(#14333) Ensure module permissions are sane.

Prior to this change, tarballs unpacked by the root user would be unpacked
with the permissions and the ownership information present in the tarball.
In the best case, this made some modules fail to function after installation
since the newly installed module was owned by a different user. In the worst
case, this could be seen as a fairly serious security vulnerability.

This change ensures that the module's permissions are always owner-writable,
world-readable, and that the owner is always the same as the module's parent
directory.
Backporting acceptance tests.
Merge pull request #1815 from pvande/PF-166-2.7.x

(#14333) Ensure module permissions are sane – 2.7.x backport.
(Maint) Use dirname instead of regexes

A sequence of substitutions to strip off the trailing filename from a
path. This is actually just File.dirname in disguise.
(Maint) Clean up specs

The specs were distractingly bad. There was usage of instance variables
that were created in a loop, but caused the final value, which was used
by the tests, to not be what the author expected. This also pulls out
specific tests around how add() behaves in very important circumstances,
which the previous way of automatic test generation did not make clear.
(#21971) Check for possible directory traversal

The class name that is being looked for is translated to the directory
structure to search. In order to prevent directory traversal attacks we
need to make sure that the requested class name is valid and therefore
doesn't contain any directory traversal shortcuts.
(#21971) Split import and autoloading code paths

The codepaths for import and autoloading of manifest files were combined
at many levels, which made them share behaviors that were not wanted.
The import ability to load absolute paths leaked through into how
autoloading would try to find files for a particular class name, which
resulted in a possible vulnerability to injected class names (ENC
values, hiera data, etc). This splits those code paths to ensure that
the one used for autoloading only will ever look in modules that are
registered on the modulepath, while still allowing the import path to
look at absolute and relative file paths.
(#21971) Create system for safely dealing with path patterns

Correctly checking that a given string is safe to use for looking for
files on the filesystem is tricky. This adds a class called
Puppet::FileSystem::PathPattern that encapsulates a validated path
pattern free of defects such as directory traversal '..' entries and
zero byte delimeters. This is then used to protect finding manifest
files in modules.
(#21971) Fix how import_all loads files

The backport of changes had an incorrect import_all that called
load_files with a single string, when an array is expected. This mistake
would not be obvious since ruby 1.8 implements #each on String.
(#21971) Fixes PathPattern's usage of Dir.glob for Windows

Dir.glob seems to perform an impilicit to_s on what is passed.  Except
on Windows.  This change explicitly converts Pathname to a String, so we
don't have any surprises.
Merge branch 'security/2.7.22/21971-remote-execution-through-resource_type-backport' into release_2.7.23

* security/2.7.22/21971-remote-execution-through-resource_type-backport:
  (#21971) Fixes PathPattern's usage of Dir.glob for Windows
  (#21971) Fix how import_all loads files
  (#21971) Create system for safely dealing with path patterns
  (#21971) Split import and autoloading code paths
  (#21971) Add test for accessing based on master being at root
  (#21971) Check for possible directory traversal
  (Maint) Clean up specs
  (Maint) Use dirname instead of regexes
  (#21971) Create test to show exploit of resource_type
Fixing broken requires in the acceptance tests.

Three acceptance tests were improperly backported, and as such couldn't require some dependencies they had; this change fixes the requires and backports the
helpers.
(Maint) Confine module tool tests off of windows

The module tool on puppet 2.7 isn't supported on windows. The tests
shouldn't run there.
(#21971) Allow paths that contain .. as part of a name

The PathPattern code was incorrectly flagging paths like /tmp/foo..bar
as being directory traversals. This updates that to exclude those names
by checking each path component separately instead of looking at the
path as a whole.

In addition this fixes up the error reporting about these kinds of
errors in Puppet::Module by creating the absolute PathPattern for the
manifests directory of the module at initialization time, so that any
errors from it are not swallowed by the error handling for the relative
path searching of manifests.

This also removed some duplicate handling of init.pp and init.rb where
in the case of having no pattern to search for the init files were
returned twice and also seemed to be loaded twice. This does not remove
the behavior in which the init.pp and rb files are *always* returned
when they exist, because that seems to be explicit behavior added for
issue #4220.

Conflicts:
	lib/puppet/module.rb
	spec/unit/module_spec.rb

Had to move absolute path to manifests back into wanted_manifests_from
because module initializes with a path optionally.
Ensure that PMT uses the correct group membership.

Previously, modules installed by the root user would retain the
original group membership information.  This change ensures that the
group will match the module directory being installed to.
Improving testing around PMT module install permissions.

Previously, the tests simply asserted that certain files had correct permissions
and belonged to the appropriate users and groups.  This worked well enough in common
cases, but could also yield a number of false positives.  This change works to remove
a great deal of the ambiguity by specifically assigning an unusual group to the modules
directory, and by asserting the permissions for every file in the installed module.
(Maint) Update expectations for older rspec

These tests were backported from a commit that was for a newer version
of rspec. The older version of rspec used for this branch does not
support the expect().to syntax.
(Maint) Update test to reflect chown using the gid too

When the gid control code was backported, the spec tests were not
updated to reflect this. This changes the expectation to match the code.
(maint) Fix module_utils regex tests for module file perms

Corrects a few bugs in the assert_module_installed_on_disk method.

Also specifically rejects '..' files from the test, since moduledir
itself, as seen by "#{moduledir}/#{module_name}/..", may have
different permissions.

And finally tests 644 for any non-directory file, and allows for a non
space character following the symbolic mode list, because SELinux
(rhel6) may have a '.' rather than a space here.
(packaging) Update CHANGELOG, PUPPETVERSION for 2.7.23