puppet 8.3.1-x64-mingw32 → 8.5.0-x64-mingw32

data/lib/puppet/util/windows/registry.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows'
 
 module Puppet::Util::Windows
@@ -16,6 +17,8 @@ module Puppet::Util::Windows
 
     ERROR_NO_MORE_ITEMS = 259
 
+    WCHAR_SIZE = FFI.type_size(:wchar)
+
     def root(name)
       Win32::Registry.const_get(name)
     rescue NameError
@@ -63,7 +66,7 @@ module Puppet::Util::Windows
 
     def values(key)
       vals = {}
-      each_value(key) { |subkey, type, data| vals[subkey] = data }
+      each_value(key) { |subkey, _type, data| vals[subkey] = data }
       vals
     end
 
@@ -124,9 +127,9 @@ module Puppet::Util::Windows
 
             # RegEnumKeyEx cannot be called twice to properly size the buffer
             result = RegEnumKeyExW(key.hkey, index,
-              subkey_ptr, subkey_length_ptr,
-              FFI::Pointer::NULL, FFI::Pointer::NULL,
-              FFI::Pointer::NULL, filetime_ptr)
+                                   subkey_ptr, subkey_length_ptr,
+                                   FFI::Pointer::NULL, FFI::Pointer::NULL,
+                                   FFI::Pointer::NULL, filetime_ptr)
 
             break if result == ERROR_NO_MORE_ITEMS
 
@@ -157,10 +160,9 @@ module Puppet::Util::Windows
           subkey_length_ptr.write_dword(max_value_length)
 
           result = RegEnumValueW(key.hkey, index,
-            subkey_ptr, subkey_length_ptr,
-            FFI::Pointer::NULL, FFI::Pointer::NULL,
-            FFI::Pointer::NULL, FFI::Pointer::NULL
-          )
+                                 subkey_ptr, subkey_length_ptr,
+                                 FFI::Pointer::NULL, FFI::Pointer::NULL,
+                                 FFI::Pointer::NULL, FFI::Pointer::NULL)
 
           break if result == ERROR_NO_MORE_ITEMS
 
@@ -184,15 +186,13 @@ module Puppet::Util::Windows
 
       FFI::MemoryPointer.new(:dword) do |max_subkey_name_length_ptr|
         FFI::MemoryPointer.new(:dword) do |max_value_name_length_ptr|
-
           status = RegQueryInfoKeyW(key.hkey,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            max_subkey_name_length_ptr, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL, max_value_name_length_ptr,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL
-          )
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    max_subkey_name_length_ptr, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL, max_value_name_length_ptr,
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL)
 
           if status != FFI::ERROR_SUCCESS
             msg = _("Failed to query registry %{key} for sizes") % { key: key.keyname }
@@ -236,27 +236,28 @@ module Puppet::Util::Windows
 
         string_length = 0
         # buffer is raw bytes, *not* chars - less a NULL terminator
-        string_length = (byte_length / FFI.type_size(:wchar)) - 1 if byte_length > 0
+        string_length = (byte_length / WCHAR_SIZE) - 1 if byte_length > 0
 
         begin
-          case type
-            when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
-              result = [ type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true) ]
-            when Win32::Registry::REG_MULTI_SZ
-              result = [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
-            when Win32::Registry::REG_BINARY
-              result = [ type, data_ptr.read_bytes(byte_length) ]
-            when Win32::Registry::REG_DWORD
-              result = [ type, data_ptr.read_dword ]
-            when Win32::Registry::REG_DWORD_BIG_ENDIAN
-              result = [ type, data_ptr.order(:big).read_dword ]
-            when Win32::Registry::REG_QWORD
-              result = [ type, data_ptr.read_qword ]
-            else
-              raise TypeError, _("Type %{type} is not supported.") % { type: type }
-          end
+          result = case type
+                   when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                     [type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true)]
+                   when Win32::Registry::REG_MULTI_SZ
+                     [type, data_ptr.read_wide_string(string_length).split(/\0/)]
+                   when Win32::Registry::REG_BINARY
+                     [type, data_ptr.read_bytes(byte_length)]
+                   when Win32::Registry::REG_DWORD
+                     [type, data_ptr.read_dword]
+                   when Win32::Registry::REG_DWORD_BIG_ENDIAN
+                     [type, data_ptr.order(:big).read_dword]
+                   when Win32::Registry::REG_QWORD
+                     [type, data_ptr.read_qword]
+                   else
+                     raise TypeError, _("Type %{type} is not supported.") % { type: type }
+                   end
         rescue IndexError => ex
           raise if (ex.message !~ /^Memory access .* is out of bounds$/i)
+
           parent_key_name = key.parent ? "#{key.parent.keyname}\\" : ""
           Puppet.warning _("A value in the registry key %{parent_key_name}%{key} is corrupt or invalid") % { parent_key_name: parent_key_name, key: key.keyname }
         end
@@ -269,17 +270,50 @@ module Puppet::Util::Windows
       FFI::MemoryPointer.new(:dword) do |type_ptr|
         FFI::MemoryPointer.new(:dword) do |length_ptr|
           result = RegQueryValueExW(key.hkey, name_ptr,
-            FFI::Pointer::NULL, type_ptr,
-            FFI::Pointer::NULL, length_ptr)
-
-          FFI::MemoryPointer.new(:byte, length_ptr.read_dword) do |buffer_ptr|
+                                    FFI::Pointer::NULL, type_ptr,
+                                    FFI::Pointer::NULL, length_ptr)
+
+          # The call to RegQueryValueExW below is potentially unsafe:
+          # https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexw
+          #
+          #   "If the data has the REG_SZ, REG_MULTI_SZ or REG_EXPAND_SZ type,
+          #   the string may not have been stored with the proper terminating
+          #   null characters. Therefore, even if the function returns
+          #   ERROR_SUCCESS, the application should ensure that the string is
+          #   properly terminated before using it; otherwise, it may overwrite a
+          #   buffer. (Note that REG_MULTI_SZ strings should have two
+          #   terminating null characters.)"
+          #
+          # Since we don't know if the values will be properly null terminated,
+          # extend the buffer to guarantee we can append one or two wide null
+          # characters, without overwriting any data.
+          base_bytes_len = length_ptr.read_dword
+          pad_bytes_len = case type_ptr.read_dword
+                          when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                            WCHAR_SIZE
+                          when Win32::Registry::REG_MULTI_SZ
+                            WCHAR_SIZE * 2
+                          else
+                            0
+                          end
+
+          FFI::MemoryPointer.new(:byte, base_bytes_len + pad_bytes_len) do |buffer_ptr|
             result = RegQueryValueExW(key.hkey, name_ptr,
-              FFI::Pointer::NULL, type_ptr,
-              buffer_ptr, length_ptr)
-
-            if result != FFI::ERROR_SUCCESS
+                                      FFI::Pointer::NULL, type_ptr,
+                                      buffer_ptr, length_ptr)
+
+            # Ensure buffer is null terminated with 1 or 2 wchar nulls, depending on the type
+            if result == FFI::ERROR_SUCCESS
+              case type_ptr.read_dword
+              when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                buffer_ptr.put_uint16(base_bytes_len, 0)
+              when Win32::Registry::REG_MULTI_SZ
+                buffer_ptr.put_uint16(base_bytes_len, 0)
+                buffer_ptr.put_uint16(base_bytes_len + WCHAR_SIZE, 0)
+              end
+            else
               # buffer is raw bytes, *not* chars - less a NULL terminator
-              name_length = (name_ptr.size / FFI.type_size(:wchar)) - 1 if name_ptr.size > 0
+              name_length = (name_ptr.size / WCHAR_SIZE) - 1 if name_ptr.size > 0
               msg = _("Failed to read registry value %{value} at %{key}") % { value: name_ptr.read_wide_string(name_length), key: key.keyname }
               raise Puppet::Util::Windows::Error.new(msg, result)
             end
@@ -336,7 +370,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegEnumKeyExW,
-      [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpwstr, :lpdword, :pointer], :win32_long
+                            [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpwstr, :lpdword, :pointer], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724865(v=vs.85).aspx
     # LONG WINAPI RegEnumValue(
@@ -351,7 +385,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegEnumValueW,
-      [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
+                            [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724911(v=vs.85).aspx
     # LONG WINAPI RegQueryValueExW(
@@ -364,7 +398,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegQueryValueExW,
-      [:handle, :lpcwstr, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
+                            [:handle, :lpcwstr, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
 
     # LONG WINAPI RegDeleteValue(
     #   _In_      HKEY hKey,
@@ -372,7 +406,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegDeleteValueW,
-      [:handle, :lpcwstr], :win32_long
+                            [:handle, :lpcwstr], :win32_long
 
     # LONG WINAPI RegDeleteKeyEx(
     #   _In_        HKEY hKey,
@@ -382,7 +416,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegDeleteKeyExW,
-      [:handle, :lpcwstr, :win32_ulong, :dword], :win32_long
+                            [:handle, :lpcwstr, :win32_ulong, :dword], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724902(v=vs.85).aspx
     # LONG WINAPI RegQueryInfoKey(
@@ -401,7 +435,8 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegQueryInfoKeyW,
-      [:handle, :lpwstr, :lpdword, :lpdword, :lpdword, :lpdword, :lpdword,
-        :lpdword, :lpdword, :lpdword, :lpdword, :pointer], :win32_long
+                            [:handle, :lpwstr, :lpdword, :lpdword, :lpdword,
+                             :lpdword, :lpdword, :lpdword, :lpdword, :lpdword,
+                             :lpdword, :pointer], :win32_long
   end
 end

data/lib/puppet/util/windows/root_certs.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows'
 require_relative '../../../puppet/ssl/openssl_loader'
 require 'ffi'
@@ -18,7 +19,7 @@ class Puppet::Util::Windows::RootCerts
   # @yieldparam cert [OpenSSL::X509::Certificate] each root certificate
   # @api public
   def each
-    @roots.each {|cert| yield cert}
+    @roots.each { |cert| yield cert }
   end
 
   # Returns a new instance.

data/lib/puppet/util/windows/security.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # This class maps POSIX owner, group, and modes to the Windows
 # security model, and back.
 #
@@ -86,7 +87,7 @@ module Puppet::Util::Windows::Security
   S_IRWXG = 0000070
   S_IRWXO = 0000007
   S_ISVTX = 0001000
-  S_IEXTRA = 02000000  # represents an extra ace
+  S_IEXTRA = 02000000 # represents an extra ace
   S_ISYSTEM_MISSING = 04000000
 
   # constants that are missing from Windows::Security
@@ -160,7 +161,7 @@ module Puppet::Util::Windows::Security
     get_security_descriptor(path).group
   end
 
-  FILE_PERSISTENT_ACLS           = 0x00000008
+  FILE_PERSISTENT_ACLS = 0x00000008
 
   def supports_acl?(path)
     supported = false
@@ -170,10 +171,11 @@ module Puppet::Util::Windows::Security
 
     FFI::MemoryPointer.new(:pointer, 1) do |flags_ptr|
       if GetVolumeInformationW(wide_string(root), FFI::Pointer::NULL, 0,
-          FFI::Pointer::NULL, FFI::Pointer::NULL,
-          flags_ptr, FFI::Pointer::NULL, 0) == FFI::WIN32_FALSE
+                               FFI::Pointer::NULL, FFI::Pointer::NULL,
+                               flags_ptr, FFI::Pointer::NULL, 0) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(_("Failed to get volume information"))
       end
+
       supported = flags_ptr.read_dword & FILE_PERSISTENT_ACLS == FILE_PERSISTENT_ACLS
     end
 
@@ -212,35 +214,35 @@ module Puppet::Util::Windows::Security
 
       case ace.sid
       when sd.owner
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 6)
           end
         end
       when sd.group
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 3)
           end
         end
       when well_known_world_sid
-        MASK_TO_MODE.each_pair do |k,v|
+        MASK_TO_MODE.each_pair do |k, v|
           if (ace.mask & k) == k
             mode |= (v << 6) | (v << 3) | v
           end
         end
         if File.directory?(path) &&
-          (ace.mask & (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE | FILE::FILE_DELETE_CHILD)) == (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE)
+           (ace.mask & (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE | FILE::FILE_DELETE_CHILD)) == (FILE::FILE_WRITE_DATA | FILE::FILE_EXECUTE)
           mode |= S_ISVTX;
         end
       when well_known_nobody_sid
         if (ace.mask & FILE::FILE_APPEND_DATA).nonzero?
           mode |= S_ISVTX
         end
-      when well_known_app_packages_sid
-      when well_known_system_sid
+      when well_known_app_packages_sid, well_known_system_sid
+        # do nothing
       else
-        #puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"
+        # puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"
         mode |= S_IEXTRA
       end
 
@@ -251,11 +253,11 @@ module Puppet::Util::Windows::Security
       # if owner and group the same, then user and group modes are the OR of both
       if sd.owner == sd.group
         mode |= ((mode & S_IRWXG) << 3) | ((mode & S_IRWXU) >> 3)
-        #puts "owner: #{sd.group}, 0x#{ace.mask.to_s(16)}, #{mode.to_s(8)}"
+        # puts "owner: #{sd.group}, 0x#{ace.mask.to_s(16)}, #{mode.to_s(8)}"
       end
     end
 
-    #puts "get_mode: #{mode.to_s(8)}"
+    # puts "get_mode: #{mode.to_s(8)}"
     mode
   end
 
@@ -285,20 +287,20 @@ module Puppet::Util::Windows::Security
     well_known_system_sid = Puppet::Util::Windows::SID::LocalSystem
 
     owner_allow = FILE::STANDARD_RIGHTS_ALL  |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::FILE_WRITE_ATTRIBUTES
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::FILE_WRITE_ATTRIBUTES
     # this prevents a mode that is not 7 from taking ownership of a file based
     # on group membership and rewriting it / making it executable
     group_allow = FILE::STANDARD_RIGHTS_READ |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::SYNCHRONIZE
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::SYNCHRONIZE
     other_allow = FILE::STANDARD_RIGHTS_READ |
-      FILE::FILE_READ_ATTRIBUTES |
-      FILE::SYNCHRONIZE
+                  FILE::FILE_READ_ATTRIBUTES |
+                  FILE::SYNCHRONIZE
     nobody_allow = 0
     system_allow = 0
 
-    MODE_TO_MASK.each do |k,v|
+    MODE_TO_MASK.each do |k, v|
       if ((mode >> 6) & k) == k
         owner_allow |= v
       end
@@ -326,7 +328,7 @@ module Puppet::Util::Windows::Security
     isownergroup = sd.owner == sd.group
 
     # caller is NOT managing SYSTEM by using group or owner, so set to FULL
-    if ! [sd.owner, sd.group].include? well_known_system_sid
+    if ![sd.owner, sd.group].include? well_known_system_sid
       # we don't check S_ISYSTEM_MISSING bit, but automatically carry over existing SYSTEM perms
       # by default set SYSTEM perms to full
       system_allow = FILE::FILE_ALL_ACCESS
@@ -337,13 +339,13 @@ module Puppet::Util::Windows::Security
         # If owner and group are both SYSTEM but group is unmanaged the control rights of system will be set to FullControl by
         # the unmanaged group, so there is no need for the warning
         if managing_owner && (!isownergroup || managing_group)
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.warning _("Setting control rights for %{path} owner SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_owner && isownergroup
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but group is not managed directly: SYSTEM user rights will be set to FullControl by group") % { path: path } }
         else
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the owner, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           owner_allow = FILE::FILE_ALL_ACCESS
         end
@@ -353,13 +355,13 @@ module Puppet::Util::Windows::Security
         # If owner and group are both SYSTEM but owner is unmanaged the control rights of system will be set to FullControl by
         # the unmanaged owner, so there is no need for the warning.
         if managing_group && (!isownergroup || managing_owner)
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.warning _("Setting control rights for %{path} group SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_group && isownergroup
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but owner is not managed directly: SYSTEM user rights will be set to FullControl by owner") % { path: path } }
         else
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           group_allow = FILE::FILE_ALL_ACCESS
         end
@@ -385,7 +387,7 @@ module Puppet::Util::Windows::Security
 
     # if any ACE allows write, then clear readonly bit, but do this before we overwrite
     # the DACl and lose our ability to set the attribute
-    if ((owner_allow | group_allow | other_allow ) & FILE::FILE_WRITE_DATA) == FILE::FILE_WRITE_DATA
+    if ((owner_allow | group_allow | other_allow) & FILE::FILE_WRITE_DATA) == FILE::FILE_WRITE_DATA
       FILE.remove_attributes(path, FILE::FILE_ATTRIBUTE_READONLY)
     end
 
@@ -401,7 +403,7 @@ module Puppet::Util::Windows::Security
     # TODO: system should be first?
     flags = !isdir ? 0 :
       Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE |
-      Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
+        Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
     dacl.allow(well_known_system_sid, system_allow, flags)
 
     # add inherit-only aces for child dirs and files that are created within the dir
@@ -424,7 +426,7 @@ module Puppet::Util::Windows::Security
     nil
   end
 
-  ACL_REVISION                   = 2
+  ACL_REVISION = 2
 
   def add_access_allowed_ace(acl, mask, sid, inherit = nil)
     inherit ||= NO_INHERITANCE
@@ -476,16 +478,15 @@ module Puppet::Util::Windows::Security
 
     0.upto(ace_count - 1) do |i|
       FFI::MemoryPointer.new(:pointer, 1) do |ace_ptr|
-
         next if GetAce(dacl_ptr, i, ace_ptr) == FFI::WIN32_FALSE
 
         # ACE structures vary depending on the type. We are only concerned with
         # ACCESS_ALLOWED_ACE and ACCESS_DENIED_ACEs, which have the same layout
-        ace = GENERIC_ACCESS_ACE.new(ace_ptr.get_pointer(0)) #deref LPVOID *
+        ace = GENERIC_ACCESS_ACE.new(ace_ptr.get_pointer(0)) # deref LPVOID *
 
         ace_type = ace[:Header][:AceType]
         if ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_ALLOWED_ACE_TYPE &&
-          ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
+           ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
           Puppet.warning _("Unsupported access control entry type: 0x%{type}") % { type: ace_type.to_s(16) }
           next
         end
@@ -511,13 +512,14 @@ module Puppet::Util::Windows::Security
   # block with the opened file HANDLE.
   def open_file(path, access, &block)
     handle = CreateFileW(
-             wide_string(path),
-             access,
-             FILE::FILE_SHARE_READ | FILE::FILE_SHARE_WRITE,
-             FFI::Pointer::NULL, # security_attributes
-             FILE::OPEN_EXISTING,
-             FILE::FILE_FLAG_OPEN_REPARSE_POINT | FILE::FILE_FLAG_BACKUP_SEMANTICS,
-             FFI::Pointer::NULL_HANDLE) # template
+      wide_string(path),
+      access,
+      FILE::FILE_SHARE_READ | FILE::FILE_SHARE_WRITE,
+      FFI::Pointer::NULL, # security_attributes
+      FILE::OPEN_EXISTING,
+      FILE::FILE_FLAG_OPEN_REPARSE_POINT | FILE::FILE_FLAG_BACKUP_SEMANTICS,
+      FFI::Pointer::NULL_HANDLE
+    ) # template
 
     if handle == Puppet::Util::Windows::File::INVALID_HANDLE_VALUE
       raise Puppet::Util::Windows::Error.new(_("Failed to open '%{path}'") % { path: path })
@@ -565,8 +567,8 @@ module Puppet::Util::Windows::Security
             # size is correct given we only have 1 LUID, otherwise would be:
             # [:PrivilegeCount].size + [:PrivilegeCount] * LUID_AND_ATTRIBUTES.size
             if AdjustTokenPrivileges(token, FFI::WIN32_FALSE,
-                token_privileges, token_privileges.size,
-                FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
+                                     token_privileges, token_privileges.size,
+                                     FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
               raise Puppet::Util::Windows::Error.new(_("Failed to adjust process privileges"))
             end
           end
@@ -587,7 +589,6 @@ module Puppet::Util::Windows::Security
           FFI::MemoryPointer.new(:pointer, 1) do |group_sid_ptr_ptr|
             FFI::MemoryPointer.new(:pointer, 1) do |dacl_ptr_ptr|
               FFI::MemoryPointer.new(:pointer, 1) do |sd_ptr_ptr|
-
                 rv = GetSecurityInfo(
                   handle,
                   :SE_FILE_OBJECT,
@@ -595,8 +596,9 @@ module Puppet::Util::Windows::Security
                   owner_sid_ptr_ptr,
                   group_sid_ptr_ptr,
                   dacl_ptr_ptr,
-                  FFI::Pointer::NULL, #sacl
-                  sd_ptr_ptr) #sec desc
+                  FFI::Pointer::NULL, # sacl
+                  sd_ptr_ptr
+                ) # sec desc
                 raise Puppet::Util::Windows::Error.new(_("Failed to get security information")) if rv != FFI::ERROR_SUCCESS
 
                 # these 2 convenience params are not freed since they point inside sd_ptr
@@ -606,7 +608,6 @@ module Puppet::Util::Windows::Security
                 FFI::MemoryPointer.new(:word, 1) do |control|
                   FFI::MemoryPointer.new(:dword, 1) do |revision|
                     sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|
-
                       if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE
                         raise Puppet::Util::Windows::Error.new(_("Failed to get security descriptor control"))
                       end
@@ -656,10 +657,10 @@ module Puppet::Util::Windows::Security
                 sd.dacl.each do |ace|
                   case ace.type
                   when Puppet::Util::Windows::AccessControlEntry::ACCESS_ALLOWED_ACE_TYPE
-                    #puts "ace: allow, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                    # puts "ace: allow, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
                     add_access_allowed_ace(acl_ptr, ace.mask, ace.sid, ace.flags)
                   when Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
-                    #puts "ace: deny, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                    # puts "ace: deny, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
                     add_access_denied_ace(acl_ptr, ace.mask, ace.sid, ace.flags)
                   else
                     raise "We should never get here"
@@ -704,7 +705,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :kernel32
   attach_function_private :CreateFileW,
-    [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
+                          [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
   # BOOL WINAPI GetVolumeInformation(
@@ -719,7 +720,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :kernel32
   attach_function_private :GetVolumeInformationW,
-    [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
+                          [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
   # BOOL WINAPI AddAccessAllowedAceEx(
@@ -731,7 +732,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AddAccessAllowedAceEx,
-    [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
   # BOOL WINAPI AddAccessDeniedAceEx(
@@ -743,7 +744,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AddAccessDeniedAceEx,
-    [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
   # typedef struct _ACL {
@@ -803,7 +804,7 @@ module Puppet::Util::Windows::Security
   # https://stackoverflow.com/a/1792930
   MAXIMUM_SID_BYTES_LENGTH = 68
   MAXIMUM_GENERIC_ACE_SIZE = GENERIC_ACCESS_ACE.offset_of(:SidStart) +
-    MAXIMUM_SID_BYTES_LENGTH
+                             MAXIMUM_SID_BYTES_LENGTH
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa446634(v=vs.85).aspx
   # BOOL WINAPI GetAce(
@@ -813,7 +814,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetAce,
-    [:pointer, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
   # BOOL WINAPI AdjustTokenPrivileges(
@@ -826,7 +827,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AdjustTokenPrivileges,
-    [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
+                          [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
@@ -839,7 +840,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetSecurityDescriptorControl,
-    [:pointer, :lpword, :lpdword], :win32_bool
+                          [:pointer, :lpword, :lpdword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
   # BOOL WINAPI InitializeAcl(
@@ -849,7 +850,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :InitializeAcl,
-    [:pointer, :dword, :dword], :win32_bool
+                          [:pointer, :dword, :dword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
   # BOOL WINAPI IsValidAcl(
@@ -857,7 +858,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :IsValidAcl,
-    [:pointer], :win32_bool
+                          [:pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
   SE_OBJECT_TYPE = enum(
@@ -889,7 +890,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetSecurityInfo,
-    [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
+                          [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
   # DWORD WINAPI SetSecurityInfo(
@@ -904,5 +905,5 @@ module Puppet::Util::Windows::Security
   ffi_lib :advapi32
   # TODO: SECURITY_INFORMATION is actually a bitmask the size of a DWORD
   attach_function_private :SetSecurityInfo,
-    [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer], :dword
+                          [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer], :dword
 end

data/lib/puppet/util/windows/security_descriptor.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Windows Security Descriptor
 #
 # Represents a security descriptor that can be applied to any Windows securable