Merge pull request #4642 from chef/ksubrama/fips_acceptance

Run the integration tests in FIPS mode

31 files changed, 129 insertions, 107 deletions

diff --git a/acceptance/fips/.kitchen.yml b/acceptance/fips/.kitchen.yml
index 946401a738..23280f9142 100644
--- a/acceptance/fips/.kitchen.yml
+++ b/acceptance/fips/.kitchen.yml
@@ -1,4 +1,8 @@
 suites:
-  - name: fips
+  - name: fips-unit-functional
+    includes: [centos-6, windows-2012r2]
+    run_list:
+
+  - name: fips-integration
     includes: [centos-6, windows-2012r2]
     run_list:
diff --git a/acceptance/fips/test/integration/fips/serverspec/Gemfile b/acceptance/fips/test/integration/fips-integration/serverspec/Gemfile
index 3921e6a92a..3921e6a92a 100644
--- a/acceptance/fips/test/integration/fips/serverspec/Gemfile
+++ b/acceptance/fips/test/integration/fips-integration/serverspec/Gemfile
diff --git a/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb b/acceptance/fips/test/integration/fips-integration/serverspec/fips-integration_spec.rb
index 4f408cd063..59a888bef1 100644
--- a/acceptance/fips/test/integration/fips/serverspec/fips_spec.rb
+++ b/acceptance/fips/test/integration/fips-integration/serverspec/fips-integration_spec.rb
@@ -1,7 +1,7 @@
 require "mixlib/shellout"
 require "bundler"
 
-describe "Chef Fips Specs" do
+describe "Chef Fips Integration Specs" do
   def windows?
     if RUBY_PLATFORM =~ /mswin|mingw|windows/
       true
@@ -35,13 +35,17 @@ describe "Chef Fips Specs" do
     cmd.stdout.chomp
   end
 
-  it "passes the unit and functional specs" do
+  def run_rspec_test(test)
     Bundler.with_clean_env do
       cmd = Mixlib::ShellOut.new(
-        "bundle exec rspec -t ~requires_git spec/unit spec/functional",
-        env: env, live_stream: STDOUT, cwd: chef_dir, timeout: 3600
+        "bundle exec rspec -f documentation -t ~requires_git #{test}",
+        env: env, cwd: chef_dir, timeout: 3600
       )
       cmd.run_command.error!
     end
   end
+
+  it "passes the integration specs" do
+    run_rspec_test("spec/integration")
+  end
 end
diff --git a/acceptance/fips/test/integration/fips-unit-functional/serverspec/Gemfile b/acceptance/fips/test/integration/fips-unit-functional/serverspec/Gemfile
new file mode 100644
index 0000000000..3921e6a92a
--- /dev/null
+++ b/acceptance/fips/test/integration/fips-unit-functional/serverspec/Gemfile
@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "mixlib-shellout"
diff --git a/acceptance/fips/test/integration/fips-unit-functional/serverspec/fips-unit-functional_spec.rb b/acceptance/fips/test/integration/fips-unit-functional/serverspec/fips-unit-functional_spec.rb
new file mode 100644
index 0000000000..446261f83f
--- /dev/null
+++ b/acceptance/fips/test/integration/fips-unit-functional/serverspec/fips-unit-functional_spec.rb
@@ -0,0 +1,56 @@
+require "mixlib/shellout"
+require "bundler"
+
+describe "Chef Fips Unit/Functional Specs" do
+  def windows?
+    if RUBY_PLATFORM =~ /mswin|mingw|windows/
+      true
+    else
+      false
+    end
+  end
+
+  let(:omnibus_root) do
+    if windows?
+      "c:/opscode/chef"
+    else
+      "/opt/chef"
+    end
+  end
+
+  let(:env) do
+    {
+      "PATH" => [ "#{omnibus_root}/embedded/bin", ENV["PATH"] ].join(File::PATH_SEPARATOR),
+      "BUNDLE_GEMFILE" => "#{omnibus_root}/Gemfile",
+      "GEM_PATH" => nil, "GEM_CACHE" => nil, "GEM_HOME" => nil,
+      "BUNDLE_IGNORE_CONFIG" => "true",
+      "BUNDLE_FROZEN" => "1",
+      "CHEF_FIPS" => "1"
+    }
+  end
+
+  let(:chef_dir) do
+    cmd = Mixlib::ShellOut.new("bundle show chef", env: env).run_command
+    cmd.error!
+    cmd.stdout.chomp
+  end
+
+  def run_rspec_test(test)
+    Bundler.with_clean_env do
+      cmd = Mixlib::ShellOut.new(
+        "bundle exec rspec -f documentation -t ~requires_git #{test}",
+        env: env, cwd: chef_dir, timeout: 3600
+      )
+      cmd.run_command.error!
+    end
+  end
+
+  it "passes the unit specs" do
+    run_rspec_test("spec/unit")
+  end
+
+  it "passes the functional specs" do
+    run_rspec_test("spec/functional")
+  end
+
+end
diff --git a/chef-config/lib/chef-config/config.rb b/chef-config/lib/chef-config/config.rb
index bbdfdd74dc..e5260e4633 100644
--- a/chef-config/lib/chef-config/config.rb
+++ b/chef-config/lib/chef-config/config.rb
@@ -986,7 +986,11 @@ module ChefConfig
       require "digest"
       require "digest/sha1"
       require "digest/md5"
+      # Remove pre-existing constants if they do exist to reduce the
+      # amount of log spam and warnings.
+      Digest.send(:remove_const, "SHA1") if Digest.const_defined?("SHA1")
       Digest.const_set("SHA1", OpenSSL::Digest::SHA1)
+      OpenSSL::Digest.send(:remove_const, "MD5") if OpenSSL::Digest.const_defined?("MD5")
       OpenSSL::Digest.const_set("MD5", Digest::MD5)
       ChefConfig.logger.debug "FIPS mode is enabled."
     end
diff --git a/ci/verify-chef.sh b/ci/verify-chef.sh
index bf72e03cc3..6c6c4606de 100755
--- a/ci/verify-chef.sh
+++ b/ci/verify-chef.sh
@@ -117,11 +117,5 @@ else
     exit 1
   fi
 
-  unset CHEF_FIPS
-  if [ "$PIPELINE_NAME" = "chef-fips" ]; then
-      echo "Setting fips mode"
-      CHEF_FIPS=1
-      export CHEF_FIPS
-  fi
-  sudo env BUNDLE_GEMFILE=/opt/$PROJECT_NAME/Gemfile BUNDLE_IGNORE_CONFIG=true BUNDLE_FROZEN=1 PATH=$PATH TERM=xterm CHEF_FIPS=$CHEF_FIPS bundle exec rspec -r rspec_junit_formatter -f RspecJunitFormatter -o $WORKSPACE/test.xml -f documentation spec/functional
+  sudo env BUNDLE_GEMFILE=/opt/$PROJECT_NAME/Gemfile BUNDLE_IGNORE_CONFIG=true BUNDLE_FROZEN=1 PATH=$PATH TERM=xterm bundle exec rspec -r rspec_junit_formatter -f RspecJunitFormatter -o $WORKSPACE/test.xml -f documentation spec/functional
 fi
diff --git a/lib/chef/provider/directory.rb b/lib/chef/provider/directory.rb
index 3235a28cd1..7cc05259b6 100644
--- a/lib/chef/provider/directory.rb
+++ b/lib/chef/provider/directory.rb
@@ -50,7 +50,21 @@ class Chef
           # Make sure the parent dir exists, or else fail.
           # for why run, print a message explaining the potential error.
           parent_directory = ::File.dirname(@new_resource.path)
-          a.assertion { @new_resource.recursive || ::File.directory?(parent_directory) }
+          a.assertion do
+            if @new_resource.recursive
+              does_parent_exist = lambda do |base_dir|
+                base_dir = ::File.dirname(base_dir)
+                if ::File.exist?(base_dir)
+                  ::File.directory?(base_dir)
+                else
+                  does_parent_exist.call(base_dir)
+                end
+              end
+              does_parent_exist.call(@new_resource.path)
+            else
+              ::File.directory?(parent_directory)
+            end
+          end
           a.failure_message(Chef::Exceptions::EnclosingDirectoryDoesNotExist, "Parent directory #{parent_directory} does not exist, cannot create #{@new_resource.path}")
           a.whyrun("Assuming directory #{parent_directory} would have been created")
         end
diff --git a/omnibus/config/projects/chef-fips.rb b/omnibus/config/projects/chef-fips.rb
deleted file mode 100644
index dfe1a9e13a..0000000000
--- a/omnibus/config/projects/chef-fips.rb
+++ /dev/null
@@ -1,49 +0,0 @@
-#
-# Copyright 2012-2016, Chef Software, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-#
-# This is the chef client build with FIPS mode enabled.
-#
-current_file = __FILE__
-chef_project_contents = IO.read(File.expand_path("../chef.rb", current_file))
-self.instance_eval chef_project_contents
-
-name "chef-fips"
-friendly_name "Chef Client with FIPS OpenSSL"
-
-if windows?
-  # NOTE: Ruby DevKit fundamentally CANNOT be installed into "Program Files"
-  #       Native gems will use gcc which will barf on files with spaces,
-  #       which is only fixable if everyone in the world fixes their Makefiles
-  install_dir "#{default_root}/opscode/#{name}"
-  package_name "chef-fips"
-else
-  install_dir "#{default_root}/#{name}"
-end
-
-override :ruby, version: "2.1.7"
-
-# Global FIPS override flag.
-override :fips, enabled: true
-
-override :chef, version: "local_source"
-override :ohai, version: "master"
-
-msi_upgrade_code = "819F5DB3-B818-4358-BB2B-54B8171D0A26"
-project_location_dir = "chef-fips"
-
-# Use chef's scripts for everything.
-resources_path "#{resources_path}/../chef"
diff --git a/spec/functional/resource/git_spec.rb b/spec/functional/resource/git_spec.rb
index 11a3afdee5..6808898c29 100644
--- a/spec/functional/resource/git_spec.rb
+++ b/spec/functional/resource/git_spec.rb
@@ -83,10 +83,8 @@ E
   after(:each) do
     Chef::Config[:file_cache_path] = @old_file_cache_path
     FileUtils.remove_entry_secure deploy_directory if File.exist?(deploy_directory)
+    FileUtils.remove_entry_secure base_dir_path
     FileUtils.remove_entry_secure file_cache_path
-  end
-
-  after(:all) do
     FileUtils.remove_entry_secure origin_repo_dir
   end
 
diff --git a/spec/functional/resource/group_spec.rb b/spec/functional/resource/group_spec.rb
index cd899ea97a..a5de63b7c6 100644
--- a/spec/functional/resource/group_spec.rb
+++ b/spec/functional/resource/group_spec.rb
@@ -269,12 +269,12 @@ describe Chef::Resource::Group, :requires_root_or_running_windows, :not_supporte
     describe "when removing members" do
       it "does not raise an error for a non well-formed domain name" do
         group_resource.excluded_members [invalid_domain_user_name]
-        expect { group_resource.run_action(tested_action) }.to_not raise_error Chef::Exceptions::Win32APIError
+        expect { group_resource.run_action(tested_action) }.to_not raise_error
       end
 
       it "does not raise an error for a nonexistent domain" do
         group_resource.excluded_members [nonexistent_domain_user_name]
-        expect { group_resource.run_action(tested_action) }.to_not raise_error Chef::Exceptions::Win32APIError
+        expect { group_resource.run_action(tested_action) }.to_not raise_error
       end
     end
   end
@@ -368,7 +368,7 @@ downthestreetalwayshadagoodsmileonhisfacetheoldmanwalkingdownthestreeQQQQQQ" }
 
     describe "when there is no group" do
       it "should raise an error" do
-        expect { group_resource.run_action(:modify) }.to raise_error
+        expect { group_resource.run_action(:modify) }.to raise_error(Chef::Exceptions::Group)
       end
     end
 
@@ -401,7 +401,7 @@ downthestreetalwayshadagoodsmileonhisfacetheoldmanwalkingdownthestreeQQQQQQ" }
       end
 
       it "raises an error on modify" do
-        expect { group_resource.run_action(:modify) }.to raise_error
+        expect { group_resource.run_action(:modify) }.to raise_error(Chef::Exceptions::Group)
       end
 
       it "does not raise an error on manage" do
diff --git a/spec/functional/tiny_server_spec.rb b/spec/functional/tiny_server_spec.rb
index 3e394f335e..2a025a2ecd 100644
--- a/spec/functional/tiny_server_spec.rb
+++ b/spec/functional/tiny_server_spec.rb
@@ -26,7 +26,7 @@ describe TinyServer::API do
   end
 
   it "is a Singleton" do
-    expect { TinyServer::API.new }.to raise_error
+    expect { TinyServer::API.new }.to raise_error NoMethodError
   end
 
   it "clears the router" do
diff --git a/spec/functional/util/powershell/cmdlet_spec.rb b/spec/functional/util/powershell/cmdlet_spec.rb
index 6ddbea2f42..19f5e58a49 100644
--- a/spec/functional/util/powershell/cmdlet_spec.rb
+++ b/spec/functional/util/powershell/cmdlet_spec.rb
@@ -105,7 +105,7 @@ describe Chef::Util::Powershell::Cmdlet, :windows_powershell_dsc_only do
   context "when constructor is given invalid arguments" do
     let(:cmd_output_format) { :invalid }
     it "throws an exception if an invalid format is passed to the constructor" do
-      expect(lambda { simple_cmdlet }).to raise_error
+      expect(lambda { simple_cmdlet }).to raise_error(ArgumentError)
     end
   end
 end
diff --git a/spec/functional/win32/registry_spec.rb b/spec/functional/win32/registry_spec.rb
index 4f9b742503..4a6157a6d5 100644
--- a/spec/functional/win32/registry_spec.rb
+++ b/spec/functional/win32/registry_spec.rb
@@ -243,7 +243,7 @@ describe "Chef::Win32::Registry", :windows_only do
     end
 
     it "throws an exception when trying to cast an array to an int for a dword" do
-      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldThrow", :type => :dword, :data => %w{one two} }) }.to raise_error
+      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldThrow", :type => :dword, :data => %w{one two} }) }.to raise_error NoMethodError
     end
 
     # we are validating that the data gets .to_s called on it when type is a :string
@@ -261,11 +261,11 @@ describe "Chef::Win32::Registry", :windows_only do
     # we are validating that the data gets .to_a called on it when type is a :multi_string
 
     it "throws an exception when a multi-string is passed a number" do
-      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldThrow", :type => :multi_string, :data => 65535 }) }.to raise_error
+      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldThrow", :type => :multi_string, :data => 65535 }) }.to raise_error NoMethodError
     end
 
     it "throws an exception when a multi-string is passed a string" do
-      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldBeWat", :type => :multi_string, :data => "foo" }) }.to raise_error
+      expect { @registry.set_value("HKCU\\Software\\Root\\Branch\\Flower", { :name => "ShouldBeWat", :type => :multi_string, :data => "foo" }) }.to raise_error NoMethodError
     end
   end
 
diff --git a/spec/integration/solo/solo_spec.rb b/spec/integration/solo/solo_spec.rb
index 567f1a2c6f..5add4849e9 100644
--- a/spec/integration/solo/solo_spec.rb
+++ b/spec/integration/solo/solo_spec.rb
@@ -112,7 +112,7 @@ EOM
       file "cookbooks/x/recipes/default.rb", <<EOM
 ruby_block "sleeping" do
   block do
-    sleep 5
+    sleep 10
   end
 end
 EOM
@@ -134,7 +134,7 @@ EOM
 -l debug -L #{path_to('logs/runs.log')}", :chdir => chef_dir)
 
           # Give it some time to progress
-          sleep 1
+          sleep 5
 
           # Instantiate the second chef-solo run
           s2 = Process.spawn("#{chef_solo} -c \"#{path_to('config/solo.rb')}\" -o 'x::default' \
diff --git a/spec/support/shared/functional/securable_resource.rb b/spec/support/shared/functional/securable_resource.rb
index dd8a0216bc..506b96736c 100644
--- a/spec/support/shared/functional/securable_resource.rb
+++ b/spec/support/shared/functional/securable_resource.rb
@@ -309,7 +309,7 @@ shared_examples_for "a securable resource without existing target" do
     end
 
     it "fails to set owner when owner has invalid characters" do
-      expect { resource.owner 'Lance "The Nose" Glindenberry III' }.to raise_error#(Chef::Exceptions::ValidationFailed)
+      expect { resource.owner 'Lance "The Nose" Glindenberry III' }.to raise_error(Chef::Exceptions::ValidationFailed)
     end
 
     it "sets owner when owner is specified with a \\" do
diff --git a/spec/support/shared/unit/provider/file.rb b/spec/support/shared/unit/provider/file.rb
index 2b2c7255cc..cb539ffbc3 100644
--- a/spec/support/shared/unit/provider/file.rb
+++ b/spec/support/shared/unit/provider/file.rb
@@ -586,14 +586,14 @@ shared_examples_for Chef::Provider::File do
       it "raises an exception when the content object returns a tempfile with a nil path" do
         tempfile = double("Tempfile", :path => nil)
         expect(provider.send(:content)).to receive(:tempfile).at_least(:once).and_return(tempfile)
-        expect { provider.send(:do_contents_changes) }.to raise_error
+        expect { provider.send(:do_contents_changes) }.to raise_error(RuntimeError)
       end
 
       it "raises an exception when the content object returns a tempfile that does not exist" do
         tempfile = double("Tempfile", :path => "/tmp/foo-bar-baz")
         expect(provider.send(:content)).to receive(:tempfile).at_least(:once).and_return(tempfile)
         expect(File).to receive(:exists?).with("/tmp/foo-bar-baz").and_return(false)
-        expect { provider.send(:do_contents_changes) }.to raise_error
+        expect { provider.send(:do_contents_changes) }.to raise_error(RuntimeError)
       end
     end
 
@@ -712,7 +712,7 @@ shared_examples_for Chef::Provider::File do
         it "should not try to backup or delete the file, and should not be updated by last action" do
           expect(provider).not_to receive(:do_backup)
           expect(File).not_to receive(:delete)
-          expect { provider.run_action(:delete) }.to raise_error()
+          expect { provider.run_action(:delete) }.to raise_error(Chef::Exceptions::InsufficientPermissions)
           expect(resource).not_to be_updated_by_last_action
         end
       end
diff --git a/spec/support/shared/unit/windows_script_resource.rb b/spec/support/shared/unit/windows_script_resource.rb
index 2dc0229c90..5b559bb83b 100644
--- a/spec/support/shared/unit/windows_script_resource.rb
+++ b/spec/support/shared/unit/windows_script_resource.rb
@@ -64,7 +64,7 @@ shared_examples_for "a Windows script resource" do
       it "should raise an exception if the guard_interpreter is overridden from its default value" do
         @resource.guard_interpreter :bash
         @resource.only_if { true }
-        expect { @resource.should_skip?(:run) }.to raise_error
+        expect { @resource.should_skip?(:run) }.to raise_error(ArgumentError)
       end
     end
   end
diff --git a/spec/unit/cookbook/metadata_spec.rb b/spec/unit/cookbook/metadata_spec.rb
index 761355b6e0..c6d7e41283 100644
--- a/spec/unit/cookbook/metadata_spec.rb
+++ b/spec/unit/cookbook/metadata_spec.rb
@@ -707,7 +707,7 @@ describe Chef::Cookbook::Metadata do
       }
       expect {
         metadata.attribute("test_cookbook/test", options)
-      }.to raise_error
+      }.to raise_error(Chef::Exceptions::ValidationFailed)
     end
 
     it "should error if default used with calculated" do
diff --git a/spec/unit/knife/bootstrap_spec.rb b/spec/unit/knife/bootstrap_spec.rb
index 1508e6e3a7..5f1ba9f781 100644
--- a/spec/unit/knife/bootstrap_spec.rb
+++ b/spec/unit/knife/bootstrap_spec.rb
@@ -85,7 +85,7 @@ describe Chef::Knife::Bootstrap do
         let(:bootstrap_template) { "/opt/blah/not/exists/template.erb" }
 
         it "raises an error" do
-          expect { knife.find_template }.to raise_error
+          expect { knife.find_template }.to raise_error(Errno::ENOENT)
         end
       end
 
@@ -339,7 +339,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--node-ssl-verify-mode", "all"] }
 
       it "raises error" do
-        expect { rendered_template }.to raise_error
+        expect { rendered_template }.to raise_error(RuntimeError)
       end
     end
 
diff --git a/spec/unit/node/attribute_spec.rb b/spec/unit/node/attribute_spec.rb
index f28c2598e3..57ad3c0c25 100644
--- a/spec/unit/node/attribute_spec.rb
+++ b/spec/unit/node/attribute_spec.rb
@@ -408,7 +408,7 @@ describe Chef::Node::Attribute do
     end
 
     it "should die if you try and do nested attributes that do not exist without read vivification" do
-      expect { @attributes["foo"]["bar"] = :baz }.to raise_error
+      expect { @attributes["foo"]["bar"] = :baz }.to raise_error(NoMethodError)
     end
 
     it "should let you set attributes manually without vivification" do
diff --git a/spec/unit/node/immutable_collections_spec.rb b/spec/unit/node/immutable_collections_spec.rb
index 170e6d927a..f57ed459cd 100644
--- a/spec/unit/node/immutable_collections_spec.rb
+++ b/spec/unit/node/immutable_collections_spec.rb
@@ -97,7 +97,7 @@ describe Chef::Node::ImmutableMash do
     :shift,
   ].each do |mutator|
     it "doesn't allow mutation via `#{mutator}'" do
-      expect { @immutable_mash.send(mutator) }.to raise_error
+      expect { @immutable_mash.send(mutator) }.to raise_error(Chef::Exceptions::ImmutableAttributeModification)
     end
   end
 
@@ -154,7 +154,7 @@ describe Chef::Node::ImmutableArray do
     :unshift,
   ].each do |mutator|
     it "does not allow mutation via `#{mutator}" do
-      expect { @immutable_array.send(mutator) }.to raise_error
+      expect { @immutable_array.send(mutator) }.to raise_error(Chef::Exceptions::ImmutableAttributeModification)
     end
   end
 
diff --git a/spec/unit/node_map_spec.rb b/spec/unit/node_map_spec.rb
index 0eb251ac8d..0480a721af 100644
--- a/spec/unit/node_map_spec.rb
+++ b/spec/unit/node_map_spec.rb
@@ -27,7 +27,7 @@ describe Chef::NodeMap do
 
   describe "with a bad filter name" do
     it "should raise an error" do
-      expect { node_map.set(node, :thing, on_platform_family: "rhel") }.to raise_error
+      expect { node_map.set(node, :thing, on_platform_family: "rhel") }.to raise_error(ArgumentError)
     end
   end
 
diff --git a/spec/unit/provider/apt_update_spec.rb b/spec/unit/provider/apt_update_spec.rb
index 3e3e6ba07a..351a10051c 100644
--- a/spec/unit/provider/apt_update_spec.rb
+++ b/spec/unit/provider/apt_update_spec.rb
@@ -73,6 +73,7 @@ describe Chef::Provider::AptUpdate do
   describe "#action_periodic" do
     before do
       allow(File).to receive(:exist?)
+      allow(File).to receive(:exist?).with(Dir.tmpdir).and_return(true)
       expect(File).to receive(:exist?).with("#{stamp_dir}/update-success-stamp").and_return(true)
     end
 
diff --git a/spec/unit/provider/directory_spec.rb b/spec/unit/provider/directory_spec.rb
index c8bec3e8ce..f8864af7f8 100644
--- a/spec/unit/provider/directory_spec.rb
+++ b/spec/unit/provider/directory_spec.rb
@@ -187,13 +187,6 @@ describe Chef::Provider::Directory do
       it "raises an exception when the parent directory is a file and recursive is true" do
         FileUtils.touch tmp_dir
         new_resource.recursive true
-        expect { directory.run_action(:create) }.to raise_error
-      end
-
-      it "raises the right exception when the parent directory is a file and recursive is true" do
-        pending "this seems to return the wrong error" # FIXME
-        FileUtils.touch tmp_dir
-        new_resource.recursive true
         expect { directory.run_action(:create) }.to raise_error(Chef::Exceptions::EnclosingDirectoryDoesNotExist)
       end
     end
diff --git a/spec/unit/provider/file/content_spec.rb b/spec/unit/provider/file/content_spec.rb
index 9ebcf10dcc..a31c75baf4 100644
--- a/spec/unit/provider/file/content_spec.rb
+++ b/spec/unit/provider/file/content_spec.rb
@@ -89,7 +89,7 @@ describe Chef::Provider::File::Content do
 
       it "fails when :file_desployment_uses_destdir is set" do
         Chef::Config[:file_staging_uses_destdir] = true
-        expect { content.tempfile }.to raise_error
+        expect { content.tempfile }.to raise_error(Chef::Exceptions::FileContentStagingError)
       end
 
       it "returns a tempfile in the tempdir when :file_desployment_uses_destdir is not set" do
diff --git a/spec/unit/provider/package/yum_spec.rb b/spec/unit/provider/package/yum_spec.rb
index 3fb60ea10d..ab726134e9 100644
--- a/spec/unit/provider/package/yum_spec.rb
+++ b/spec/unit/provider/package/yum_spec.rb
@@ -1578,7 +1578,7 @@ describe Chef::Provider::Package::Yum::RPMDb do
     end
 
     it "should only accept an RPMDbPackage object" do
-      expect { @rpmdb.push("string") }.to raise_error
+      expect { @rpmdb.push("string") }.to raise_error(ArgumentError)
     end
 
     it "should add the package to the package db" do
diff --git a/spec/unit/provider/user/dscl_spec.rb b/spec/unit/provider/user/dscl_spec.rb
index c1877a53cd..bf8b3169d7 100644
--- a/spec/unit/provider/user/dscl_spec.rb
+++ b/spec/unit/provider/user/dscl_spec.rb
@@ -294,7 +294,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
       let(:dscl_exists) { false }
 
       it "should raise an error" do
-        expect { run_requirements }.to raise_error
+        expect { run_requirements }.to raise_error(Chef::Exceptions::User)
       end
     end
 
@@ -302,7 +302,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
       let(:plutil_exists) { false }
 
       it "should raise an error" do
-        expect { run_requirements }.to raise_error
+        expect { run_requirements }.to raise_error(Chef::Exceptions::User)
       end
     end
 
@@ -312,7 +312,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
       }
 
       it "should raise an error" do
-        expect { run_requirements }.to raise_error
+        expect { run_requirements }.to raise_error(Chef::Exceptions::User)
       end
     end
 
@@ -333,7 +333,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
         let(:password) { salted_sha512_pbkdf2_password }
 
         it "should raise an error" do
-          expect { run_requirements }.to raise_error
+          expect { run_requirements }.to raise_error(Chef::Exceptions::User)
         end
       end
     end
@@ -348,7 +348,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
           let(:password) { salted_sha512_password }
 
           it "should raise an error" do
-            expect { run_requirements }.to raise_error
+            expect { run_requirements }.to raise_error(Chef::Exceptions::User)
           end
         end
 
@@ -357,7 +357,7 @@ ea18e18b720e358e7fbe3cfbeaa561456f6ba008937a30"
 
           describe "when salt and iteration is not set" do
             it "should raise an error" do
-              expect { run_requirements }.to raise_error
+              expect { run_requirements }.to raise_error(Chef::Exceptions::User)
             end
           end
 
diff --git a/spec/unit/resource/file/verification_spec.rb b/spec/unit/resource/file/verification_spec.rb
index f55f6416aa..bc51eccaef 100644
--- a/spec/unit/resource/file/verification_spec.rb
+++ b/spec/unit/resource/file/verification_spec.rb
@@ -43,7 +43,7 @@ describe Chef::Resource::File::Verification do
     it "expects a string argument" do
       v = Chef::Resource::File::Verification.new(parent_resource, nil, {}) {}
       expect { v.verify("/foo/bar") }.to_not raise_error
-      expect { v.verify }.to raise_error
+      expect { v.verify }.to raise_error(ArgumentError)
     end
 
     it "accepts an options hash" do
diff --git a/spec/unit/resource/file_spec.rb b/spec/unit/resource/file_spec.rb
index c93a213480..19304cb6b8 100644
--- a/spec/unit/resource/file_spec.rb
+++ b/spec/unit/resource/file_spec.rb
@@ -70,8 +70,8 @@ describe Chef::Resource::File do
     expect { @resource.verify {} }.not_to raise_error
     expect { @resource.verify "" }.not_to raise_error
     expect { @resource.verify :json }.not_to raise_error
-    expect { @resource.verify true }.to raise_error
-    expect { @resource.verify false }.to raise_error
+    expect { @resource.verify true }.to raise_error(ArgumentError)
+    expect { @resource.verify false }.to raise_error(ArgumentError)
   end
 
   it "should accept multiple verify statements" do
diff --git a/spec/unit/resource_spec.rb b/spec/unit/resource_spec.rb
index 09edbd7869..e88931fa54 100644
--- a/spec/unit/resource_spec.rb
+++ b/spec/unit/resource_spec.rb
@@ -542,7 +542,7 @@ describe Chef::Resource do
       allow(provider).to receive(:action_purr).and_raise
 
       expect(retriable_resource).to receive(:sleep).exactly(3).times
-      expect { retriable_resource.run_action(:purr) }.to raise_error
+      expect { retriable_resource.run_action(:purr) }.to raise_error(RuntimeError)
       expect(retriable_resource.retries).to eq(3)
     end
   end