expect(Gem::Specification).to receive(:stubs).and_return([fake_gem])
+
+      expect(described_class.new.directories).to eq([gem_lib])
+    end
+
+    it "#clear_paths calls Gem.clear_paths" do
+      expect(Gem).to receive(:clear_paths)
+      described_class.new.clear_paths
+    end
+  end
+end

data/spec/unit/util/run_mode_spec.rb

@@ -0,0 +1,185 @@
+require 'spec_helper'
+
+describe Puppet::Util::RunMode do
+  before do
+    @run_mode = Puppet::Util::RunMode.new('fake')
+  end
+
+  describe Puppet::Util::UnixRunMode, :unless => Puppet::Util::Platform.windows? do
+    before do
+      @run_mode = Puppet::Util::UnixRunMode.new('fake')
+    end
+
+    describe "#conf_dir" do
+      it "has confdir /etc/puppetlabs/puppet when run as root" do
+        as_root { expect(@run_mode.conf_dir).to eq(File.expand_path('/etc/puppetlabs/puppet')) }
+      end
+
+      it "has confdir ~/.puppetlabs/etc/puppet when run as non-root" do
+        as_non_root { expect(@run_mode.conf_dir).to eq(File.expand_path('~/.puppetlabs/etc/puppet')) }
+      end
+
+      context "server run mode" do
+        before do
+          @run_mode = Puppet::Util::UnixRunMode.new('server')
+        end
+
+        it "has confdir ~/.puppetlabs/etc/puppet when run as non-root and server run mode" do
+          as_non_root { expect(@run_mode.conf_dir).to eq(File.expand_path('~/.puppetlabs/etc/puppet')) }
+        end
+      end
+    end
+
+    describe "#code_dir" do
+      it "has codedir /etc/puppetlabs/code when run as root" do
+        as_root { expect(@run_mode.code_dir).to eq(File.expand_path('/etc/puppetlabs/code')) }
+      end
+
+      it "has codedir ~/.puppetlabs/etc/code when run as non-root" do
+        as_non_root { expect(@run_mode.code_dir).to eq(File.expand_path('~/.puppetlabs/etc/code')) }
+      end
+
+      context "server run mode" do
+        before do
+          @run_mode = Puppet::Util::UnixRunMode.new('server')
+        end
+
+        it "has codedir ~/.puppetlabs/etc/code when run as non-root and server run mode" do
+          as_non_root { expect(@run_mode.code_dir).to eq(File.expand_path('~/.puppetlabs/etc/code')) }
+        end
+      end
+    end
+
+    describe "#var_dir" do
+      it "has vardir /opt/puppetlabs/puppet/cache when run as root" do
+        as_root { expect(@run_mode.var_dir).to eq(File.expand_path('/opt/puppetlabs/puppet/cache')) }
+      end
+
+      it "has vardir ~/.puppetlabs/opt/puppet/cache when run as non-root" do
+        as_non_root { expect(@run_mode.var_dir).to eq(File.expand_path('~/.puppetlabs/opt/puppet/cache')) }
+      end
+    end
+
+    describe "#public_dir" do
+      it "has publicdir /opt/puppetlabs/puppet/public when run as root" do
+        as_root { expect(@run_mode.public_dir).to eq(File.expand_path('/opt/puppetlabs/puppet/public')) }
+      end
+
+      it "has publicdir ~/.puppetlabs/opt/puppet/public when run as non-root" do
+        as_non_root { expect(@run_mode.public_dir).to eq(File.expand_path('~/.puppetlabs/opt/puppet/public')) }
+      end
+    end
+
+    describe "#log_dir" do
+      describe "when run as root" do
+        it "has logdir /var/log/puppetlabs/puppet" do
+          as_root { expect(@run_mode.log_dir).to eq(File.expand_path('/var/log/puppetlabs/puppet')) }
+        end
+      end
+
+      describe "when run as non-root" do
+        it "has default logdir ~/.puppetlabs/var/log" do
+          as_non_root { expect(@run_mode.log_dir).to eq(File.expand_path('~/.puppetlabs/var/log')) }
+        end
+      end
+    end
+
+    describe "#run_dir" do
+      describe "when run as root" do
+        it "has rundir /var/run/puppetlabs" do
+          as_root { expect(@run_mode.run_dir).to eq(File.expand_path('/var/run/puppetlabs')) }
+        end
+      end
+
+      describe "when run as non-root" do
+        it "has default rundir ~/.puppetlabs/var/run" do
+          as_non_root { expect(@run_mode.run_dir).to eq(File.expand_path('~/.puppetlabs/var/run')) }
+        end
+      end
+    end
+  end
+
+  describe Puppet::Util::WindowsRunMode, :if => Puppet::Util::Platform.windows? do
+    before do
+      @run_mode = Puppet::Util::WindowsRunMode.new('fake')
+    end
+
+    describe "#conf_dir" do
+      it "has confdir ending in Puppetlabs/puppet/etc when run as root" do
+        as_root { expect(@run_mode.conf_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "etc"))) }
+      end
+
+      it "has confdir in ~/.puppetlabs/etc/puppet when run as non-root" do
+        as_non_root { expect(@run_mode.conf_dir).to eq(File.expand_path("~/.puppetlabs/etc/puppet")) }
+      end
+    end
+
+    describe "#code_dir" do
+      it "has codedir ending in PuppetLabs/code when run as root" do
+        as_root { expect(@run_mode.code_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "code"))) }
+      end
+
+      it "has codedir in ~/.puppetlabs/etc/code when run as non-root" do
+        as_non_root { expect(@run_mode.code_dir).to eq(File.expand_path("~/.puppetlabs/etc/code")) }
+      end
+    end
+
+    describe "#var_dir" do
+      it "has vardir ending in PuppetLabs/puppet/cache when run as root" do
+        as_root { expect(@run_mode.var_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "cache"))) }
+      end
+
+      it "has vardir in ~/.puppetlabs/opt/puppet/cache when run as non-root" do
+        as_non_root { expect(@run_mode.var_dir).to eq(File.expand_path("~/.puppetlabs/opt/puppet/cache")) }
+      end
+    end
+
+    describe "#public_dir" do
+      it "has publicdir ending in PuppetLabs/puppet/public when run as root" do
+        as_root { expect(@run_mode.public_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "public"))) }
+      end
+
+      it "has publicdir in ~/.puppetlabs/opt/puppet/public when run as non-root" do
+        as_non_root { expect(@run_mode.public_dir).to eq(File.expand_path("~/.puppetlabs/opt/puppet/public")) }
+      end
+    end
+
+    describe "#log_dir" do
+      describe "when run as root" do
+        it "has logdir ending in PuppetLabs/puppet/var/log" do
+          as_root { expect(@run_mode.log_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "var", "log"))) }
+        end
+      end
+
+      describe "when run as non-root" do
+        it "has default logdir ~/.puppetlabs/var/log" do
+          as_non_root { expect(@run_mode.log_dir).to eq(File.expand_path('~/.puppetlabs/var/log')) }
+        end
+      end
+    end
+
+    describe "#run_dir" do
+      describe "when run as root" do
+        it "has rundir ending in PuppetLabs/puppet/var/run" do
+          as_root { expect(@run_mode.run_dir).to eq(File.expand_path(File.join(ENV['ALLUSERSPROFILE'], "PuppetLabs", "puppet", "var", "run"))) }
+        end
+      end
+
+      describe "when run as non-root" do
+        it "has default rundir ~/.puppetlabs/var/run" do
+          as_non_root { expect(@run_mode.run_dir).to eq(File.expand_path('~/.puppetlabs/var/run')) }
+        end
+      end
+    end
+  end
+
+  def as_root
+    allow(Puppet.features).to receive(:root?).and_return(true)
+    yield
+  end
+
+  def as_non_root
+    allow(Puppet.features).to receive(:root?).and_return(false)
+    yield
+  end
+end

data/spec/unit/util/selinux_spec.rb

@@ -0,0 +1,422 @@
+require 'spec_helper'
+
+require 'pathname'
+require 'puppet/util/selinux'
+
+describe Puppet::Util::SELinux do
+  include Puppet::Util::SELinux
+
+  let(:selinux) { double('selinux', is_selinux_enabled: false) }
+
+  before :each do
+    stub_const('Selinux', selinux)
+  end
+
+  describe "selinux_support?" do
+    it "should return true if this system has SELinux enabled" do
+      expect(Selinux).to receive(:is_selinux_enabled).and_return(1)
+      expect(selinux_support?).to eq(true)
+    end
+
+    it "should return false if this system has SELinux disabled" do
+      expect(Selinux).to receive(:is_selinux_enabled).and_return(0)
+      expect(selinux_support?).to eq(false)
+    end
+
+    it "should return false if this system lacks SELinux" do
+      hide_const('Selinux')
+      expect(selinux_support?).to eq(false)
+    end
+
+    it "should return nil if /proc/mounts does not exist" do
+      allow(File).to receive(:open).with("/proc/mounts").and_raise("No such file or directory - /proc/mounts")
+      expect(read_mounts).to eq(nil)
+    end
+  end
+
+  describe "read_mounts" do
+    before :each do
+      fh = double('fh', :close => nil)
+      allow(File).to receive(:open).and_call_original()
+      allow(File).to receive(:open).with("/proc/mounts").and_return(fh)
+      times_fh_called = 0
+      expect(fh).to receive(:read_nonblock) do
+        times_fh_called += 1
+        raise EOFError if times_fh_called > 1
+
+        "rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n/sys /sys sysfs rw,relatime 0 0\n192.168.1.1:/var/export /mnt/nfs nfs rw,relatime,vers=3,rsize=32768,wsize=32768,namlen=255,hard,nointr,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,mountvers=3,mountproto=udp,addr=192.168.1.1 0 0\n"
+      end.twice()
+    end
+
+    it "should parse the contents of /proc/mounts" do
+      result = read_mounts
+      expect(result).to  eq({
+        '/' => 'ext3',
+        '/sys' => 'sysfs',
+        '/mnt/nfs' => 'nfs',
+        '/proc' => 'proc',
+        '/dev' => 'tmpfs' })
+    end
+  end
+
+  describe "filesystem detection" do
+    before :each do
+      allow(self).to receive(:read_mounts).and_return({
+        '/'        => 'ext3',
+        '/sys'     => 'sysfs',
+        '/mnt/nfs' => 'nfs',
+        '/mnt/zfs' => 'zfs',
+        '/proc'    => 'proc',
+        '/dev'     => 'tmpfs' })
+    end
+
+    it "should match a path on / to ext3" do
+      expect(find_fs('/etc/puppetlabs/puppet/testfile')).to eq("ext3")
+    end
+
+    it "should match a path on /mnt/nfs to nfs" do
+      expect(find_fs('/mnt/nfs/testfile/foobar')).to eq("nfs")
+    end
+
+    it "should return true for a capable filesystem" do
+      expect(selinux_label_support?('/etc/puppetlabs/puppet/testfile')).to be_truthy
+    end
+
+    it "should return true if tmpfs" do
+      expect(selinux_label_support?('/dev/shm/testfile')).to be_truthy
+    end
+
+    it "should return true if zfs" do
+      expect(selinux_label_support?('/mnt/zfs/testfile')).to be_truthy
+    end
+
+    it "should return false for a noncapable filesystem" do
+      expect(selinux_label_support?('/mnt/nfs/testfile')).to be_falsey
+    end
+
+    it "(#8714) don't follow symlinks when determining file systems", :unless => Puppet::Util::Platform.windows? do
+      scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
+
+      allow(self).to receive(:read_mounts).and_return({
+        '/'             => 'ext3',
+        scratch + 'nfs' => 'nfs',
+      })
+
+      (scratch + 'foo').make_symlink('nfs/bar')
+      expect(selinux_label_support?(scratch + 'foo')).to be_truthy
+    end
+
+    it "should handle files that don't exist" do
+      scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
+      expect(selinux_label_support?(scratch + 'nonesuch')).to be_truthy
+    end
+  end
+
+  describe "get_selinux_current_context" do
+    it "should return nil if no SELinux support" do
+      expect(self).to receive(:selinux_support?).and_return(false)
+      expect(get_selinux_current_context("/foo")).to be_nil
+    end
+
+    it "should return a context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return([0, "user_u:role_r:type_t:s0"])
+        expect(get_selinux_current_context("/foo")).to eq("user_u:role_r:type_t:s0")
+      end
+    end
+
+    it "should return nil if lgetfilecon fails" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return(-1)
+        expect(get_selinux_current_context("/foo")).to be_nil
+      end
+    end
+  end
+
+  describe "get_selinux_default_context" do
+    it "should return nil if no SELinux support" do
+      expect(self).to receive(:selinux_support?).and_return(false)
+      expect(get_selinux_default_context("/foo")).to be_nil
+    end
+
+    it "should return a context if a default context exists" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        fstat = double('File::Stat', :mode => 0)
+        expect(Puppet::FileSystem).to receive(:lstat).with('/foo').and_return(fstat)
+        expect(self).to receive(:find_fs).with("/foo").and_return("ext3")
+        expect(Selinux).to receive(:matchpathcon).with("/foo", 0).and_return([0, "user_u:role_r:type_t:s0"])
+
+        expect(get_selinux_default_context("/foo")).to eq("user_u:role_r:type_t:s0")
+      end
+    end
+
+    it "handles permission denied errors by issuing a warning" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 0).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::EACCES, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj")).to be_nil
+      end
+    end
+
+    it "backward compatibly handles no such file or directory errors by issuing a warning when resource_ensure not set" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 0).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::ENOENT, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj")).to be_nil
+      end
+    end
+
+    it "should determine mode based on resource ensure when set to file" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 32768).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::ENOENT, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj", :present)).to be_nil
+        expect(get_selinux_default_context("/root/chuj", :file)).to be_nil
+      end
+    end
+
+    it "should determine mode based on resource ensure when set to dir" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 16384).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::ENOENT, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj", :directory)).to be_nil
+      end
+    end
+
+    it "should determine mode based on resource ensure when set to link" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 40960).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::ENOENT, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj", :link)).to be_nil
+      end
+    end
+
+    it "should determine mode based on resource ensure when set to unknown" do
+      without_partial_double_verification do
+        allow(self).to receive(:selinux_support?).and_return(true)
+        allow(self).to receive(:selinux_label_support?).and_return(true)
+        allow(Selinux).to receive(:matchpathcon).with("/root/chuj", 0).and_return(-1)
+        allow(self).to receive(:file_lstat).with("/root/chuj").and_raise(Errno::ENOENT, "/root/chuj")
+
+        expect(get_selinux_default_context("/root/chuj", "unknown")).to be_nil
+      end
+    end
+
+    it "should return nil if matchpathcon returns failure" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        fstat = double('File::Stat', :mode => 0)
+        expect(Puppet::FileSystem).to receive(:lstat).with('/foo').and_return(fstat)
+        expect(self).to receive(:find_fs).with("/foo").and_return("ext3")
+        expect(Selinux).to receive(:matchpathcon).with("/foo", 0).and_return(-1)
+
+        expect(get_selinux_default_context("/foo")).to be_nil
+      end
+    end
+
+    it "should return nil if selinux_label_support returns false" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(self).to receive(:find_fs).with("/foo").and_return("nfs")
+        expect(get_selinux_default_context("/foo")).to be_nil
+      end
+    end
+  end
+
+  describe "parse_selinux_context" do
+    it "should return nil if no context is passed" do
+      expect(parse_selinux_context(:seluser, nil)).to be_nil
+    end
+
+    it "should return nil if the context is 'unlabeled'" do
+      expect(parse_selinux_context(:seluser, "unlabeled")).to be_nil
+    end
+
+    it "should return the user type when called with :seluser" do
+      expect(parse_selinux_context(:seluser, "user_u:role_r:type_t:s0")).to eq("user_u")
+      expect(parse_selinux_context(:seluser, "user-withdash_u:role_r:type_t:s0")).to eq("user-withdash_u")
+    end
+
+    it "should return the role type when called with :selrole" do
+      expect(parse_selinux_context(:selrole, "user_u:role_r:type_t:s0")).to eq("role_r")
+      expect(parse_selinux_context(:selrole, "user_u:role-withdash_r:type_t:s0")).to eq("role-withdash_r")
+    end
+
+    it "should return the type type when called with :seltype" do
+      expect(parse_selinux_context(:seltype, "user_u:role_r:type_t:s0")).to eq("type_t")
+      expect(parse_selinux_context(:seltype, "user_u:role_r:type-withdash_t:s0")).to eq("type-withdash_t")
+    end
+
+    describe "with spaces in the components" do
+      it "should raise when user contains a space" do
+        expect{parse_selinux_context(:seluser, "user with space_u:role_r:type_t:s0")}.to raise_error Puppet::Error
+      end
+
+      it "should raise when role contains a space" do
+        expect{parse_selinux_context(:selrole, "user_u:role with space_r:type_t:s0")}.to raise_error Puppet::Error
+      end
+
+      it "should raise when type contains a space" do
+        expect{parse_selinux_context(:seltype, "user_u:role_r:type with space_t:s0")}.to raise_error Puppet::Error
+      end
+
+      it "should return the range when range contains a space" do
+        expect(parse_selinux_context(:selrange, "user_u:role_r:type_t:s0 s1")).to eq("s0 s1")
+      end
+    end
+
+    it "should return nil for :selrange when no range is returned" do
+      expect(parse_selinux_context(:selrange, "user_u:role_r:type_t")).to be_nil
+    end
+
+    it "should return the range type when called with :selrange" do
+      expect(parse_selinux_context(:selrange, "user_u:role_r:type_t:s0")).to eq("s0")
+      expect(parse_selinux_context(:selrange, "user_u:role_r:type-withdash_t:s0")).to eq("s0")
+    end
+
+    describe "with a variety of SELinux range formats" do
+      ['s0', 's0:c3', 's0:c3.c123', 's0:c3,c5,c8', 'TopSecret', 'TopSecret,Classified', 'Patient_Record'].each do |range|
+        it "should parse range '#{range}'" do
+          expect(parse_selinux_context(:selrange, "user_u:role_r:type_t:#{range}")).to eq(range)
+        end
+      end
+    end
+  end
+
+  describe "set_selinux_context" do
+    before :each do
+      fh = double('fh', :close => nil)
+      allow(File).to receive(:open).with("/proc/mounts").and_return(fh)
+      times_fh_called = 0
+      allow(fh).to receive(:read_nonblock) do
+        times_fh_called += 1
+        raise EOFError if times_fh_called > 1
+
+        "rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n"+
+        "/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n"+
+        "/sys /sys sysfs rw,relatime 0 0\n"
+      end
+    end
+
+    it "should return nil if there is no SELinux support" do
+      expect(self).to receive(:selinux_support?).and_return(false)
+      expect(set_selinux_context("/foo", "user_u:role_r:type_t:s0")).to be_nil
+    end
+
+    it "should return nil if selinux_label_support returns false" do
+      expect(self).to receive(:selinux_support?).and_return(true)
+      expect(self).to receive(:selinux_label_support?).with("/foo").and_return(false)
+      expect(set_selinux_context("/foo", "user_u:role_r:type_t:s0")).to be_nil
+    end
+
+    it "should use lsetfilecon to set a context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").and_return(0)
+        expect(set_selinux_context("/foo", "user_u:role_r:type_t:s0")).to be_truthy
+      end
+    end
+
+    it "should use lsetfilecon to set user_u user context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return([0, "foo:role_r:type_t:s0"])
+        expect(Selinux).to receive(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").and_return(0)
+        expect(set_selinux_context("/foo", "user_u", :seluser)).to be_truthy
+      end
+    end
+
+    it "should use lsetfilecon to set role_r role context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return([0, "user_u:foo:type_t:s0"])
+        expect(Selinux).to receive(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").and_return(0)
+        expect(set_selinux_context("/foo", "role_r", :selrole)).to be_truthy
+      end
+    end
+
+    it "should use lsetfilecon to set type_t type context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return([0, "user_u:role_r:foo:s0"])
+        expect(Selinux).to receive(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").and_return(0)
+        expect(set_selinux_context("/foo", "type_t", :seltype)).to be_truthy
+      end
+    end
+
+    it "should use lsetfilecon to set s0:c3,c5 range context" do
+      without_partial_double_verification do
+        expect(self).to receive(:selinux_support?).and_return(true)
+        expect(Selinux).to receive(:lgetfilecon).with("/foo").and_return([0, "user_u:role_r:type_t:s0"])
+        expect(Selinux).to receive(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0:c3,c5").and_return(0)
+        expect(set_selinux_context("/foo", "s0:c3,c5", :selrange)).to be_truthy
+      end
+    end
+  end
+
+  describe "set_selinux_default_context" do
+    it "should return nil if there is no SELinux support" do
+      expect(self).to receive(:selinux_support?).and_return(false)
+      expect(set_selinux_default_context("/foo")).to be_nil
+    end
+
+    it "should return nil if no default context exists" do
+      expect(self).to receive(:get_selinux_default_context).with("/foo", nil).and_return(nil)
+      expect(set_selinux_default_context("/foo")).to be_nil
+    end
+
+    it "should do nothing and return nil if the current context matches the default context" do
+      expect(self).to receive(:get_selinux_default_context).with("/foo", nil).and_return("user_u:role_r:type_t")
+      expect(self).to receive(:get_selinux_current_context).with("/foo").and_return("user_u:role_r:type_t")
+      expect(set_selinux_default_context("/foo")).to be_nil
+    end
+
+    it "should set and return the default context if current and default do not match" do
+      expect(self).to receive(:get_selinux_default_context).with("/foo", nil).and_return("user_u:role_r:type_t")
+      expect(self).to receive(:get_selinux_current_context).with("/foo").and_return("olduser_u:role_r:type_t")
+      expect(self).to receive(:set_selinux_context).with("/foo", "user_u:role_r:type_t").and_return(true)
+      expect(set_selinux_default_context("/foo")).to eq("user_u:role_r:type_t")
+    end
+  end
+
+  describe "get_create_mode" do
+    it "should return 0 if the resource is absent" do
+      expect(get_create_mode(:absent)).to eq(0)
+    end
+
+    it "should return mode with file type set to S_IFREG when resource is file" do
+      expect(get_create_mode(:present)).to eq(32768)
+      expect(get_create_mode(:file)).to eq(32768)
+    end
+
+    it "should return mode with file type set to S_IFDIR when resource is dir" do
+      expect(get_create_mode(:directory)).to eq(16384)
+    end
+
+    it "should return mode with file type set to S_IFLNK when resource is link" do
+      expect(get_create_mode(:link)).to eq(40960)
+    end
+
+    it "should return 0 for everything else" do
+      expect(get_create_mode("unknown")).to eq(0)
+    end
+  end
+end

data/spec/unit/util/skip_tags_spec.rb

@@ -0,0 +1,14 @@
+# coding: utf-8
+require 'spec_helper'
+
+require 'puppet/util/skip_tags'
+
+describe Puppet::Util::SkipTags do
+  let(:tagger) { Puppet::Util::SkipTags.new([]) }
+
+  it "should add qualified classes as single tags" do
+    tagger.tag("one::two::three")
+    expect(tagger.tags).to include("one::two::three")
+    expect(tagger.tags).not_to include("one", "two", "three")
+  end
+end