+++ /dev/null
-require 'set'
-require 'pathname'
-
-Puppet::Type.newtype(:posix_acl) do
- desc <<-EOT
- Ensures that a set of ACL permissions are applied to a given file
- or directory.
-
- Example:
-
- posix_acl { '/var/www/html':
- action => exact,
- permission => [
- 'user::rwx',
- 'group::r-x',
- 'mask::rwx',
- 'other::r--',
- 'default:user::rwx',
- 'default:user:www-data:r-x',
- 'default:group::r-x',
- 'default:mask::rwx',
- 'default:other::r--',
- ],
- provider => posixacl,
- recursive => true,
- }
-
- In this example, Puppet will ensure that the user and group
- permissions are set recursively on /var/www/html as well as add
- default permissions that will apply to new directories and files
- created under /var/www/html
-
- Setting an ACL can change a file's mode bits, so if the file is
- managed by a File resource, that resource needs to set the mode
- bits according to what the calculated mode bits will be, for
- example, the File resource for the ACL above should be:
-
- file { '/var/www/html':
- mode => 754,
- }
- EOT
-
- newparam(:action) do
- desc 'What do we do with this list of ACLs? Options are set, unset, exact, and purge'
- newvalues(:set, :unset, :exact, :purge)
- defaultto :set
- end
-
- newparam(:path) do
- desc 'The file or directory to which the ACL applies.'
- isnamevar
- validate do |value|
- path = Pathname.new(value)
- unless path.absolute?
- raise ArgumentError, "Path must be absolute: #{path}"
- end
- end
- end
-
- newparam(:recursemode) do
- desc "Should Puppet apply the ACL recursively with the -R option or
- apply it to individual files?
-
- lazy means -R option
- deep means apply to every file"
-
- newvalues(:lazy, :deep)
- defaultto :lazy
- end
-
- # Credits to @itdoesntwork
- # http://stackoverflow.com/questions/26878341/how-do-i-tell-if-one-path-is-an-ancestor-of-another
- def self.descendant?(a, b)
- a_list = File.expand_path(a).split('/')
- b_list = File.expand_path(b).split('/')
-
- b_list[0..a_list.size - 1] == a_list && b_list != a_list
- end
-
- # Snippet based on upstream Puppet (ASL 2.0)
- [:posix_acl, :file].each do |autorequire_type|
- autorequire(autorequire_type) do
- req = []
- path = Pathname.new(self[:path])
- # rubocop:disable Style/MultilineBlockChain
- if autorequire_type != :posix_acl
- if self[:recursive] == :true
- catalog.resources.select do |r|
- r.is_a?(Puppet::Type.type(autorequire_type)) && self.class.descendant?(self[:path], r[:path])
- end.each do |found|
- req << found[:path]
- end
- end
- req << self[:path]
- end
- unless path.root?
- # Start at our parent, to avoid autorequiring ourself
- parents = path.parent.enum_for(:ascend)
- # should this be = or == ? I don't know
- if found = parents.find { |p| catalog.resource(autorequire_type, p.to_s) } # rubocop:disable Lint/AssignmentInCondition
- req << found.to_s
- end
- end
- req
- end
- # rubocop:enable Style/MultilineBlockChain
- end
- # End of Snippet
-
- autorequire(:package) do
- ['acl']
- end
-
- newproperty(:permission, array_matching: :all) do
- desc 'ACL permission(s).'
-
- def is_to_s(value) # rubocop:disable Style/PredicateName
- if value == :absent || value.include?(:absent)
- super
- else
- value.sort.inspect
- end
- end
-
- def should_to_s(value)
- if value == :absent || value.include?(:absent)
- super
- else
- value.sort.inspect
- end
- end
-
- def retrieve
- provider.permission
- end
-
- # Remove permission bits from an ACL line, eg:
- # 'user:root:rwx' becomes 'user:root:'
- def strip_perms(pl)
- Puppet.debug 'permission.strip_perms'
- value = []
- pl.each do |perm|
- unless perm =~ %r{^(((u(ser)?)|(g(roup)?)|(m(ask)?)|(o(ther)?)):):}
- perm = perm.split(':', -1)[0..-2].join(':')
- value << perm
- end
- end
- value.sort
- end
-
- # in unset_insync and set_insync the test_should has been added as a work around
- # to prevent puppet-posix_acl from interpreting recursive permission notation (e.g. rwX)
- # from causing a false mismatch. A better solution needs to be implemented to
- # recursively check permissions, not rely upon getfacl
- def unset_insync(cur_perm)
- # Puppet.debug "permission.unset_insync"
- test_should = []
- @should.each { |x| test_should << x.downcase }
- cp = strip_perms(cur_perm)
- sp = strip_perms(test_should)
- (sp - cp).sort == sp
- end
-
- def set_insync(cur_perm) # rubocop:disable Style/AccessorMethodName
- should = @should.uniq.sort
- (cur_perm.sort == should) || (provider.check_set && (should - cur_perm).empty?)
- end
-
- def purge_insync(cur_perm)
- # Puppet.debug "permission.purge_insync"
- cur_perm.each do |perm|
- # If anything other than the mode bits are set, we're not in sync
- return false unless perm =~ %r{^(((u(ser)?)|(g(roup)?)|(o(ther)?)):):}
- end
- true
- end
-
- def insync?(is)
- Puppet.debug "permission.insync? is: #{is.inspect} @should: #{@should.inspect}"
- return purge_insync(is) if provider.check_purge
- return unset_insync(is) if provider.check_unset
- set_insync(is)
- end
-
- # Munge into normalised form
- munge do |acl|
- r = ''
- a = acl.split ':', -1 # -1 keeps trailing empty fields.
- raise ArgumentError, "Too few fields. At least 3 required, got #{a.length}." if a.length < 3
- raise ArgumentError, "Too many fields. At most 4 allowed, got #{a.length}." if a.length > 4
- if a.length == 4
- d = a.shift
- raise ArgumentError, %(First field of 4 must be "d" or "default", got "#{d}".) unless %w[d default].include?(d)
- r << 'default:'
- end
- t = a.shift # Copy the type.
- r << case t
- when 'u', 'user'
- 'user:'
- when 'g', 'group'
- 'group:'
- when 'o', 'other'
- 'other:'
- when 'm', 'mask'
- 'mask:'
- else
- raise ArgumentError, %(Unknown type "#{t}", expected "user", "group", "other" or "mask".)
- end
- r << "#{a.shift}:" # Copy the "who".
- p = a.shift
- if p =~ %r{[0-7]}
- p = p.oct
- r << (p | 4 ? 'r' : '-')
- r << (p | 2 ? 'w' : '-')
- r << (p | 1 ? 'x' : '-')
- else
- # Not the most efficient but checks for multiple and invalid chars.
- s = p.tr '-', ''
- r << (s.sub!('r', '') ? 'r' : '-')
- r << (s.sub!('w', '') ? 'w' : '-')
- r << (s.sub!('x', '') ? 'x' : '-')
- raise ArgumentError, %(Invalid permission set "#{p}".) unless s.empty?
- end
- r
- end
- end
-
- newparam(:recursive) do
- desc 'Apply ACLs recursively.'
- newvalues(:true, :false)
- defaultto :false
- end
-
- def self.pick_default_perms(acl)
- acl.reject { |a| a.split(':', -1).length == 4 }
- end
-
- def newchild(path)
- options = @original_parameters.merge(name: path).reject { |_param, value| value.nil? }
- unless File.directory?(options[:name])
- options[:permission] = self.class.pick_default_perms(options[:permission]) if options.include?(:permission)
- end
- [:recursive, :recursemode, :path].each do |param|
- options.delete(param) if options.include?(param)
- end
- self.class.new(options)
- end
-
- def generate
- return [] unless self[:recursive] == :true && self[:recursemode] == :deep
- results = []
- paths = Set.new
- if File.directory?(self[:path])
- Dir.chdir(self[:path]) do
- Dir['**/*'].each do |path|
- paths << ::File.join(self[:path], path)
- end
- end
- end
- # At the time we generate extra resources, all the files might now be present yet.
- # In prediction to that we also create ACL resources for child file resources that
- # might not have been applied yet.
- catalog.resources.select do |r|
- r.is_a?(Puppet::Type.type(:file)) && self.class.descendant?(self[:path], r[:path])
- end.each do |found| # rubocop:disable Style/MultilineBlockChain
- paths << found[:path]
- end
- paths.each do |path|
- results << newchild(path)
- end
- results
- end
-
- validate do
- unless self[:permission]
- raise(Puppet::Error, 'permission is a required property.')
- end
- end
-end
projects / mirror / dsa-puppet.git / blobdiff