puppet 7.6.1-universal-darwin → 7.10.0-universal-darwin

data/lib/puppet/provider/service/freebsd.rb

@@ -74,7 +74,7 @@ Puppet::Type.type(:service).provide :freebsd, :parent => :init do
       if Puppet::FileSystem.exist?(filename)
         s = File.read(filename)
         if s.gsub!(/^(#{rcvar}(_enable)?)=\"?(YES|NO)\"?/, "\\1=\"#{yesno}\"")
-          File.open(filename, File::WRONLY) { |f| f << s }
+          Puppet::FileSystem.replace_file(filename) { |f| f << s  }
           self.debug("Replaced in #{filename}")
           success = true
         end

data/lib/puppet/provider/service/init.rb

@@ -170,7 +170,7 @@ Puppet::Type.type(:service).provide :init, :parent => :base do
     (@resource[:hasrestart] == :true) && [initscript, :restart]
   end
 
-  def texecute(type, command, fof = true, squelch = false, combine = true)
+  def service_execute(type, command, fof = true, squelch = false, combine = true)
     if type == :start && Facter.value(:osfamily) == "Solaris"
         command =  ["/usr/bin/ctrun -l child", command].flatten.join(" ")
     end

data/lib/puppet/provider/service/launchd.rb

@@ -1,4 +1,4 @@
-require 'puppet/util/plist'
+require_relative '../../../puppet/util/plist'
 Puppet::Type.type(:service).provide :launchd, :parent => :base do
   desc <<-'EOT'
     This provider manages jobs with `launchd`, which is the default service
@@ -138,7 +138,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
         Puppet.debug("Reading launchd plist #{filepath}")
         job = read_plist(filepath)
         next if job.nil?
-        if job.has_key?("Label")
+        if job.respond_to?(:key) && job.key?("Label")
           @label_to_path_map[job["Label"]] = filepath
         else
           #TRANSLATORS 'plist' and label' should not be translated
@@ -262,7 +262,10 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   # conditionally enable at load, then disable by modifying the plist file
   # directly.
   def start
-    return ucommand(:start) if resource[:start]
+    if resource[:start]
+      service_command(:start)
+      return nil
+    end
     job_path, _ = plist_from_label(resource[:name])
     did_enable_job = false
     cmds = []
@@ -285,7 +288,10 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
 
 
   def stop
-    return ucommand(:stop) if resource[:stop]
+    if resource[:stop]
+      service_command(:stop)
+      return nil
+    end
     job_path, _ = plist_from_label(resource[:name])
     did_disable_job = false
     cmds = []

data/lib/puppet/provider/service/service.rb

@@ -8,7 +8,8 @@ Puppet::Type.type(:service).provide :service do
   # How to restart the process.
   def restart
     if @resource[:restart] or restartcmd
-      ucommand(:restart)
+      service_command(:restart)
+      nil
     else
       self.stop
       self.start
@@ -19,7 +20,7 @@ Puppet::Type.type(:service).provide :service do
   def restartcmd
   end
 
-  # A simple wrapper so execution failures are a bit more informative.
+  # @deprecated because the exit status is not returned, use service_execute instead
   def texecute(type, command, fof = true, squelch = false, combine = true)
     begin
       execute(command, :failonfail => fof, :override_locale => false, :squelch => squelch, :combine => combine)
@@ -29,7 +30,7 @@ Puppet::Type.type(:service).provide :service do
     nil
   end
 
-  # Use either a specified command or the default for our provider.
+  # @deprecated because the exitstatus is not returned, use service_command instead
   def ucommand(type, fof = true)
     c = @resource[type]
     if c
@@ -39,5 +40,29 @@ Puppet::Type.type(:service).provide :service do
     end
     texecute(type, cmd, fof)
   end
+
+  # Execute a command, failing the resource if the command fails.
+  #
+  # @return [Puppet::Util::Execution::ProcessOutput]
+  def service_execute(type, command, fof = true, squelch = false, combine = true)
+    begin
+      execute(command, :failonfail => fof, :override_locale => false, :squelch => squelch, :combine => combine)
+    rescue Puppet::ExecutionFailure => detail
+      @resource.fail Puppet::Error, "Could not #{type} #{@resource.ref}: #{detail}", detail
+    end
+  end
+
+  # Use either a specified command or the default for our provider.
+  #
+  # @return [Puppet::Util::Execution::ProcessOutput]
+  def service_command(type, fof = true)
+    c = @resource[type]
+    if c
+      cmd = [c]
+    else
+      cmd = [send("#{type}cmd")].flatten
+    end
+    service_execute(type, cmd, fof)
+  end
 end
 

data/lib/puppet/provider/service/smf.rb

@@ -77,30 +77,6 @@ Puppet::Type.type(:service).provide :smf, :parent => :base do
     raise Puppet::Error.new( "Cannot config #{@resource[:name]} to enable it: #{detail}", detail )
   end
 
-  # Returns the service's FMRI. We fail if multiple FMRIs correspond to
-  # @resource[:name].
-  #
-  # If the service does not exist or we fail to get any FMRIs from svcs,
-  # this method will raise a Puppet::ExecutionFailure
-  def service_fmri
-    return @fmri if @fmri
-
-    # `svcs -l` is better to use because we can detect service instances
-    # that have not yet been activated or enabled (i.e. it lets us detect
-    # services that svcadm has not yet touched). `svcs -H -o fmri` is a bit
-    # more limited.
-    lines = svcs("-l", @resource[:name]).chomp.lines.to_a
-    lines.select! { |line| line =~ /^fmri/ }
-    fmris = lines.map! { |line| line.split(' ')[-1].chomp }
-    unless fmris.length == 1
-      raise Puppet::Error.new(
-        "Failed to get #{@resource[:name]}'s FMRI: The pattern '#{@resource[:name]}' matches multiple FMRIs! These are the FMRIs it matches: #{fmris.join(', ')}"
-      )
-    end
-
-    @fmri = fmris.first
-  end
-
   # Returns the service's FMRI. We fail if multiple FMRIs correspond to
   # @resource[:name].
   #

data/lib/puppet/provider/service/src.rb

@@ -53,8 +53,8 @@ Puppet::Type.type(:service).provide :src, :parent => :base do
   end
 
   def enabled?
-    execute([command(:lsitab), @resource[:name]], {:failonfail => false, :combine => true})
-    $CHILD_STATUS.exitstatus == 0 ? :true : :false
+    output = execute([command(:lsitab), @resource[:name]], {:failonfail => false, :combine => true})
+    output.exitstatus == 0 ? :true : :false
   end
 
   def enable

data/lib/puppet/provider/service/systemd.rb

@@ -1,6 +1,6 @@
 # Manage systemd services using systemctl
 
-require 'puppet/file_system'
+require_relative '../../../puppet/file_system'
 
 Puppet::Type.type(:service).provide :systemd, :parent => :base do
   desc "Manages `systemd` services using `systemctl`.
@@ -14,7 +14,7 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   confine :true => Puppet::FileSystem.exist?('/proc/1/comm') && Puppet::FileSystem.read('/proc/1/comm').include?('systemd')
 
   defaultfor :osfamily => [:archlinux]
-  defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8"]
+  defaultfor :osfamily => :redhat, :operatingsystemmajrelease => ["7", "8", "9"]
   defaultfor :osfamily => :redhat, :operatingsystem => :fedora
   defaultfor :osfamily => :suse
   defaultfor :osfamily => :coreos
@@ -45,8 +45,13 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   def enabled_insync?(current)
     case cached_enabled?[:output]
     when 'static'
-      Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
-      return true
+      # masking static services is OK, but enabling/disabling them is not
+      if @resource[:enable] == :mask
+        current == @resource[:enable]
+      else
+        Puppet.debug("Unable to enable or disable static service #{@resource[:name]}")
+        return true
+      end
     when 'indirect'
       Puppet.debug("Service #{@resource[:name]} is in 'indirect' state and cannot be enabled/disabled")
       return true
@@ -119,10 +124,10 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   # whether it is enabled or not. See PUP-5016 for more details.
   #
   def debian_enabled?
-    system("/usr/sbin/invoke-rc.d", "--quiet", "--query", @resource[:name], "start")
-    if [104, 106].include?($CHILD_STATUS.exitstatus)
+    status = execute(["/usr/sbin/invoke-rc.d", "--quiet", "--query", @resource[:name], "start"], :failonfail => false)
+    if [104, 106].include?(status.exitstatus)
       return :true
-    elsif [101, 105].include?($CHILD_STATUS.exitstatus)
+    elsif [101, 105].include?(status.exitstatus)
       # 101 is action not allowed, which means we have to do the check manually.
       # 105 is unknown, which generally means the initscript does not support query
       # The debian policy states that the initscript should support methods of query
@@ -159,10 +164,15 @@ Puppet::Type.type(:service).provide :systemd, :parent => :base do
   end
 
   def mask
-    self.disable
+    disable if exist?
     systemctl_change_enable(:mask)
   end
 
+  def exist?
+    result = execute([command(:systemctl), 'cat', '--', @resource[:name]], :failonfail => false)
+    result.exitstatus == 0
+  end
+
   def unmask
     systemctl_change_enable(:unmask)
   end

data/lib/puppet/provider/service/windows.rb

@@ -128,17 +128,55 @@ Puppet::Type.type(:service).provide :windows, :parent => :service do
     services
   end
 
+  def logonaccount_insync?(current)
+    @normalized_logon_account ||= normalize_logonaccount
+    @resource[:logonaccount] = @normalized_logon_account
+
+    insync = @resource[:logonaccount] == current
+    self.logonpassword = @resource[:logonpassword] if insync
+    insync
+  end
+
   def logonaccount
     return unless Puppet::Util::Windows::Service.exists?(@resource[:name])
     Puppet::Util::Windows::Service.logon_account(@resource[:name])
   end
 
   def logonaccount=(value)
+    validate_logon_credentials
     Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_account: value, logon_password: @resource[:logonpassword]})
     restart if @resource[:ensure] == :running && [:running, :paused].include?(status)
   end
 
   def logonpassword=(value)
+    validate_logon_credentials
     Puppet::Util::Windows::Service.set_startup_configuration(@resource[:name], options: {logon_password: value})
   end
+
+  private
+
+  def normalize_logonaccount
+    logon_account = @resource[:logonaccount].sub(/^\.\\/, "#{Puppet::Util::Windows::ADSI.computer_name}\\")
+    return 'LocalSystem' if Puppet::Util::Windows::User::localsystem?(logon_account)
+
+    @logonaccount_information ||= Puppet::Util::Windows::SID.name_to_principal(logon_account)
+    return logon_account unless @logonaccount_information
+    return ".\\#{@logonaccount_information.account}" if @logonaccount_information.domain == Puppet::Util::Windows::ADSI.computer_name
+    @logonaccount_information.domain_account
+  end
+
+  def validate_logon_credentials
+    unless Puppet::Util::Windows::User::localsystem?(@normalized_logon_account)
+      raise Puppet::Error.new("\"#{@normalized_logon_account}\" is not a valid account") unless @logonaccount_information && [:SidTypeUser, :SidTypeWellKnownGroup].include?(@logonaccount_information.account_type)
+
+      user_rights = Puppet::Util::Windows::User::get_rights(@logonaccount_information.domain_account) unless Puppet::Util::Windows::User::default_system_account?(@normalized_logon_account)
+      raise Puppet::Error.new("\"#{@normalized_logon_account}\" has the 'Log On As A Service' right set to denied.") if user_rights =~ /SeDenyServiceLogonRight/
+      raise Puppet::Error.new("\"#{@normalized_logon_account}\" is missing the 'Log On As A Service' right.") unless user_rights.nil? || user_rights =~ /SeServiceLogonRight/
+    end
+
+    is_a_predefined_local_account = Puppet::Util::Windows::User::default_system_account?(@normalized_logon_account) || @normalized_logon_account == 'LocalSystem'
+    account_info = @normalized_logon_account.split("\\")
+    able_to_logon = Puppet::Util::Windows::User.password_is?(account_info[1], @resource[:logonpassword], account_info[0]) unless is_a_predefined_local_account
+    raise Puppet::Error.new("The given password is invalid for user '#{@normalized_logon_account}'.") unless is_a_predefined_local_account || able_to_logon
+  end
 end

data/lib/puppet/provider/user/aix.rb

@@ -9,8 +9,8 @@
 #
 # See https://puppet.com/docs/puppet/latest/provider_development.html
 # for more information
-require 'puppet/provider/aix_object'
-require 'puppet/util/posix'
+require_relative '../../../puppet/provider/aix_object'
+require_relative '../../../puppet/util/posix'
 require 'tempfile'
 require 'date'
 

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,5 +1,5 @@
-require 'puppet'
-require 'puppet/util/plist' if Puppet.features.cfpropertylist?
+require_relative '../../../puppet'
+require_relative '../../../puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
@@ -435,7 +435,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
-        if self.class.get_os_version.split('.').last.to_i >= 14 && %w(home uid).include?(setter_method)
+        if %w(home uid).include?(setter_method)
           raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
         end
         begin
@@ -536,6 +536,14 @@ Puppet::Type.type(:user).provide :directoryservice do
       if (shadow_hash_data.class == Hash) && (shadow_hash_data.has_key?('SALTED-SHA512'))
         shadow_hash_data.delete('SALTED-SHA512')
       end
+
+      # Starting with macOS 11 Big Sur, the AuthenticationAuthority field
+      # could be missing entirely and without it the managed user cannot log in
+      if needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+        Puppet.debug("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user '#{@resource.name}'")
+        merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ERB::Util.html_escape(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY))
+      end
+
       set_salted_pbkdf2(users_plist, shadow_hash_data, 'entropy', value)
     end
   end
@@ -562,6 +570,17 @@ Puppet::Type.type(:user).provide :directoryservice do
     end
   end
 
+  # This method will check if authentication_authority key of a user's plist
+  # needs SALTED_SHA512_PBKDF2 to be added. This is a valid case for macOS 11 (Big Sur)
+  # where users created with `dscl` started to have this field missing
+  def needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+    authority = users_plist['authentication_authority']
+    return false if Puppet::Util::Package.versioncmp(self.class.get_os_version, '11.0.0') < 0 && authority && authority.include?(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY)
+
+    Puppet.debug("User '#{@resource.name}' is missing the 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash")
+    true
+  end
+
   # This method will embed the binary plist data comprising the user's
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
@@ -572,11 +591,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') < 0
-      write_users_plist_to_disk(users_plist)
-    else
-      write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
-    end
+    write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
   end
 
   # This method writes the ShadowHashData plist in a temporary file,
@@ -652,9 +667,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
-  # This method will accept a plist in XML format, save it to disk, convert
-  # the plist to a binary format, and flush the dscl cache.
-  def write_users_plist_to_disk(users_plist)
-    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
-  end
+  private
+
+  SHA512_PBKDF2_AUTHENTICATION_AUTHORITY = ';ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>'
 end

data/lib/puppet/provider/user/ldap.rb

@@ -1,4 +1,4 @@
-require 'puppet/provider/ldap'
+require_relative '../../../puppet/provider/ldap'
 
 Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
   desc "User management via LDAP.

data/lib/puppet/provider/user/openbsd.rb

@@ -1,4 +1,4 @@
-require 'puppet/error'
+require_relative '../../../puppet/error'
 
 Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
   desc "User management via `useradd` and its ilk for OpenBSD. Note that you

data/lib/puppet/provider/user/pw.rb

@@ -1,4 +1,4 @@
-require 'puppet/provider/nameservice/pw'
+require_relative '../../../puppet/provider/nameservice/pw'
 require 'open3'
 
 Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::PW do

data/lib/puppet/provider/user/user_role_add.rb

@@ -1,5 +1,5 @@
-require 'puppet/util'
-require 'puppet/util/user_attr'
+require_relative '../../../puppet/util'
+require_relative '../../../puppet/util/user_attr'
 require 'date'
 
 Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source => :useradd do

data/lib/puppet/provider/user/useradd.rb

@@ -1,15 +1,15 @@
-require 'puppet/provider/nameservice/objectadd'
+require_relative '../../../puppet/provider/nameservice/objectadd'
 require 'date'
-require 'puppet/util/libuser'
+require_relative '../../../puppet/util/libuser'
 require 'time'
-require 'puppet/error'
+require_relative '../../../puppet/error'
 
 Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameService::ObjectAdd do
   desc "User management via `useradd` and its ilk.  Note that you will need to
     install Ruby's shadow password library (often known as `ruby-libshadow`)
     if you wish to manage user passwords."
 
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage", :chpasswd  => "chpasswd"
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
@@ -152,6 +152,38 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     set(:groups, value)
   end
 
+  def password=(value)
+    user = @resource[:name]
+    tempfile = Tempfile.new('puppet', :encoding => Encoding::UTF_8)
+    begin
+      # Puppet execute does not support strings as input, only files.
+      # The password is expected to be in an encrypted format given -e is specified:
+      tempfile << "#{user}:#{value}\n"
+      tempfile.flush
+
+      # Options '-e' use encrypted password
+      # Must receive "user:enc_password" as input
+      # command, arguments = {:failonfail => true, :combine => true}
+      cmd = [command(:chpasswd), '-e']
+      execute_options = {
+        :failonfail => false,
+        :combine => true,
+        :stdinfile => tempfile.path,
+        :sensitive => has_sensitive_data?
+      }
+      output = execute(cmd, execute_options)
+
+    rescue => detail
+      tempfile.close
+      tempfile.delete
+      raise Puppet::Error, "Could not set password on #{@resource.class.name}[#{@resource.name}]: #{detail}", detail.backtrace
+    end
+
+    # chpasswd can return 1, even on success (at least on AIX 6.1); empty output
+    # indicates success
+    raise Puppet::ExecutionFailure, "chpasswd said #{output}" if output != ''
+  end
+
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
   end
@@ -215,13 +247,15 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     end
   end
 
+  # Add properties and flags but skipping password related properties due to
+  # security risks
   def add_properties
     cmd = []
     # validproperties is a list of properties in undefined order
     # sort them to have a predictable command line in tests
     Puppet::Type.type(:user).validproperties.sort.each do |property|
       value = get_value_for_property(property)
-      next if value.nil?
+      next if value.nil? || property == :password
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
       cmd << flag(property) << munge(property, value)
@@ -331,13 +365,12 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     if @resource[:shell]
       check_valid_shell
     end
-     super
-     if @resource.forcelocal? && self.groups?
-       set(:groups, @resource[:groups])
-     end
-     if @resource.forcelocal? && @resource[:expiry]
-       set(:expiry, @resource[:expiry])
-     end
+    super
+    if @resource.forcelocal?
+      set(:groups, @resource[:groups]) if self.groups?
+      set(:expiry, @resource[:expiry]) if @resource[:expiry]
+    end
+    set(:password, @resource[:password]) if @resource[:password]
   end
 
   def groups?