Merge branch 'maint'

Conflicts:
	doc/appendix/guides/fedora.txt
	misc/bcfg2.spec
	schemas/types.xsd
	src/lib/Bcfg2/Encryption.py
	src/lib/Bcfg2/Options.py
	src/lib/Bcfg2/Server/Admin/Client.py
	src/lib/Bcfg2/Server/Core.py
	src/lib/Bcfg2/Server/Lint/Validate.py
	src/lib/Bcfg2/Server/Plugin/helpers.py
	src/lib/Bcfg2/Server/Plugins/Bundler.py
	src/lib/Bcfg2/Server/Plugins/Cfg/CfgEncryptedGenerator.py
	src/lib/Bcfg2/Server/Plugins/Probes.py
	src/sbin/bcfg2-crypt
	testsuite/Testsrc/Testlib/TestServer/TestPlugin/Testhelpers.py
	testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestCfg/TestCfgEncryptedGenerator.py
	testsuite/Testsrc/Testlib/TestServer/TestPlugins/TestProbes.py
	testsuite/common.py
	testsuite/install.sh

16 files changed, 560 insertions, 49 deletions

diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/Augeas.py b/src/lib/Bcfg2/Client/Tools/POSIX/Augeas.py
new file mode 100644
index 000000000..4f6953b2a
--- /dev/null
+++ b/src/lib/Bcfg2/Client/Tools/POSIX/Augeas.py
@@ -0,0 +1,284 @@
+""" Augeas driver """
+
+import sys
+import Bcfg2.Client.XML
+from augeas import Augeas
+from Bcfg2.Client.Tools.POSIX.base import POSIXTool
+
+
+class AugeasCommand(object):
+    """ Base class for all Augeas command objects """
+
+    def __init__(self, command, augeas_obj, logger):
+        self._augeas = augeas_obj
+        self.command = command
+        self.entry = self.command.getparent()
+        self.logger = logger
+
+    def get_path(self, attr="path"):
+        """ Get a fully qualified path from the name of the parent entry and
+        the path given in this command tag.
+
+        @param attr: The attribute to get the relative path from
+        @type attr: string
+        @returns: string - the fully qualified Augeas path
+
+        """
+        return "/files/%s/%s" % (self.entry.get("name").strip("/"),
+                                 self.command.get(attr).lstrip("/"))
+
+    def _exists(self, path):
+        """ Return True if a path exists in Augeas, False otherwise.
+
+        Note that a False return can mean many things: A file that
+        doesn't exist, a node within the file that doesn't exist, no
+        lens to parse the file, etc. """
+        return len(self._augeas.match(path)) > 1
+
+    def _verify_exists(self, path=None):
+        """ Verify that the given path exists, with friendly debug
+        logging.
+
+        @param path: The path to verify existence of.  Defaults to the
+                     result of
+                     :func:`Bcfg2.Client.Tools.POSIX.Augeas.AugeasCommand.getpath`.
+        @type path: string
+        @returns: bool - Whether or not the path exists
+        """
+        if path is None:
+            path = self.get_path()
+        self.logger.debug("Augeas: Verifying that '%s' exists" % path)
+        return self._exists(path)
+
+    def _verify_not_exists(self, path=None):
+        """ Verify that the given path does not exist, with friendly
+        debug logging.
+
+        @param path: The path to verify existence of.  Defaults to the
+                     result of
+                     :func:`Bcfg2.Client.Tools.POSIX.Augeas.AugeasCommand.getpath`.
+        @type path: string
+        @returns: bool - Whether or not the path does not exist.
+                  (I.e., True if it does not exist, False if it does
+                  exist.)
+        """
+        if path is None:
+            path = self.get_path()
+        self.logger.debug("Augeas: Verifying that '%s' does not exist" % path)
+        return not self._exists(path)
+
+    def _verify_set(self, expected, path=None):
+        """ Verify that the given path is set to the given value, with
+        friendly debug logging.
+
+        @param expected: The expected value of the node.
+        @param path: The path to verify existence of.  Defaults to the
+                     result of
+                     :func:`Bcfg2.Client.Tools.POSIX.Augeas.AugeasCommand.getpath`.
+        @type path: string
+        @returns: bool - Whether or not the path matches the expected value.
+
+        """
+        if path is None:
+            path = self.get_path()
+        self.logger.debug("Augeas: Verifying '%s' == '%s'" % (path, expected))
+        actual = self._augeas.get(path)
+        if actual == expected:
+            return True
+        else:
+            self.logger.debug("Augeas: '%s' failed verification: '%s' != '%s'"
+                              % (path, actual, expected))
+            return False
+
+    def __str__(self):
+        return Bcfg2.Client.XML.tostring(self.command)
+
+    def verify(self):
+        """ Verify that the command has been applied. """
+        raise NotImplementedError
+
+    def install(self):
+        """ Run the command. """
+        raise NotImplementedError
+
+
+class Remove(AugeasCommand):
+    """ Augeas ``rm`` command """
+    def verify(self):
+        return self._verify_not_exists()
+
+    def install(self):
+        self.logger.debug("Augeas: Removing %s" % self.get_path())
+        return self._augeas.remove(self.get_path())
+
+
+class Move(AugeasCommand):
+    """ Augeas ``move`` command """
+    def __init__(self, command, augeas_obj, logger):
+        AugeasCommand.__init__(self, command, augeas_obj, logger)
+        self.source = self.get_path("source")
+        self.dest = self.get_path("destination")
+
+    def verify(self):
+        return (self._verify_not_exists(self.source),
+                self._verify_exists(self.dest))
+
+    def install(self):
+        self.logger.debug("Augeas: Moving %s to %s" % (self.source, self.dest))
+        return self._augeas.move(self.source, self.dest)
+
+
+class Set(AugeasCommand):
+    """ Augeas ``set`` command """
+    def __init__(self, command, augeas_obj, logger):
+        AugeasCommand.__init__(self, command, augeas_obj, logger)
+        self.value = self.command.get("value")
+
+    def verify(self):
+        return self._verify_set(self.value)
+
+    def install(self):
+        self.logger.debug("Augeas: Setting %s to %s" % (self.get_path(),
+                                                        self.value))
+        return self._augeas.set(self.get_path(), self.value)
+
+
+class Clear(Set):
+    """ Augeas ``clear`` command """
+    def __init__(self, command, augeas_obj, logger):
+        Set.__init__(self, command, augeas_obj, logger)
+        self.value = None
+
+
+class SetMulti(AugeasCommand):
+    """ Augeas ``setm`` command """
+    def __init__(self, command, augeas_obj, logger):
+        AugeasCommand.__init__(self, command, augeas_obj, logger)
+        self.sub = self.command.get("sub")
+        self.value = self.command.get("value")
+        self.base = self.get_path("base")
+
+    def verify(self):
+        return all(self._verify_set(self.value,
+                                    path="%s/%s" % (path, self.sub))
+                   for path in self._augeas.match(self.base))
+
+    def install(self):
+        return self._augeas.setm(self.base, self.sub, self.value)
+
+
+class Insert(AugeasCommand):
+    """ Augeas ``ins`` command """
+    def __init__(self, command, augeas_obj, logger):
+        AugeasCommand.__init__(self, command, augeas_obj, logger)
+        self.label = self.command.get("label")
+        self.where = self.command.get("where", "before")
+        self.before = self.where == "before"
+
+    def verify(self):
+        return self._verify_exists("%s/../%s" % (self.get_path(), self.label))
+
+    def install(self):
+        self.logger.debug("Augeas: Inserting new %s %s %s" %
+                          (self.label, self.where, self.get_path()))
+        return self._augeas.insert(self.get_path(), self.label, self.before)
+
+
+class POSIXAugeas(POSIXTool):
+    """ Handle <Path type='augeas'...> entries.  See
+    :ref:`client-tools-augeas`. """
+
+    __handles__ = [('Path', 'augeas')]
+    __req__ = {'Path': ['type', 'name', 'setting', 'value']}
+
+    def __init__(self, config):
+        POSIXTool.__init__(self, config)
+        self._augeas = dict()
+
+    def get_augeas(self, entry):
+        """ Get an augeas object for the given entry. """
+        if entry.get("name") not in self._augeas:
+            aug = Augeas()
+            if entry.get("lens"):
+                self.logger.debug("Augeas: Adding %s to include path for %s" %
+                                  (entry.get("name"), entry.get("lens")))
+                incl = "/augeas/load/%s/incl" % entry.get("lens")
+                ilen = len(aug.match(incl))
+                if ilen == 0:
+                    self.logger.error("Augeas: Lens %s does not exist" %
+                                      entry.get("lens"))
+                else:
+                    aug.set("%s[%s]" % (incl, ilen + 1), entry.get("name"))
+                    aug.load()
+            self._augeas[entry.get("name")] = aug
+        return self._augeas[entry.get("name")]
+
+    def fully_specified(self, entry):
+        return entry.text is not None
+
+    def get_commands(self, entry, unverified=False):
+        """ Get a list of commands to verify or install.
+
+        @param entry: The entry to get commands from.
+        @type entry: lxml.etree._Element
+        @param unverified: Only get commands that failed verification.
+        @type unverified: bool
+        @returns: list of
+                  :class:`Bcfg2.Client.Tools.POSIX.Augeas.AugeasCommand`
+                  objects representing the commands.
+        """
+        rv = []
+        for cmd in entry.iterchildren():
+            if unverified and cmd.get("verified", "false") != "false":
+                continue
+            if cmd.tag in globals():
+                rv.append(globals()[cmd.tag](cmd, self.get_augeas(entry),
+                                             self.logger))
+            else:
+                err = "Augeas: Unknown command %s in %s" % (cmd.tag,
+                                                            entry.get("name"))
+                self.logger.error(err)
+                entry.set('qtext', "\n".join([entry.get('qtext', ''), err]))
+        return rv
+
+    def verify(self, entry, modlist):
+        rv = True
+        for cmd in self.get_commands(entry):
+            try:
+                if not cmd.verify():
+                    err = "Augeas: Command has not been applied to %s: %s" % \
+                          (entry.get("name"), cmd)
+                    self.logger.debug(err)
+                    entry.set('qtext', "\n".join([entry.get('qtext', ''),
+                                                  err]))
+                    rv = False
+                    cmd.command.set("verified", "false")
+                else:
+                    cmd.command.set("verified", "true")
+            except:  # pylint: disable=W0702
+                err = "Augeas: Unexpected error verifying %s: %s: %s" % \
+                      (entry.get("name"), cmd, sys.exc_info()[1])
+                self.logger.error(err)
+                entry.set('qtext', "\n".join([entry.get('qtext', ''), err]))
+                rv = False
+                cmd.command.set("verified", "false")
+        return POSIXTool.verify(self, entry, modlist) and rv
+
+    def install(self, entry):
+        rv = True
+        for cmd in self.get_commands(entry, unverified=True):
+            try:
+                cmd.install()
+            except:  # pylint: disable=W0702
+                self.logger.error(
+                    "Failure running Augeas command on %s: %s: %s" %
+                    (entry.get("name"), cmd, sys.exc_info()[1]))
+                rv = False
+        try:
+            self.get_augeas(entry).save()
+        except:  # pylint: disable=W0702
+            self.logger.error(
+                "Failure saving Augeas changes to %s: %s" %
+                (entry.get("name"), sys.exc_info()[1]))
+            rv = False
+        return POSIXTool.install(self, entry) and rv
diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
index 13b45a759..c27c7559d 100644
--- a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
+++ b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
@@ -58,8 +58,11 @@ class POSIX(Bcfg2.Client.Tools.Tool):
             mname = submodule[1].rsplit('.', 1)[-1]
             if mname == 'base':
                 continue
-            module = getattr(__import__(submodule[1]).Client.Tools.POSIX,
-                             mname)
+            try:
+                module = getattr(__import__(submodule[1]).Client.Tools.POSIX,
+                                 mname)
+            except ImportError:
+                continue
             hdlr = getattr(module, "POSIX" + mname)
             if POSIXTool in hdlr.__mro__:
                 # figure out what entry type this handler handles
diff --git a/src/lib/Bcfg2/DBSettings.py b/src/lib/Bcfg2/DBSettings.py
index 24835a3e8..cd5183a45 100644
--- a/src/lib/Bcfg2/DBSettings.py
+++ b/src/lib/Bcfg2/DBSettings.py
@@ -148,7 +148,7 @@ class _OptionContainer(object):
             cf=('database', 'port'), help='Database port', dest='db_port'),
         Bcfg2.Options.Option(
             cf=('database', 'schema'), help='Database schema',
-            dest='db_schema'),
+            dest='db_schema', default='public'),
         Bcfg2.Options.Option(
             cf=('database', 'options'), help='Database options',
             dest='db_opts', type=Bcfg2.Options.Types.comma_dict,
diff --git a/src/lib/Bcfg2/Options/Types.py b/src/lib/Bcfg2/Options/Types.py
index 2f0fd7d52..d11e54fba 100644
--- a/src/lib/Bcfg2/Options/Types.py
+++ b/src/lib/Bcfg2/Options/Types.py
@@ -50,6 +50,15 @@ def comma_dict(value):
     return result
 
 
+def anchored_regex_list(value):
+    """ Split an option string on whitespace and compile each element as
+    an anchored regex """
+    try:
+        return [re.compile('^' + x + '$') for x in re.split(r'\s+', value)]
+    except re.error:
+        raise ValueError("Not a list of regexes", value)
+
+
 def octal(value):
     """ Given an octal string, get an integer representation. """
     return int(value, 8)
diff --git a/src/lib/Bcfg2/Reporting/Compat.py b/src/lib/Bcfg2/Reporting/Compat.py
index 57261970d..9113fdb91 100644
--- a/src/lib/Bcfg2/Reporting/Compat.py
+++ b/src/lib/Bcfg2/Reporting/Compat.py
@@ -10,9 +10,7 @@ if VERSION[0] == 1 and VERSION[1] < 6:
 
 try:
     # Django < 1.6
-    from django.conf.urls import defaults
-    django_urls = defaults
+    from django.conf.urls.defaults import url, patterns
 except ImportError:
     # Django > 1.6
-    from django.conf import urls
-    django_urls = urls
+    from django.conf.urls import url, patterns
diff --git a/src/lib/Bcfg2/Reporting/urls.py b/src/lib/Bcfg2/Reporting/urls.py
index a9e5690be..3a40cb932 100644
--- a/src/lib/Bcfg2/Reporting/urls.py
+++ b/src/lib/Bcfg2/Reporting/urls.py
@@ -1,4 +1,4 @@
-from Bcfg2.Reporting.Compat.django_urls import *
+from Bcfg2.Reporting.Compat import url, patterns  # django compat imports
 from django.core.urlresolvers import reverse, NoReverseMatch
 from django.http import HttpResponsePermanentRedirect
 from Bcfg2.Reporting.utils import filteredUrls, paginatedUrls, timeviewUrls
diff --git a/src/lib/Bcfg2/Reporting/utils.py b/src/lib/Bcfg2/Reporting/utils.py
index d9b8213b1..0d394fcd8 100755
--- a/src/lib/Bcfg2/Reporting/utils.py
+++ b/src/lib/Bcfg2/Reporting/utils.py
@@ -1,5 +1,4 @@
 """Helper functions for reports"""
-from Bcfg2.Reporting.Compat.django_urls import *
 import re
 
 """List of filters provided by filteredUrls"""
diff --git a/src/lib/Bcfg2/Server/Admin.py b/src/lib/Bcfg2/Server/Admin.py
index 207106596..27152b867 100644
--- a/src/lib/Bcfg2/Server/Admin.py
+++ b/src/lib/Bcfg2/Server/Admin.py
@@ -173,15 +173,33 @@ class Backup(AdminCmd):
 
 
 class Client(_ServerAdminCmd):
-    """ Create, delete, or list client entries """
+    """ Create, modify, delete, or list client entries """
 
+    __plugin_whitelist__ = ["Metadata"]
     options = _ServerAdminCmd.options + [
         Bcfg2.Options.PositionalArgument(
             "mode",
-            choices=["add", "del", "list"]),
-        Bcfg2.Options.PositionalArgument("hostname", nargs='?')]
-
-    __plugin_whitelist__ = ["Metadata"]
+            choices=["add", "del", "delete", "remove", "rm", "up", "update",
+                     "list"]),
+        Bcfg2.Options.PositionalArgument("hostname", nargs='?'),
+        Bcfg2.Options.PositionalArgument("attributes", metavar="KEY=VALUE",
+                                         nargs='*')]
+
+    valid_attribs = ['profile', 'uuid', 'password', 'floating', 'secure',
+                     'address', 'auth']
+
+    def get_attribs(self, setup):
+        """ Get attributes for adding or updating a client from the command
+        line """
+        attr_d = {}
+        for i in setup.attributes:
+            attr, val = i.split('=', 1)
+            if attr not in self.valid_attribs:
+                print("Attribute %s unknown. Valid attributes: %s" %
+                      (attr, self.valid_attribs))
+                raise SystemExit(1)
+            attr_d[attr] = val
+        return attr_d
 
     def run(self, setup):
         if setup.mode != 'list' and not setup.hostname:
@@ -189,23 +207,32 @@ class Client(_ServerAdminCmd):
         elif setup.mode == 'list' and setup.hostname:
             self.logger.warning("<hostname> is not honored in list mode")
 
-        if setup.mode == 'add':
-            try:
-                self.metadata.add_client(setup.hostname)
-            except MetadataConsistencyError:
-                err = sys.exc_info()[1]
-                self.errExit("Error adding client %s: %s" % (setup.hostname,
-                                                             err))
-        elif setup.mode == 'del':
+        if setup.mode == 'list':
+            for client in self.metadata.list_clients():
+                print(client)
+        else:
+            include_attribs = True
+            if setup.mode == 'add':
+                func = self.metadata.add_client
+                action = "adding"
+            elif setup.mode in ['up', 'update']:
+                func = self.metadata.update_client
+                action = "updating"
+            elif setup.mode in ['del', 'delete', 'rm', 'remove']:
+                func = self.metadata.remove_client
+                include_attribs = False
+                action = "deleting"
+
+            if include_attribs:
+                args = (setup.hostname, self.get_attribs(setup))
+            else:
+                args = (setup.hostname,)
             try:
-                self.metadata.remove_client(setup.hostname)
+                func(*args)
             except MetadataConsistencyError:
                 err = sys.exc_info()[1]
-                self.errExit("Error deleting client %s: %s" % (setup.hostname,
-                                                               err))
-        elif setup.mode == 'list':
-            for client in self.metadata.list_clients():
-                print(client)
+                self.errExit("Error %s client %s: %s" % (setup.hostname,
+                                                         action, err))
 
 
 class Compare(AdminCmd):
diff --git a/src/lib/Bcfg2/Server/Core.py b/src/lib/Bcfg2/Server/Core.py
index 398053374..23209448d 100644
--- a/src/lib/Bcfg2/Server/Core.py
+++ b/src/lib/Bcfg2/Server/Core.py
@@ -240,12 +240,12 @@ class Core(object):
                                         verbosity=0)
                 self._database_available = True
             except ImproperlyConfigured:
-                err = sys.exc_info()[1]
-                self.logger.error("Django configuration problem: %s" % err)
+                self.logger.error("Django configuration problem: %s" %
+                                  sys.exc_info()[1])
             except:
-                err = sys.exc_info()[1]
                 self.logger.error("Updating database %s failed: %s" %
-                                  (Bcfg2.Options.setup.db_name, err))
+                                  (Bcfg2.Options.setup.db_name,
+                                   sys.exc_info()[1]))
 
     def __str__(self):
         return self.__class__.__name__
diff --git a/src/lib/Bcfg2/Server/Encryption.py b/src/lib/Bcfg2/Server/Encryption.py
index f8b602d90..c96e7ad21 100755
--- a/src/lib/Bcfg2/Server/Encryption.py
+++ b/src/lib/Bcfg2/Server/Encryption.py
@@ -233,6 +233,10 @@ class DecryptError(Exception):
     """ Exception raised when decryption fails. """
 
 
+class EncryptError(Exception):
+    """ Exception raised when encryption fails. """
+
+
 class CryptoTool(object):
     """ Generic decryption/encryption interface base object """
 
@@ -428,8 +432,7 @@ class PropertiesEncryptor(Encryptor, PropertiesCryptoMixin):
             try:
                 pname, passphrase = self._get_element_passphrase(elt)
             except PassphraseError:
-                self.logger.error(str(sys.exc_info()[1]))
-                return False
+                raise EncryptError(str(sys.exc_info()[1]))
             self.logger.debug("Encrypting %s" % print_xml(elt))
             elt.text = ssl_encrypt(elt.text, passphrase).strip()
             elt.set("encrypted", pname)
@@ -640,9 +643,9 @@ class CLI(object):
             if data is None:
                 try:
                     data = getattr(tool, mode)()
-                except DecryptError:
-                    self.logger.error("Failed to %s %s, skipping" % (mode,
-                                                                     fname))
+                except (EncryptError, DecryptError):
+                    self.logger.error("Failed to %s %s, skipping: %s" %
+                                      (mode, fname, sys.exc_info()[1]))
                     continue
             if Bcfg2.Options.setup.stdout:
                 if len(Bcfg2.Options.setup.files) > 1:
diff --git a/src/lib/Bcfg2/Server/Lint/TemplateAbuse.py b/src/lib/Bcfg2/Server/Lint/TemplateAbuse.py
new file mode 100644
index 000000000..202a1487d
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Lint/TemplateAbuse.py
@@ -0,0 +1,76 @@
+""" Check for templated scripts or executables. """
+
+import os
+import stat
+import Bcfg2.Server.Lint
+from Bcfg2.Compat import any  # pylint: disable=W0622
+from Bcfg2.Server.Plugin import default_path_metadata
+from Bcfg2.Server.Plugins.Cfg.CfgInfoXML import CfgInfoXML
+from Bcfg2.Server.Plugins.Cfg.CfgGenshiGenerator import CfgGenshiGenerator
+from Bcfg2.Server.Plugins.Cfg.CfgCheetahGenerator import CfgCheetahGenerator
+from Bcfg2.Server.Plugins.Cfg.CfgEncryptedGenshiGenerator import \
+    CfgEncryptedGenshiGenerator
+from Bcfg2.Server.Plugins.Cfg.CfgEncryptedCheetahGenerator import \
+    CfgEncryptedCheetahGenerator
+
+
+class TemplateAbuse(Bcfg2.Server.Lint.ServerPlugin):
+    """ Check for templated scripts or executables. """
+    templates = [CfgGenshiGenerator, CfgCheetahGenerator,
+                 CfgEncryptedGenshiGenerator, CfgEncryptedCheetahGenerator]
+    extensions = [".pl", ".py", ".sh", ".rb"]
+
+    def Run(self):
+        if 'Cfg' in self.core.plugins:
+            for entryset in self.core.plugins['Cfg'].entries.values():
+                for entry in entryset.entries.values():
+                    if (self.HandlesFile(entry.name) and
+                        any(isinstance(entry, t) for t in self.templates)):
+                        self.check_template(entryset, entry)
+
+    @classmethod
+    def Errors(cls):
+        return {"templated-script": "warning",
+                "templated-executable": "warning"}
+
+    def check_template(self, entryset, entry):
+        """ Check a template to see if it's a script or an executable. """
+        # first, check for a known script extension
+        ext = os.path.splitext(entryset.path)[1]
+        if ext in self.extensions:
+            self.LintError("templated-script",
+                           "Templated script found: %s\n"
+                           "File has a known script extension: %s\n"
+                           "Template a config file for the script instead" %
+                           (entry.name, ext))
+            return
+
+        # next, check for a shebang line
+        firstline = open(entry.name).readline()
+        if firstline.startswith("#!"):
+            self.LintError("templated-script",
+                           "Templated script found: %s\n"
+                           "File starts with a shebang: %s\n"
+                           "Template a config file for the script instead" %
+                           (entry.name, firstline))
+            return
+
+        # finally, check for executable permissions in info.xml
+        for entry in entryset.entries.values():
+            if isinstance(entry, CfgInfoXML):
+                for pinfo in entry.infoxml.pnode.data.xpath("//FileInfo"):
+                    try:
+                        mode = int(
+                            pinfo.get("mode",
+                                      default_path_metadata()['mode']), 8)
+                    except ValueError:
+                        # LintError will be produced by RequiredAttrs plugin
+                        self.logger.warning("Non-octal mode: %s" % mode)
+                        continue
+                    if mode & stat.S_IXUSR != 0:
+                        self.LintError(
+                            "templated-executable",
+                            "Templated executable found: %s\n"
+                            "Template a config file for the executable instead"
+                            % entry.name)
+                        return
diff --git a/src/lib/Bcfg2/Server/Lint/Validate.py b/src/lib/Bcfg2/Server/Lint/Validate.py
index e38619355..3ad78ade4 100644
--- a/src/lib/Bcfg2/Server/Lint/Validate.py
+++ b/src/lib/Bcfg2/Server/Lint/Validate.py
@@ -113,9 +113,16 @@ class Validate(Bcfg2.Server.Lint.ServerlessPlugin):
         :type filename: string
         :returns: lxml.etree._ElementTree - the parsed data"""
         try:
-            return lxml.etree.parse(filename)
-        except SyntaxError:
-            result = self.cmd.run(["xmllint", filename])
+            xdata = lxml.etree.parse(filename)
+            if self.files is None:
+                xdata.xinclude()
+            return xdata
+        except (lxml.etree.XIncludeError, SyntaxError):
+            cmd = ["xmllint", "--noout"]
+            if self.files is None:
+                cmd.append("--xinclude")
+            cmd.append(filename)
+            result = self.cmd.run(cmd)
             self.LintError("xml-failed-to-parse",
                            "%s fails to parse:\n%s" %
                            (filename, result.stdout + result.stderr))
@@ -146,6 +153,8 @@ class Validate(Bcfg2.Server.Lint.ServerlessPlugin):
             if not schema:
                 return False
         datafile = self.parse(filename)
+        if not datafile:
+            return False
         if not schema.validate(datafile):
             cmd = ["xmllint"]
             if self.files is None:
diff --git a/src/lib/Bcfg2/Server/Lint/ValidateJSON.py b/src/lib/Bcfg2/Server/Lint/ValidateJSON.py
new file mode 100644
index 000000000..04151d764
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Lint/ValidateJSON.py
@@ -0,0 +1,70 @@
+"""Ensure that all JSON files in the Bcfg2 repository are
+valid. Currently, the only plugins that uses JSON are Ohai and
+Properties."""
+
+import os
+import sys
+import glob
+import fnmatch
+import Bcfg2.Server.Lint
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+
+class ValidateJSON(Bcfg2.Server.Lint.ServerlessPlugin):
+    """Ensure that all JSON files in the Bcfg2 repository are
+    valid. Currently, the only plugins that uses JSON are Ohai and
+    Properties. """
+
+    def __init__(self, *args, **kwargs):
+        Bcfg2.Server.Lint.ServerlessPlugin.__init__(self, *args, **kwargs)
+
+        #: A list of file globs that give the path to JSON files.  The
+        #: globs are extended :mod:`fnmatch` globs that also support
+        #: ``**``, which matches any number of any characters,
+        #: including forward slashes.
+        self.globs = ["Properties/*.json", "Ohai/*.json"]
+        self.files = self.get_files()
+
+    def Run(self):
+        for path in self.files:
+            self.logger.debug("Validating JSON in %s" % path)
+            try:
+                json.load(open(path))
+            except ValueError:
+                self.LintError("json-failed-to-parse",
+                               "%s does not contain valid JSON: %s" %
+                               (path, sys.exc_info()[1]))
+
+    @classmethod
+    def Errors(cls):
+        return {"json-failed-to-parse": "error"}
+
+    def get_files(self):
+        """Return a list of all JSON files to validate, based on
+        :attr:`Bcfg2.Server.Lint.ValidateJSON.ValidateJSON.globs`. """
+        if self.files is not None:
+            listfiles = lambda p: fnmatch.filter(self.files,
+                                                 os.path.join('*', p))
+        else:
+            listfiles = lambda p: glob.glob(
+                os.path.join(Bcfg2.Options.setup.repository, p))
+
+        rv = []
+        for path in self.globs:
+            if '/**/' in path:
+                if self.files is not None:
+                    rv.extend(listfiles(path))
+                else:  # self.files is None
+                    fpath, fname = path.split('/**/')
+                    for root, _, files in os.walk(
+                            os.path.join(Bcfg2.Options.setup.repository,
+                                         fpath)):
+                        rv.extend([os.path.join(root, f)
+                                   for f in files if f == fname])
+            else:
+                rv.extend(listfiles(path))
+        return rv
diff --git a/src/lib/Bcfg2/Server/Plugin/helpers.py b/src/lib/Bcfg2/Server/Plugin/helpers.py
index 1cb5a7b3e..aa8db2bc0 100644
--- a/src/lib/Bcfg2/Server/Plugin/helpers.py
+++ b/src/lib/Bcfg2/Server/Plugin/helpers.py
@@ -18,7 +18,7 @@ from Bcfg2.Compat import CmpMixin, wraps
 from Bcfg2.Server.Plugin.base import Plugin
 from Bcfg2.Server.Plugin.interfaces import Generator, TemplateDataProvider
 from Bcfg2.Server.Plugin.exceptions import SpecificityError, \
-    PluginExecutionError
+    PluginExecutionError, PluginInitError
 
 try:
     import Bcfg2.Server.Encryption
@@ -219,6 +219,18 @@ class DatabaseBacked(Plugin):
     .. private-include: _must_lock
     """
 
+    def __init__(self, core):
+        Plugin.__init__(self, core)
+        use_db = getattr(Bcfg2.Options.setup, "%s_db" % self.name.lower(),
+                         False)
+        if use_db and not HAS_DJANGO:
+            raise PluginInitError("%s is configured to use the database but "
+                                  "Django libraries are not found" % self.name)
+        elif use_db and not self.core.database_available:
+            raise PluginInitError("%s is configured to use the database but "
+                                  "the database is unavailable due to prior "
+                                  "errors" % self.name)
+
     @property
     def _use_db(self):
         """ Whether or not this plugin is configured to use the
@@ -227,11 +239,7 @@ class DatabaseBacked(Plugin):
                          False)
         if use_db and HAS_DJANGO and self.core.database_available:
             return True
-        elif not use_db:
-            return False
         else:
-            self.logger.error("%s: use_database is true but django not found" %
-                              self.name)
             return False
 
     @property
@@ -818,7 +826,8 @@ class StructFile(XMLFileBacked):
         """
         stream = self.template.generate(
             **get_xml_template_data(self, metadata)).filter(removecomment)
-        return lxml.etree.XML(stream.render('xml', strip_whitespace=False),
+        return lxml.etree.XML(stream.render('xml',
+                                            strip_whitespace=False).encode(),
                               parser=Bcfg2.Server.XMLParser)
 
     def _match(self, item, metadata, *args):
diff --git a/src/lib/Bcfg2/Server/Plugins/Metadata.py b/src/lib/Bcfg2/Server/Plugins/Metadata.py
index 78f86f28e..6ff256147 100644
--- a/src/lib/Bcfg2/Server/Plugins/Metadata.py
+++ b/src/lib/Bcfg2/Server/Plugins/Metadata.py
@@ -674,6 +674,11 @@ class Metadata(Bcfg2.Server.Plugin.Metadata,
         if attribs is None:
             attribs = dict()
         if self._use_db:
+            if attribs:
+                msg = "Metadata does not support setting client attributes " +\
+                      "with use_database enabled"
+                self.logger.error(msg)
+                raise Bcfg2.Server.Plugin.PluginExecutionError(msg)
             try:
                 client = MetadataClientModel.objects.get(hostname=client_name)
             except MetadataClientModel.DoesNotExist:
diff --git a/src/lib/Bcfg2/Server/Plugins/Probes.py b/src/lib/Bcfg2/Server/Plugins/Probes.py
index 9f2375fcd..553c16202 100644
--- a/src/lib/Bcfg2/Server/Plugins/Probes.py
+++ b/src/lib/Bcfg2/Server/Plugins/Probes.py
@@ -10,7 +10,7 @@ import lxml.etree
 import Bcfg2.Server
 import Bcfg2.Server.Cache
 import Bcfg2.Server.Plugin
-from Bcfg2.Compat import unicode  # pylint: disable=W0622
+from Bcfg2.Compat import unicode, any  # pylint: disable=W0622
 import Bcfg2.Server.FileMonitor
 from Bcfg2.Logger import Debuggable
 from Bcfg2.Server.Statistics import track_statistics
@@ -431,7 +431,13 @@ class Probes(Bcfg2.Server.Plugin.Probing,
     options = [
         Bcfg2.Options.BooleanOption(
             cf=('probes', 'use_database'), dest="probes_db",
-            help="Use database capabilities of the Probes plugin")]
+            help="Use database capabilities of the Probes plugin"),
+        Bcfg2.Options.Option(
+            cf=('probes', 'allowed_groups'), dest="probes_allowed_groups",
+            help="Whitespace-separated list of group name regexps to which "
+            "probes can assign a client",
+            default=[re.compile('.*')],
+            type=Bcfg2.Options.Types.anchored_regex_list)]
     options_parsed_hook = staticmethod(load_django_models)
 
     def __init__(self, core):
@@ -480,7 +486,13 @@ class Probes(Bcfg2.Server.Plugin.Probing,
         for line in dlines[:]:
             match = self.groupline_re.match(line)
             if match:
-                groups.append(match.group("groupname"))
+                newgroup = match.group("groupname")
+                if self._group_allowed(newgroup):
+                    groups.append(newgroup)
+                else:
+                    self.logger.warning(
+                        "Disallowed group assignment %s from %s" %
+                        (newgroup, client.hostname))
                 dlines.remove(line)
         return (groups, ProbeData("\n".join(dlines)))
 
@@ -489,3 +501,10 @@ class Probes(Bcfg2.Server.Plugin.Probing,
 
     def get_additional_data(self, metadata):
         return self.probestore.get_data(metadata.hostname)
+
+    def _group_allowed(self, group):
+        """ Determine if the named group can be set as a probe group
+        by checking the regexes listed in the [probes] groups_allowed
+        setting """
+        return any(r.match(group)
+                   for r in Bcfg2.Options.setup.probes_allowed_groups)