Make SELinux internal helper functions private.

There are a handful of internal helper functions in the SELinux utility code,
dealing with finding the filesystem that a file resides on.  We may as well
make them private in the code.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#8714) Don't follow symlinks in SELinux FS detection

When detecting the filesystem that a target file lives on, we used to follow
symbolic links.  This is actually a problem - the SELinux change applies to
the link, not the target of the link.

This rewrites the code to handle this more cleanly, following the logical tree
up to locate the record in the set of mountpoints.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(maint) Confine pty-based test to non-Windows hosts.

Pty detection on Windows is broken in Ruby 1.8.7. This causes tests which use
a pty to freeze, locking up the test suite.

This patch works around the issue by not running the affected test on Windows
hosts.
RSpec 3 is deprecating `expect {}.should` - respect that.

This updates a handful of tests to use `expect {} .to` since the should
variant is being deprecated in RSpec 3 - and has started throwing
deprecation warnings.

There should be absolutely no functional change as a result of this.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Merge branch 'maint/2.7.x/rspec-fix-deprecation-expect-should' into 2.7.x
Merge pull request #1099 from daniel-pittman/bug/2.7.x/8714-better-symlink-handling-in-selinux-utils

Bug/2.7.x/8714 better symlink handling in selinux utils
Skip symbolic link demanding test on Windows

One of the SELinux tests I wrote creates a symbolic link, to ensure
correct behaviour.  Windows Ruby doesn't support symlinks, and so failed; this
test can simply be skipped on that platform.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Update copyright years in LICENSE

This brings the copyright years up to date, reflecting the set of years we
actually worked on the software.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#16347) Replace \x92 character with apostrophe

Previously, there was a non-ascii character in the comment, which caused
a warning when building rdoc during `gem install puppet` on ruby 1.9.3.
It is possible from a copy & paste from MS Word smart apostrophe.

This commit doesn't change any code, just the comment.

Paired-with: Andy Parker <andy@puppetlabs.com>
(#16347) Qualify references to windows-pr gem

Previously, running `gem install puppet` on ruby 1.9.3, would fail when
the Puppet::Util::Windows::Security and Puppet::Util::Windows::User
modules both included the Windows::Security module from the windows-pr
gem.

The failure occurs when rdoc attempts to generate documentation for
Puppet::Util::Windows::User, and gets into an infinite loop, eventually
causing a stack overflow.

This commit fully qualifies to windows-specific gems so that this
doesn't occur in the future.

Paired-with: Andy Parker <andy@puppetlabs.com>
Merge branch 'ticket/2.7.x/16347-gem-install' into 2.7.x

* ticket/2.7.x/16347-gem-install:
  (#16347) Qualify references to windows-pr gem
  (#16347) Replace \x92 character with apostrophe
Fixup apple package plist for use with packaging repo

With the packaging repo change to the non-flat package
format, the package info plist format changes to plist.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
(#16376) Fix rails compatibility layer for activerecord < 3.0

Previously an alias was attempted between scope and named_scope to allow older
activerecord versions (< 3.0) to work with the inventory service while also
supporting modern activerecord. The scope alias failed because
Puppet::Rails::InventoryNode inherits from ActiveRecord::Base, which has a
scope method already. So activerecord's scope method is found instead of the
intended alias target. This commit removes the alias and simply switches on
activerecord version to use the correct scope (AR >= 3.0) or named_scope (AR <
3.0) method.
Merge pull request #1135 from MosesMendoza/maint/2.7.x/fix_apple_pkg_info_plist

Fixup apple package plist for use with packaging repo
(#16330) Update ZAML to latest upstream.

This rebases our internal ZAML on the upstream 0.1.3 release, including the
update to dual-license the code.  It then merges back all our changes and
squashes them into place - which, in essence, means bumping the version
number; we already had all the other relevant changes in place.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Git ignore an .rvmrc file in the root of the project

Now that there is a Gemfile in the Puppet repository, RVM ignores an rvmrc in
the parent directory - because it assumes that the gemfile defines the full
scope of configuration required.

Since the gemfile is actually useless for the purpose, a project level rvmrc
file is needed to "win", and actually put local configuration in place.

Since things like that configuration are really per-developer, we should
ignore the file if present, though, so that we don't pollute everyone's
working space with our personal opinions on configuration.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#4680) Reject CA network operations when master CA is disabled

When the master has CA function explicitly disabled, it would still respond to
networked REST requests. They accessed the local certificate store and,
generally, provided quite unexpected results.

For example, if a CSR was submitted it would be accepted successfully and
ignored; no further action, despite the fact that the master would never do
anything with it, and it could not be acted on.

Now, instead, we explicitly fail for remote requests.  This delivers a clear,
unambiguous error message to the agent and stops them functioning - a much
better outcome overall.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Merge pull request #1156 from daniel-pittman/bug/2.7.x/4680-better-handling-of-csr-submission-problems

(#4680) Reject CA network operations when master CA is disabled
(#2888) Add settings catalog info to README_DEVELOPER

Without this patch the README_DEVELOPER doesn't mention the special
settings catalog which I overlooked while working on #2888.  If the
settings catalog was in mind while I worked on this issue I probably
would have solved it a lot faster than it took to track down.

In particular, wrapping the File.open method was an effective way to
quickly track down the codepath that was improperly writing and
truncating the lockfile.
(#2888) Fix race condition with puppetdlockfile

Without this patch applied there is a race condition where by two or
more concurrent puppet agent processes will eventually result in a
deadlock state where all processes consider catalog runs to be
administratively disabled.

This is a problem because the configuration catalog stops being applied
periodically.  The system will not recover unless there is manual
intervention by the end user.

The problem is caused by the settings catalog.  The settings catalog
will contain a file resource for the puppetdlockfile if the file exists.
When two processes are running, the file will exist when it is created
by the other process.  When the file resource is in the settings
catalog, it will be created as a zero length file, or truncated to a
zero length file if it already exists.

Here is the state transition for two puppet agent --test processes, A
and B.

    A:
    lock()
      File.exist? => false
      File.open()
      catalog.run
      ...

    B:
    Puppet::Util::Settings#to_catalog
      File.exist? => true
      catalog.add_resource(Puppet::Type::File)
      ...
      resource synchronizes
      Puppet::Type::File#write(:content)

    A:
    unlock()
      unlink()

    B:
    settings catalog apply
      File.open("puppetdlock", "wb") { ... } # Truncates the file!

    A:
    locked? => true
    mine? => false

    B:
    locked? => true
    mine? => false

    A and B are deadlocked.

This patch fixes the problem by marking the puppetdlockfile settings as
a `:type => :setting`.  This change prevents the settings catalog from
containing a file resource for the puppetdlockfile setting.

Paired-with: Josh Cooper <josh@puppetlabs.com>