Fixing #2337 - Adding 'freeze_main' setting

This disables adding any code to 'main' except
in site.pp, so if you have code outside of a node,
class, or define it will throw an exception.

Signed-off-by: Luke Kanies <luke@puppetlabs.com>

2 files changed, 5 insertions, 1 deletions

diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index 9de73f526..f2e498d5a 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -169,7 +169,10 @@ module Puppet
             return code, the entire Puppet run will fail."],
         :postrun_command => ["", "A command to run after every agent run.  If this command returns a non-zero
             return code, the entire Puppet run will be considered to have failed, even though it might have
-            performed work during the normal run."]
+            performed work during the normal run."],
+        :freeze_main => [false, "Freezes the 'main' class, disallowing any code to be added to it.  This
+            essentially means that you can't have any code outside of a node, class, or definition other
+            than in the site manifest."]
     )
 
     hostname = Facter["hostname"].value
diff --git a/lib/puppet/resource/type.rb b/lib/puppet/resource/type.rb
index e13b1834e..e60f87953 100644
--- a/lib/puppet/resource/type.rb
+++ b/lib/puppet/resource/type.rb
@@ -106,6 +106,7 @@ class Puppet::Resource::Type
     def merge(other)
         fail "#{name} is not a class; cannot add code to it" unless type == :hostclass
         fail "#{other.name} is not a class; cannot add code from it" unless other.type == :hostclass
+        fail "Cannot have code outside of a class/node/define because 'freeze_main' is enabled" if name == "" and Puppet.settings[:freeze_main]
 
         if parent and other.parent and parent != other.parent
             fail "Cannot merge classes with different parent classes (#{name} => #{parent} vs. #{other.name} => #{other.parent})"