Skip to content

Commit 10ea353

Browse files
silugsilug
authored
Remove calls to deprecated parameters (#198)
* Remove calls to deprecated parameters On Puppet 8, [strict](https://www.puppet.com/docs/puppet/8/configuration.html#strict) is set to `error` by default. This causes [`deprecation()`](https://forge.puppet.com/modules/puppetlabs/stdlib/reference#deprecation) to fail and output an error message. This change avoids the calls to deprecated parameters where possible and checks the value of `strict` in tests where the deprecated parameters are used intentionally.
1 parent 82bc3ae commit 10ea353

File tree

5 files changed

+121
-60
lines changed

5 files changed

+121
-60
lines changed

‎CHANGELOG‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
* Mon Jul 08 2024 Steven Pritchard <steve@sicura.us> - 8.14.2
2+
- Remove calls to deprecated parameters (for Puppet 8 compatibility)
3+
14
* Wed Jul 03 2024 Steven Pritchard <steve@sicura.us> - 8.14.1
25
- Clean up legacy fact usage for Puppet 8 compatibility
36

‎SIMP/compliance_profiles/checks.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ checks:
211211
- audit_rules_dac_modification_lchown
212212
oval:com.puppet.forge.simp.auditd.config.audit_profiles.simp.audit_grub:
213213
settings:
214-
parameter: auditd::config::audit_profiles::simp::audit_grub
214+
parameter: auditd::config::audit_profiles::simp::audit_cfg_grub
215215
value: true
216216
type: puppet-class-parameter
217217
controls:
@@ -332,7 +332,7 @@ checks:
332332
- AU-2
333333
oval:com.puppet.forge.simp.auditd.config.audit_profiles.simp.audit_sudoers:
334334
settings:
335-
parameter: auditd::config::audit_profiles::simp::audit_sudoers
335+
parameter: auditd::config::audit_profiles::simp::audit_cfg_sudoers
336336
value: true
337337
type: puppet-class-parameter
338338
controls:
@@ -387,7 +387,7 @@ checks:
387387
- AU-2
388388
oval:com.puppet.forge.simp.auditd.config.audit_profiles.simp.audit_yum:
389389
settings:
390-
parameter: auditd::config::audit_profiles::simp::audit_yum
390+
parameter: auditd::config::audit_profiles::simp::audit_cfg_yum
391391
value: true
392392
type: puppet-class-parameter
393393
controls:

‎metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "simp-auditd",
3-
"version": "8.14.1",
3+
"version": "8.14.2",
44
"author": "SIMP Team",
55
"summary": "A SIMP puppet module for managing auditd and audispd",
66
"license": "Apache-2.0",

‎spec/classes/config/audit_profiles/simp_spec.rb‎

Lines changed: 82 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -387,88 +387,128 @@
387387
context 'with deprecated parameters' do
388388
context 'disable audit_cfg_sudoers using deprecated audit_sudoers' do
389389
let(:hieradata) { 'simp_audit_profile/disable__audit_sudoers' }
390+
390391
[
391392
%r{^-w /etc/sudoers -p wa -k CFG_sys$},
392393
%r{^-w /etc/sudoers.d/ -p wa -k CFG_sys$},
393394
].each do |command_regex|
394-
it {
395-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
396-
with_content(command_regex)
397-
}
395+
it do
396+
if Puppet[:strict] == :error
397+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_sudoers' is deprecated\.})
398+
else
399+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
400+
with_content(command_regex)
401+
end
402+
end
398403
end
399404
end
400405

401406
context 'set audit_cfg_sudoers rule key using deprecated audit_sudoers_tag' do
402407
let(:hieradata) { 'simp_audit_profile/set__audit_sudoers_tag' }
408+
403409
[
404410
%r{^-w /etc/sudoers -p wa -k old_sudoers_tag$},
405411
%r{^-w /etc/sudoers.d/ -p wa -k old_sudoers_tag$},
406412
].each do |command_regex|
407-
it {
408-
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
409-
with_content(command_regex)
410-
}
413+
it do
414+
if Puppet[:strict] == :error
415+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_sudoers_tag' is deprecated\.})
416+
else
417+
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
418+
with_content(command_regex)
419+
end
420+
end
411421
end
412422

413423
[
414424
%r{^-w /etc/sudoers -p wa -k CFG_sys$},
415425
%r{^-w /etc/sudoers.d/ -p wa -k CFG_sys$},
416426
].each do |command_regex|
417-
it {
418-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
419-
with_content(command_regex)
420-
}
427+
it do
428+
if Puppet[:strict] == :error
429+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_sudoers_tag' is deprecated\.})
430+
else
431+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').
432+
with_content(command_regex)
433+
end
434+
end
421435
end
422436
end
423437

424438
context 'disable audit_cfg_grub using deprecated audit_grub' do
425439
let(:hieradata) { 'simp_audit_profile/disable__audit_grub' }
426-
it {
427-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
428-
%r{^.* -k CFG_grub$}
429-
)
430-
}
440+
441+
it do
442+
if Puppet[:strict] == :error
443+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_grub' is deprecated\.})
444+
else
445+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
446+
%r{^.* -k CFG_grub$}
447+
)
448+
end
449+
end
431450
end
432451

433452
context 'set audit_cfg_grub rule key using deprecated audit_grub_tag' do
434453
let(:hieradata) { 'simp_audit_profile/set__audit_grub_tag' }
435454

436-
it {
437-
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
438-
%r{^.*grub.(d|conf).* -k old_grub_tag$}
439-
)
440-
}
455+
it do
456+
if Puppet[:strict] == :error
457+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_grub_tag' is deprecated\.})
458+
else
459+
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
460+
%r{^.*grub.(d|conf).* -k old_grub_tag$}
461+
)
462+
end
463+
end
441464

442-
it {
443-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
444-
%r{^.* -k CFG_grub$}
445-
)
446-
}
465+
it do
466+
if Puppet[:strict] == :error
467+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_grub_tag' is deprecated\.})
468+
else
469+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
470+
%r{^.* -k CFG_grub$}
471+
)
472+
end
473+
end
447474
end
448475

449476
context 'disable audit_cfg_yum using deprecated audit_yum' do
450477
let(:hieradata) { 'simp_audit_profile/disable__audit_yum' }
451-
it {
452-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
453-
%r{^.* -k yum_config$}
454-
)
455-
}
478+
479+
it do
480+
if Puppet[:strict] == :error
481+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_yum' is deprecated\.})
482+
else
483+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
484+
%r{^.* -k yum_config$}
485+
)
486+
end
487+
end
456488
end
457489

458490
context 'set audit_cfg_yum rule key using deprecated audit_yum_tag' do
459491
let(:hieradata) { 'simp_audit_profile/set__audit_yum_tag' }
460492

461-
it {
462-
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
463-
%r{^.*/etc/yum.* -k old_yum_tag$}
464-
)
465-
}
493+
it do
494+
if Puppet[:strict] == :error
495+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_yum_tag' is deprecated\.})
496+
else
497+
is_expected.to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
498+
%r{^.*/etc/yum.* -k old_yum_tag$}
499+
)
500+
end
501+
end
466502

467-
it {
468-
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
469-
%r{^.* -k yum_config$}
470-
)
471-
}
503+
it do
504+
if Puppet[:strict] == :error
505+
is_expected.to compile.and_raise_error(%r{'auditd::config::audit_profiles::simp::audit_yum_tag' is deprecated\.})
506+
else
507+
is_expected.not_to contain_file('/etc/audit/rules.d/50_00_simp_base.rules').with_content(
508+
%r{^.* -k yum_config$}
509+
)
510+
end
511+
end
472512
end
473513
end
474514
end

‎spec/classes/config_spec.rb‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -149,26 +149,44 @@
149149

150150
context 'with deprecated parameters' do
151151
context 'with default_audit_profile = true' do
152-
let(:params) {{ :default_audit_profile => true }}
153-
154-
it { is_expected.to contain_class('auditd::config::audit_profiles') }
155-
it { is_expected.to contain_class('auditd::config::audit_profiles::simp') }
152+
let(:params) {{ default_audit_profile: true }}
153+
154+
it do
155+
if Puppet[:strict] == :error
156+
is_expected.to compile.and_raise_error(%r{'auditd::default_audit_profile' is deprecated\.})
157+
else
158+
is_expected.to contain_class('auditd::config::audit_profiles')
159+
is_expected.to contain_class('auditd::config::audit_profiles::simp')
160+
end
161+
end
156162
end
157163

158164
context 'with default_audit_profile = false' do
159-
let(:params) {{ :default_audit_profile => false }}
160-
161-
it { is_expected.to compile.with_all_deps }
162-
it { is_expected.to_not contain_class('auditd::config::audit_profiles') }
163-
it { is_expected.to_not contain_class('auditd::config::audit_profiles::simp') }
165+
let(:params) {{ default_audit_profile: false }}
166+
167+
it do
168+
if Puppet[:strict] == :error
169+
is_expected.to compile.and_raise_error(%r{'auditd::default_audit_profile' is deprecated\.})
170+
else
171+
is_expected.to compile.with_all_deps
172+
is_expected.not_to contain_class('auditd::config::audit_profiles')
173+
is_expected.not_to contain_class('auditd::config::audit_profiles::simp')
174+
end
175+
end
164176
end
165-
end
166177

167-
context "with default_audit_profile = 'simp'" do
168-
let(:params) {{ :default_audit_profile => 'simp' }}
178+
context "with default_audit_profile = 'simp'" do
179+
let(:params) {{ default_audit_profile: 'simp' }}
169180

170-
it { is_expected.to contain_class('auditd::config::audit_profiles') }
171-
it { is_expected.to contain_class('auditd::config::audit_profiles::simp') }
181+
it do
182+
if Puppet[:strict] == :error
183+
is_expected.to compile.and_raise_error(%r{'auditd::default_audit_profile' is deprecated\.})
184+
else
185+
is_expected.to contain_class('auditd::config::audit_profiles')
186+
is_expected.to contain_class('auditd::config::audit_profiles::simp')
187+
end
188+
end
189+
end
172190
end
173191

174192
context "with default_audit_profiles = 'built_in'" do

0 commit comments

Comments
 (0)