puppet 8.3.1 → 8.4.0

data/lib/puppet/util/windows/principal.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows'
 
 module Puppet::Util::Windows::SID
@@ -21,7 +22,7 @@ module Puppet::Util::Windows::SID
       if (domain && !domain.empty? && @account_type == :SidTypeDomain)
         @domain_account = @domain
       elsif (domain && !domain.empty?)
-        @domain_account =  "#{domain}\\#{@account}"
+        @domain_account = "#{domain}\\#{@account}"
       else
         @domain_account = account
       end
@@ -59,28 +60,27 @@ module Puppet::Util::Windows::SID
             FFI::MemoryPointer.new(:dword, 1) do |sid_length_ptr|
               FFI::MemoryPointer.new(:dword, 1) do |domain_length_ptr|
                 FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|
+                  sid_length_ptr.write_dword(MAXIMUM_SID_BYTE_LENGTH)
+                  success = LookupAccountNameW(system_name_ptr, account_name_ptr, sid_ptr, sid_length_ptr,
+                                               FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
+                  last_error = FFI.errno
 
-                sid_length_ptr.write_dword(MAXIMUM_SID_BYTE_LENGTH)
-                success = LookupAccountNameW(system_name_ptr, account_name_ptr, sid_ptr, sid_length_ptr,
-                  FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
-                last_error = FFI.errno
-
-                if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
-                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name}, last_error)
-                end
-
-                FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
-                  if LookupAccountNameW(system_name_ptr, account_name_ptr,
-                      sid_ptr, sid_length_ptr,
-                      domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                  raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name} )
+                  if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
+                    raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name}, last_error)
                   end
 
-                  # with a SID returned, loop back through lookup_account_sid to retrieve official name
-                  # necessary when accounts like . or '' are passed in
-                  return lookup_account_sid(
-                    system_name,
-                    sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*'))
+                  FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
+                    if LookupAccountNameW(system_name_ptr, account_name_ptr,
+                                          sid_ptr, sid_length_ptr,
+                                          domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
+                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountNameW with account: %{account_name}') % { account_name: account_name} )
+                    end
+
+                    # with a SID returned, loop back through lookup_account_sid to retrieve official name
+                    # necessary when accounts like . or '' are passed in
+                    return lookup_account_sid(
+                      system_name,
+                      sid_ptr.read_bytes(sid_length_ptr.read_dword).unpack('C*'))
                   end
                 end
               end
@@ -95,7 +95,7 @@ module Puppet::Util::Windows::SID
     def self.lookup_account_sid(system_name = nil, sid_bytes)
       system_name_ptr = FFI::Pointer::NULL
       if (sid_bytes.nil? || (!sid_bytes.is_a? Array) || (sid_bytes.length == 0))
-        #TRANSLATORS `lookup_account_sid` is a variable name and should not be translated
+        # TRANSLATORS `lookup_account_sid` is a variable name and should not be translated
         raise Puppet::Util::Windows::Error.new(_('Byte array for lookup_account_sid must not be nil and must be at least 1 byte long'))
       end
 
@@ -109,7 +109,6 @@ module Puppet::Util::Windows::SID
           FFI::MemoryPointer.new(:dword, 1) do |name_length_ptr|
             FFI::MemoryPointer.new(:dword, 1) do |domain_length_ptr|
               FFI::MemoryPointer.new(:uint32, 1) do |name_use_enum_ptr|
-
                 sid_ptr.write_array_of_uchar(sid_bytes)
 
                 if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE
@@ -117,7 +116,7 @@ module Puppet::Util::Windows::SID
                 end
 
                 success = LookupAccountSidW(system_name_ptr, sid_ptr, FFI::Pointer::NULL, name_length_ptr,
-                  FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
+                                            FFI::Pointer::NULL, domain_length_ptr, name_use_enum_ptr)
                 last_error = FFI.errno
 
                 if (success == FFI::WIN32_FALSE && last_error != ERROR_INSUFFICIENT_BUFFER)
@@ -127,8 +126,8 @@ module Puppet::Util::Windows::SID
                 FFI::MemoryPointer.new(:lpwstr, name_length_ptr.read_dword) do |name_ptr|
                   FFI::MemoryPointer.new(:lpwstr, domain_length_ptr.read_dword) do |domain_ptr|
                     if LookupAccountSidW(system_name_ptr, sid_ptr, name_ptr, name_length_ptr,
-                        domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
-                     raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes} )
+                                         domain_ptr, domain_length_ptr, name_use_enum_ptr) == FFI::WIN32_FALSE
+                      raise Puppet::Util::Windows::Error.new(_('Failed to call LookupAccountSidW with bytes: %{sid_bytes}') % { sid_bytes: sid_bytes} )
                     end
 
                     return new(
@@ -151,6 +150,7 @@ module Puppet::Util::Windows::SID
     # Sanitize the given account name for lookup to avoid known issues
     def self.sanitize_account_name(account_name)
       return account_name unless account_name.start_with?('APPLICATION PACKAGE AUTHORITY\\')
+
       account_name.split('\\').last
     end
     private_class_method :sanitize_account_name
@@ -183,7 +183,7 @@ module Puppet::Util::Windows::SID
     # );
     ffi_lib :advapi32
     attach_function_private :LookupAccountNameW,
-      [:lpcwstr, :lpcwstr, :pointer, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
+                            [:lpcwstr, :lpcwstr, :pointer, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379166(v=vs.85).aspx
     # BOOL WINAPI LookupAccountSid(
@@ -197,6 +197,6 @@ module Puppet::Util::Windows::SID
     # );
     ffi_lib :advapi32
     attach_function_private :LookupAccountSidW,
-      [:lpcwstr, :pointer, :lpwstr, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
+                            [:lpcwstr, :pointer, :lpwstr, :lpdword, :lpwstr, :lpdword, :pointer], :win32_bool
   end
 end

data/lib/puppet/util/windows/process.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows/monkey_patches/process'
 require_relative '../../../puppet/ffi/windows'
 
@@ -46,6 +47,7 @@ module Puppet::Util::Windows::Process
       if GetExitCodeProcess(handle, exit_status_ptr) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(_("Failed to get child process exit code"))
       end
+
       exit_status = exit_status_ptr.read_dword
 
       # $CHILD_STATUS is not set when calling win32/process Process.create
@@ -134,8 +136,8 @@ module Puppet::Util::Windows::Process
             result = QueryFullProcessImageNameW(phandle, use_win32_path_format, exe_name_ptr, exe_name_length_ptr)
             if result == FFI::WIN32_FALSE
               raise Puppet::Util::Windows::Error.new(
-                      "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
-                      "exe_name_ptr, #{max_chars}")
+                "QueryFullProcessImageNameW(phandle, #{use_win32_path_format}, " +
+                "exe_name_ptr, #{max_chars}")
             end
             image_name = exe_name_ptr.read_wide_string(exe_name_length_ptr.read_dword)
           end
@@ -153,7 +155,7 @@ module Puppet::Util::Windows::Process
         wide_string(system_name),
         wide_string(name.to_s),
         luid_ptr
-        )
+      )
 
       if result == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(
@@ -182,7 +184,7 @@ module Puppet::Util::Windows::Process
       # re-call API with properly sized buffer for all results
       FFI::MemoryPointer.new(return_length) do |token_information_buf|
         result = GetTokenInformation(token_handle, token_information,
-          token_information_buf, return_length, return_length_ptr)
+                                     token_information_buf, return_length, return_length_ptr)
 
         if result == FFI::WIN32_FALSE
           raise Puppet::Util::Windows::Error.new(
@@ -208,7 +210,7 @@ module Puppet::Util::Windows::Process
 
     # extract each instance of LUID_AND_ATTRIBUTES
     0.upto(privileges[:count] - 1) do |i|
-      privileges[:privileges] <<  LUID_AND_ATTRIBUTES.new(privilege_ptr[i])
+      privileges[:privileges] << LUID_AND_ATTRIBUTES.new(privilege_ptr[i])
     end
 
     privileges
@@ -361,5 +363,4 @@ module Puppet::Util::Windows::Process
     windows_major_version >= 6
   end
   module_function :supports_elevated_security?
-
 end

data/lib/puppet/util/windows/registry.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows'
 
 module Puppet::Util::Windows
@@ -63,7 +64,7 @@ module Puppet::Util::Windows
 
     def values(key)
       vals = {}
-      each_value(key) { |subkey, type, data| vals[subkey] = data }
+      each_value(key) { |subkey, _type, data| vals[subkey] = data }
       vals
     end
 
@@ -124,9 +125,9 @@ module Puppet::Util::Windows
 
             # RegEnumKeyEx cannot be called twice to properly size the buffer
             result = RegEnumKeyExW(key.hkey, index,
-              subkey_ptr, subkey_length_ptr,
-              FFI::Pointer::NULL, FFI::Pointer::NULL,
-              FFI::Pointer::NULL, filetime_ptr)
+                                   subkey_ptr, subkey_length_ptr,
+                                   FFI::Pointer::NULL, FFI::Pointer::NULL,
+                                   FFI::Pointer::NULL, filetime_ptr)
 
             break if result == ERROR_NO_MORE_ITEMS
 
@@ -157,9 +158,9 @@ module Puppet::Util::Windows
           subkey_length_ptr.write_dword(max_value_length)
 
           result = RegEnumValueW(key.hkey, index,
-            subkey_ptr, subkey_length_ptr,
-            FFI::Pointer::NULL, FFI::Pointer::NULL,
-            FFI::Pointer::NULL, FFI::Pointer::NULL
+                                 subkey_ptr, subkey_length_ptr,
+                                 FFI::Pointer::NULL, FFI::Pointer::NULL,
+                                 FFI::Pointer::NULL, FFI::Pointer::NULL
           )
 
           break if result == ERROR_NO_MORE_ITEMS
@@ -184,14 +185,13 @@ module Puppet::Util::Windows
 
       FFI::MemoryPointer.new(:dword) do |max_subkey_name_length_ptr|
         FFI::MemoryPointer.new(:dword) do |max_value_name_length_ptr|
-
           status = RegQueryInfoKeyW(key.hkey,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            max_subkey_name_length_ptr, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL, max_value_name_length_ptr,
-            FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
-            FFI::MemoryPointer::NULL
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    max_subkey_name_length_ptr, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL, max_value_name_length_ptr,
+                                    FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL,
+                                    FFI::MemoryPointer::NULL
           )
 
           if status != FFI::ERROR_SUCCESS
@@ -239,24 +239,25 @@ module Puppet::Util::Windows
         string_length = (byte_length / FFI.type_size(:wchar)) - 1 if byte_length > 0
 
         begin
-          case type
-            when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
-              result = [ type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true) ]
-            when Win32::Registry::REG_MULTI_SZ
-              result = [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
-            when Win32::Registry::REG_BINARY
-              result = [ type, data_ptr.read_bytes(byte_length) ]
-            when Win32::Registry::REG_DWORD
-              result = [ type, data_ptr.read_dword ]
-            when Win32::Registry::REG_DWORD_BIG_ENDIAN
-              result = [ type, data_ptr.order(:big).read_dword ]
-            when Win32::Registry::REG_QWORD
-              result = [ type, data_ptr.read_qword ]
-            else
-              raise TypeError, _("Type %{type} is not supported.") % { type: type }
-          end
+          result = case type
+                   when Win32::Registry::REG_SZ, Win32::Registry::REG_EXPAND_SZ
+                     [ type, data_ptr.read_wide_string(string_length, Encoding::UTF_8, true) ]
+                   when Win32::Registry::REG_MULTI_SZ
+                     [ type, data_ptr.read_wide_string(string_length).split(/\0/) ]
+                   when Win32::Registry::REG_BINARY
+                     [ type, data_ptr.read_bytes(byte_length) ]
+                   when Win32::Registry::REG_DWORD
+                     [ type, data_ptr.read_dword ]
+                   when Win32::Registry::REG_DWORD_BIG_ENDIAN
+                     [ type, data_ptr.order(:big).read_dword ]
+                   when Win32::Registry::REG_QWORD
+                     [ type, data_ptr.read_qword ]
+                   else
+                     raise TypeError, _("Type %{type} is not supported.") % { type: type }
+                   end
         rescue IndexError => ex
           raise if (ex.message !~ /^Memory access .* is out of bounds$/i)
+
           parent_key_name = key.parent ? "#{key.parent.keyname}\\" : ""
           Puppet.warning _("A value in the registry key %{parent_key_name}%{key} is corrupt or invalid") % { parent_key_name: parent_key_name, key: key.keyname }
         end
@@ -269,13 +270,13 @@ module Puppet::Util::Windows
       FFI::MemoryPointer.new(:dword) do |type_ptr|
         FFI::MemoryPointer.new(:dword) do |length_ptr|
           result = RegQueryValueExW(key.hkey, name_ptr,
-            FFI::Pointer::NULL, type_ptr,
-            FFI::Pointer::NULL, length_ptr)
+                                    FFI::Pointer::NULL, type_ptr,
+                                    FFI::Pointer::NULL, length_ptr)
 
           FFI::MemoryPointer.new(:byte, length_ptr.read_dword) do |buffer_ptr|
             result = RegQueryValueExW(key.hkey, name_ptr,
-              FFI::Pointer::NULL, type_ptr,
-              buffer_ptr, length_ptr)
+                                      FFI::Pointer::NULL, type_ptr,
+                                      buffer_ptr, length_ptr)
 
             if result != FFI::ERROR_SUCCESS
               # buffer is raw bytes, *not* chars - less a NULL terminator
@@ -336,7 +337,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegEnumKeyExW,
-      [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpwstr, :lpdword, :pointer], :win32_long
+                            [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpwstr, :lpdword, :pointer], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724865(v=vs.85).aspx
     # LONG WINAPI RegEnumValue(
@@ -351,7 +352,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegEnumValueW,
-      [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
+                            [:handle, :dword, :lpwstr, :lpdword, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724911(v=vs.85).aspx
     # LONG WINAPI RegQueryValueExW(
@@ -364,7 +365,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegQueryValueExW,
-      [:handle, :lpcwstr, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
+                            [:handle, :lpcwstr, :lpdword, :lpdword, :lpbyte, :lpdword], :win32_long
 
     # LONG WINAPI RegDeleteValue(
     #   _In_      HKEY hKey,
@@ -372,7 +373,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegDeleteValueW,
-      [:handle, :lpcwstr], :win32_long
+                            [:handle, :lpcwstr], :win32_long
 
     # LONG WINAPI RegDeleteKeyEx(
     #   _In_        HKEY hKey,
@@ -382,7 +383,7 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegDeleteKeyExW,
-      [:handle, :lpcwstr, :win32_ulong, :dword], :win32_long
+                            [:handle, :lpcwstr, :win32_ulong, :dword], :win32_long
 
     # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724902(v=vs.85).aspx
     # LONG WINAPI RegQueryInfoKey(
@@ -401,7 +402,8 @@ module Puppet::Util::Windows
     # );
     ffi_lib :advapi32
     attach_function_private :RegQueryInfoKeyW,
-      [:handle, :lpwstr, :lpdword, :lpdword, :lpdword, :lpdword, :lpdword,
-        :lpdword, :lpdword, :lpdword, :lpdword, :pointer], :win32_long
+                            [:handle, :lpwstr, :lpdword, :lpdword, :lpdword,
+                             :lpdword, :lpdword, :lpdword, :lpdword, :lpdword,
+                             :lpdword, :pointer], :win32_long
   end
 end

data/lib/puppet/util/windows/root_certs.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative '../../../puppet/util/windows'
 require_relative '../../../puppet/ssl/openssl_loader'
 require 'ffi'

data/lib/puppet/util/windows/security.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # This class maps POSIX owner, group, and modes to the Windows
 # security model, and back.
 #
@@ -86,7 +87,7 @@ module Puppet::Util::Windows::Security
   S_IRWXG = 0000070
   S_IRWXO = 0000007
   S_ISVTX = 0001000
-  S_IEXTRA = 02000000  # represents an extra ace
+  S_IEXTRA = 02000000 # represents an extra ace
   S_ISYSTEM_MISSING = 04000000
 
   # constants that are missing from Windows::Security
@@ -160,7 +161,7 @@ module Puppet::Util::Windows::Security
     get_security_descriptor(path).group
   end
 
-  FILE_PERSISTENT_ACLS           = 0x00000008
+  FILE_PERSISTENT_ACLS = 0x00000008
 
   def supports_acl?(path)
     supported = false
@@ -170,10 +171,11 @@ module Puppet::Util::Windows::Security
 
     FFI::MemoryPointer.new(:pointer, 1) do |flags_ptr|
       if GetVolumeInformationW(wide_string(root), FFI::Pointer::NULL, 0,
-          FFI::Pointer::NULL, FFI::Pointer::NULL,
-          flags_ptr, FFI::Pointer::NULL, 0) == FFI::WIN32_FALSE
+                               FFI::Pointer::NULL, FFI::Pointer::NULL,
+                               flags_ptr, FFI::Pointer::NULL, 0) == FFI::WIN32_FALSE
         raise Puppet::Util::Windows::Error.new(_("Failed to get volume information"))
       end
+
       supported = flags_ptr.read_dword & FILE_PERSISTENT_ACLS == FILE_PERSISTENT_ACLS
     end
 
@@ -237,10 +239,10 @@ module Puppet::Util::Windows::Security
         if (ace.mask & FILE::FILE_APPEND_DATA).nonzero?
           mode |= S_ISVTX
         end
-      when well_known_app_packages_sid
-      when well_known_system_sid
+      when well_known_app_packages_sid, well_known_system_sid
+        # do nothing
       else
-        #puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"
+        # puts "Warning, unable to map SID into POSIX mode: #{ace.sid}"
         mode |= S_IEXTRA
       end
 
@@ -251,11 +253,11 @@ module Puppet::Util::Windows::Security
       # if owner and group the same, then user and group modes are the OR of both
       if sd.owner == sd.group
         mode |= ((mode & S_IRWXG) << 3) | ((mode & S_IRWXU) >> 3)
-        #puts "owner: #{sd.group}, 0x#{ace.mask.to_s(16)}, #{mode.to_s(8)}"
+        # puts "owner: #{sd.group}, 0x#{ace.mask.to_s(16)}, #{mode.to_s(8)}"
       end
     end
 
-    #puts "get_mode: #{mode.to_s(8)}"
+    # puts "get_mode: #{mode.to_s(8)}"
     mode
   end
 
@@ -337,13 +339,13 @@ module Puppet::Util::Windows::Security
         # If owner and group are both SYSTEM but group is unmanaged the control rights of system will be set to FullControl by
         # the unmanaged group, so there is no need for the warning
         if managing_owner && (!isownergroup || managing_group)
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.warning _("Setting control rights for %{path} owner SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_owner && isownergroup
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but group is not managed directly: SYSTEM user rights will be set to FullControl by group") % { path: path } }
         else
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the owner, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           owner_allow = FILE::FILE_ALL_ACCESS
         end
@@ -353,13 +355,13 @@ module Puppet::Util::Windows::Security
         # If owner and group are both SYSTEM but owner is unmanaged the control rights of system will be set to FullControl by
         # the unmanaged owner, so there is no need for the warning.
         if managing_group && (!isownergroup || managing_owner)
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.warning _("Setting control rights for %{path} group SYSTEM to less than Full Control rights. Setting SYSTEM rights to less than Full Control may have unintented consequences for operations on this file") % { path: path }
         elsif managing_group && isownergroup
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("%{path} owner and group both set to user SYSTEM, but owner is not managed directly: SYSTEM user rights will be set to FullControl by owner") % { path: path } }
         else
-          #TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
+          # TRANSLATORS 'SYSTEM' is a Windows name and should not be translated
           Puppet.debug { _("An attempt to set mode %{mode} on item %{path} would result in the group, SYSTEM, to have less than Full Control rights. This attempt has been corrected to Full Control") % { mode: mode.to_s(8), path: path } }
           group_allow = FILE::FILE_ALL_ACCESS
         end
@@ -424,7 +426,7 @@ module Puppet::Util::Windows::Security
     nil
   end
 
-  ACL_REVISION                   = 2
+  ACL_REVISION = 2
 
   def add_access_allowed_ace(acl, mask, sid, inherit = nil)
     inherit ||= NO_INHERITANCE
@@ -476,12 +478,11 @@ module Puppet::Util::Windows::Security
 
     0.upto(ace_count - 1) do |i|
       FFI::MemoryPointer.new(:pointer, 1) do |ace_ptr|
-
         next if GetAce(dacl_ptr, i, ace_ptr) == FFI::WIN32_FALSE
 
         # ACE structures vary depending on the type. We are only concerned with
         # ACCESS_ALLOWED_ACE and ACCESS_DENIED_ACEs, which have the same layout
-        ace = GENERIC_ACCESS_ACE.new(ace_ptr.get_pointer(0)) #deref LPVOID *
+        ace = GENERIC_ACCESS_ACE.new(ace_ptr.get_pointer(0)) # deref LPVOID *
 
         ace_type = ace[:Header][:AceType]
         if ace_type != Puppet::Util::Windows::AccessControlEntry::ACCESS_ALLOWED_ACE_TYPE &&
@@ -511,13 +512,13 @@ module Puppet::Util::Windows::Security
   # block with the opened file HANDLE.
   def open_file(path, access, &block)
     handle = CreateFileW(
-             wide_string(path),
-             access,
-             FILE::FILE_SHARE_READ | FILE::FILE_SHARE_WRITE,
-             FFI::Pointer::NULL, # security_attributes
-             FILE::OPEN_EXISTING,
-             FILE::FILE_FLAG_OPEN_REPARSE_POINT | FILE::FILE_FLAG_BACKUP_SEMANTICS,
-             FFI::Pointer::NULL_HANDLE) # template
+      wide_string(path),
+      access,
+      FILE::FILE_SHARE_READ | FILE::FILE_SHARE_WRITE,
+      FFI::Pointer::NULL, # security_attributes
+      FILE::OPEN_EXISTING,
+      FILE::FILE_FLAG_OPEN_REPARSE_POINT | FILE::FILE_FLAG_BACKUP_SEMANTICS,
+      FFI::Pointer::NULL_HANDLE) # template
 
     if handle == Puppet::Util::Windows::File::INVALID_HANDLE_VALUE
       raise Puppet::Util::Windows::Error.new(_("Failed to open '%{path}'") % { path: path })
@@ -565,8 +566,8 @@ module Puppet::Util::Windows::Security
             # size is correct given we only have 1 LUID, otherwise would be:
             # [:PrivilegeCount].size + [:PrivilegeCount] * LUID_AND_ATTRIBUTES.size
             if AdjustTokenPrivileges(token, FFI::WIN32_FALSE,
-                token_privileges, token_privileges.size,
-                FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
+                                     token_privileges, token_privileges.size,
+                                     FFI::MemoryPointer::NULL, FFI::MemoryPointer::NULL) == FFI::WIN32_FALSE
               raise Puppet::Util::Windows::Error.new(_("Failed to adjust process privileges"))
             end
           end
@@ -587,7 +588,6 @@ module Puppet::Util::Windows::Security
           FFI::MemoryPointer.new(:pointer, 1) do |group_sid_ptr_ptr|
             FFI::MemoryPointer.new(:pointer, 1) do |dacl_ptr_ptr|
               FFI::MemoryPointer.new(:pointer, 1) do |sd_ptr_ptr|
-
                 rv = GetSecurityInfo(
                   handle,
                   :SE_FILE_OBJECT,
@@ -595,8 +595,8 @@ module Puppet::Util::Windows::Security
                   owner_sid_ptr_ptr,
                   group_sid_ptr_ptr,
                   dacl_ptr_ptr,
-                  FFI::Pointer::NULL, #sacl
-                  sd_ptr_ptr) #sec desc
+                  FFI::Pointer::NULL, # sacl
+                  sd_ptr_ptr) # sec desc
                 raise Puppet::Util::Windows::Error.new(_("Failed to get security information")) if rv != FFI::ERROR_SUCCESS
 
                 # these 2 convenience params are not freed since they point inside sd_ptr
@@ -606,7 +606,6 @@ module Puppet::Util::Windows::Security
                 FFI::MemoryPointer.new(:word, 1) do |control|
                   FFI::MemoryPointer.new(:dword, 1) do |revision|
                     sd_ptr_ptr.read_win32_local_pointer do |sd_ptr|
-
                       if GetSecurityDescriptorControl(sd_ptr, control, revision) == FFI::WIN32_FALSE
                         raise Puppet::Util::Windows::Error.new(_("Failed to get security descriptor control"))
                       end
@@ -656,10 +655,10 @@ module Puppet::Util::Windows::Security
                 sd.dacl.each do |ace|
                   case ace.type
                   when Puppet::Util::Windows::AccessControlEntry::ACCESS_ALLOWED_ACE_TYPE
-                    #puts "ace: allow, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                    # puts "ace: allow, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
                     add_access_allowed_ace(acl_ptr, ace.mask, ace.sid, ace.flags)
                   when Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
-                    #puts "ace: deny, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
+                    # puts "ace: deny, sid #{Puppet::Util::Windows::SID.sid_to_name(ace.sid)}, mask 0x#{ace.mask.to_s(16)}"
                     add_access_denied_ace(acl_ptr, ace.mask, ace.sid, ace.flags)
                   else
                     raise "We should never get here"
@@ -704,7 +703,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :kernel32
   attach_function_private :CreateFileW,
-    [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
+                          [:lpcwstr, :dword, :dword, :pointer, :dword, :dword, :handle], :handle
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx
   # BOOL WINAPI GetVolumeInformation(
@@ -719,7 +718,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :kernel32
   attach_function_private :GetVolumeInformationW,
-    [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
+                          [:lpcwstr, :lpwstr, :dword, :lpdword, :lpdword, :lpdword, :lpwstr, :dword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374951(v=vs.85).aspx
   # BOOL WINAPI AddAccessAllowedAceEx(
@@ -731,7 +730,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AddAccessAllowedAceEx,
-    [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx
   # BOOL WINAPI AddAccessDeniedAceEx(
@@ -743,7 +742,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AddAccessDeniedAceEx,
-    [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :dword, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa374931(v=vs.85).aspx
   # typedef struct _ACL {
@@ -813,7 +812,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetAce,
-    [:pointer, :dword, :pointer], :win32_bool
+                          [:pointer, :dword, :pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa375202(v=vs.85).aspx
   # BOOL WINAPI AdjustTokenPrivileges(
@@ -826,7 +825,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :AdjustTokenPrivileges,
-    [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
+                          [:handle, :win32_bool, :pointer, :dword, :pointer, :pdword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379561(v=vs.85).aspx
@@ -839,7 +838,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetSecurityDescriptorControl,
-    [:pointer, :lpword, :lpdword], :win32_bool
+                          [:pointer, :lpword, :lpdword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378853(v=vs.85).aspx
   # BOOL WINAPI InitializeAcl(
@@ -849,7 +848,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :InitializeAcl,
-    [:pointer, :dword, :dword], :win32_bool
+                          [:pointer, :dword, :dword], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379142(v=vs.85).aspx
   # BOOL WINAPI IsValidAcl(
@@ -857,7 +856,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :IsValidAcl,
-    [:pointer], :win32_bool
+                          [:pointer], :win32_bool
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379593(v=vs.85).aspx
   SE_OBJECT_TYPE = enum(
@@ -889,7 +888,7 @@ module Puppet::Util::Windows::Security
   # );
   ffi_lib :advapi32
   attach_function_private :GetSecurityInfo,
-    [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
+                          [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer, :pointer], :dword
 
   # https://msdn.microsoft.com/en-us/library/windows/desktop/aa379588(v=vs.85).aspx
   # DWORD WINAPI SetSecurityInfo(
@@ -904,5 +903,5 @@ module Puppet::Util::Windows::Security
   ffi_lib :advapi32
   # TODO: SECURITY_INFORMATION is actually a bitmask the size of a DWORD
   attach_function_private :SetSecurityInfo,
-    [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer], :dword
+                          [:handle, SE_OBJECT_TYPE, :dword, :pointer, :pointer, :pointer, :pointer], :dword
 end

data/lib/puppet/util/windows/security_descriptor.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Windows Security Descriptor
 #
 # Represents a security descriptor that can be applied to any Windows securable