user provider cleanup

* removes more run_command
* converts to shell_out_compact
* some other misc style cleanup

Signed-off-by: Lamont Granquist <lamont@scriptkiddie.org>

7 files changed, 168 insertions, 179 deletions

diff --git a/lib/chef/provider/user/aix.rb b/lib/chef/provider/user/aix.rb
index 8ac229ae4d..0e81c76bbc 100644
--- a/lib/chef/provider/user/aix.rb
+++ b/lib/chef/provider/user/aix.rb
@@ -23,7 +23,7 @@ class Chef
         provides :user, os: "aix"
         provides :aix_user
 
-        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:shell, "-s"], [:uid, "-u"]]
+        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:shell, "-s"], [:uid, "-u"]].freeze
 
         def create_user
           super
@@ -44,53 +44,52 @@ class Chef
         end
 
         def check_lock
-          lock_info = shell_out!("lsuser -a account_locked #{new_resource.username}")
+          lock_info = shell_out_compact!("lsuser", "-a", "account_locked", new_resource.username)
           if whyrun_mode? && passwd_s.stdout.empty? && lock_info.stderr.match(/does not exist/)
             # if we're in whyrun mode and the user is not yet created we assume it would be
             return false
           end
-          raise Chef::Exceptions::User, "Cannot determine if #{@new_resource} is locked!" if lock_info.stdout.empty?
+          raise Chef::Exceptions::User, "Cannot determine if #{new_resource} is locked!" if lock_info.stdout.empty?
 
           status = /\S+\s+account_locked=(\S+)/.match(lock_info.stdout)
-          if status && status[1] == "true"
-            @locked = true
-          else
-            @locked = false
-          end
+          @locked =
+            if status && status[1] == "true"
+              true
+            else
+              false
+            end
 
           @locked
         end
 
         def lock_user
-          shell_out!("chuser account_locked=true #{new_resource.username}")
+          shell_out_compact!("chuser", "account_locked=true", new_resource.username)
         end
 
         def unlock_user
-          shell_out!("chuser account_locked=false #{new_resource.username}")
+          shell_out_compact!("chuser", "account_locked=false", new_resource.username)
         end
 
         private
 
         def add_password
-          if @current_resource.password != @new_resource.password && @new_resource.password
-            Chef::Log.debug("#{@new_resource.username} setting password to #{@new_resource.password}")
-            command = "echo '#{@new_resource.username}:#{@new_resource.password}' | chpasswd -e"
-            shell_out!(command)
-          end
+          return unless current_resource.password != new_resource.password && new_resource.password
+          Chef::Log.debug("#{new_resource.username} setting password to #{new_resource.password}")
+          command = "echo '#{new_resource.username}:#{new_resource.password}' | chpasswd -e"
+          shell_out!(command)
         end
 
         # Aix specific handling to update users home directory.
         def manage_home
+          return unless updating_home? && managing_home_dir?
           # -m option does not work on aix, so move dir.
-          if updating_home? && managing_home_dir?
-            universal_options.delete("-m")
-            if ::File.directory?(@current_resource.home)
-              Chef::Log.debug("Changing users home directory from #{@current_resource.home} to #{new_resource.home}")
-              shell_out!("mv #{@current_resource.home} #{new_resource.home}")
-            else
-              Chef::Log.debug("Creating users home directory #{new_resource.home}")
-              shell_out!("mkdir -p #{new_resource.home}")
-            end
+          universal_options.delete("-m")
+          if ::File.directory?(current_resource.home)
+            Chef::Log.debug("Changing users home directory from #{current_resource.home} to #{new_resource.home}")
+            FileUtils.mv current_resource.home, new_resource.home
+          else
+            Chef::Log.debug("Creating users home directory #{new_resource.home}")
+            FileUtils.mkdir_p new_resource.home
           end
         end
 
diff --git a/lib/chef/provider/user/dscl.rb b/lib/chef/provider/user/dscl.rb
index 16d60ba116..2302a874e2 100644
--- a/lib/chef/provider/user/dscl.rb
+++ b/lib/chef/provider/user/dscl.rb
@@ -65,12 +65,12 @@ class Chef
           end
 
           requirements.assert(:all_actions) do |a|
-            a.assertion { ::File.exists?("/usr/bin/dscl") }
+            a.assertion { ::File.exist?("/usr/bin/dscl") }
             a.failure_message(Chef::Exceptions::User, "Cannot find binary '/usr/bin/dscl' on the system for #{new_resource}!")
           end
 
           requirements.assert(:all_actions) do |a|
-            a.assertion { ::File.exists?("/usr/bin/plutil") }
+            a.assertion { ::File.exist?("/usr/bin/plutil") }
             a.failure_message(Chef::Exceptions::User, "Cannot find binary '/usr/bin/plutil' on the system for #{new_resource}!")
           end
 
@@ -199,7 +199,7 @@ user password using shadow hash.")
         # Create a user using dscl
         #
         def dscl_create_user
-          run_dscl("create /Users/#{new_resource.username}")
+          run_dscl("create", "/Users/#{new_resource.username}")
         end
 
         #
@@ -208,7 +208,7 @@ user password using shadow hash.")
         #
         def dscl_create_comment
           comment = new_resource.comment || new_resource.username
-          run_dscl("create /Users/#{new_resource.username} RealName '#{comment}'")
+          run_dscl("create", "/Users/#{new_resource.username}", "RealName", comment)
         end
 
         #
@@ -224,7 +224,7 @@ user password using shadow hash.")
             raise(Chef::Exceptions::RequestedUIDUnavailable, "uid #{new_resource.uid} is already in use")
           end
 
-          run_dscl("create /Users/#{new_resource.username} UniqueID #{new_resource.uid}")
+          run_dscl("create", "/Users/#{new_resource.username}", "UniqueID", new_resource.uid)
         end
 
         #
@@ -235,7 +235,7 @@ user password using shadow hash.")
           uid = nil
           base_uid = new_resource.system ? 200 : 500
           next_uid_guess = base_uid
-          users_uids = run_dscl("list /Users uid")
+          users_uids = run_dscl("list", "/Users", "uid")
           while next_uid_guess < search_limit + base_uid
             if users_uids =~ Regexp.new("#{Regexp.escape(next_uid_guess.to_s)}\n")
               next_uid_guess += 1
@@ -244,7 +244,7 @@ user password using shadow hash.")
               break
             end
           end
-          return uid || raise("uid not found. Exhausted. Searched #{search_limit} times")
+          uid || raise("uid not found. Exhausted. Searched #{search_limit} times")
         end
 
         #
@@ -252,18 +252,18 @@ user password using shadow hash.")
         #
         def uid_used?(uid)
           return false unless uid
-          users_uids = run_dscl("list /Users uid").split("\n")
-          uid_map = users_uids.inject({}) do |tmap, tuid|
+          users_uids = run_dscl("list", "/Users", "uid").split("\n")
+          uid_map = users_uids.each_with_object({}) do |tuid, tmap|
             x = tuid.split
             tmap[x[1]] = x[0]
             tmap
           end
           if uid_map[uid.to_s]
-            unless uid_map[uid.to_s] == new_resource.username.to_s
+            unless uid_map[uid.to_s] == new_resource.username
               return true
             end
           end
-          return false
+          false
         end
 
         #
@@ -277,14 +277,14 @@ user password using shadow hash.")
             new_resource.gid(STAFF_GROUP_ID)
           elsif !new_resource.gid.to_s.match(/^\d+$/)
             begin
-              possible_gid = run_dscl("read /Groups/#{new_resource.gid} PrimaryGroupID").split(" ").last
-            rescue Chef::Exceptions::DsclCommandFailed => e
-              raise Chef::Exceptions::GroupIDNotFound.new("Group not found for #{new_resource.gid} when creating user #{new_resource.username}")
+              possible_gid = run_dscl("read", "/Groups/#{new_resource.gid}", "PrimaryGroupID").split(" ").last
+            rescue Chef::Exceptions::DsclCommandFailed
+              raise Chef::Exceptions::GroupIDNotFound, "Group not found for #{new_resource.gid} when creating user #{new_resource.username}"
             end
             # XXX: mutates the new resource
             new_resource.gid(possible_gid) if possible_gid && possible_gid.match(/^\d+$/)
           end
-          run_dscl("create /Users/#{new_resource.username} PrimaryGroupID '#{new_resource.gid}'")
+          run_dscl("create", "/Users/#{new_resource.username}", "PrimaryGroupID", new_resource.gid)
         end
 
         #
@@ -293,7 +293,7 @@ user password using shadow hash.")
         #
         def dscl_set_home
           if new_resource.home.nil? || new_resource.home.empty?
-            run_dscl("delete /Users/#{new_resource.username} NFSHomeDirectory")
+            run_dscl("delete", "/Users/#{new_resource.username}", "NFSHomeDirectory")
             return
           end
 
@@ -308,7 +308,7 @@ user password using shadow hash.")
               move_home
             end
           end
-          run_dscl("create /Users/#{new_resource.username} NFSHomeDirectory '#{new_resource.home}'")
+          run_dscl("create", "/Users/#{new_resource.username}", "NFSHomeDirectory", new_resource.home)
         end
 
         def validate_home_dir_specification!
@@ -318,17 +318,17 @@ user password using shadow hash.")
         end
 
         def current_home_exists?
-          ::File.exist?("#{current_resource.home}")
+          ::File.exist?(current_resource.home)
         end
 
         def new_home_exists?
-          ::File.exist?("#{new_resource.home}")
+          ::File.exist?(new_resource.home)
         end
 
         def ditto_home
           skel = "/System/Library/User Template/English.lproj"
-          raise(Chef::Exceptions::User, "can't find skel at: #{skel}") unless ::File.exists?(skel)
-          shell_out! "ditto '#{skel}' '#{new_resource.home}'"
+          raise(Chef::Exceptions::User, "can't find skel at: #{skel}") unless ::File.exist?(skel)
+          shell_out_compact!("ditto", skel, new_resource.home)
           ::FileUtils.chown_R(new_resource.username, new_resource.gid.to_s, new_resource.home)
         end
 
@@ -338,7 +338,7 @@ user password using shadow hash.")
           src = current_resource.home
           FileUtils.mkdir_p(new_resource.home)
           files = ::Dir.glob("#{Chef::Util::PathHelper.escape_glob_dir(src)}/*", ::File::FNM_DOTMATCH) - ["#{src}/.", "#{src}/.."]
-          ::FileUtils.mv(files, new_resource.home, :force => true)
+          ::FileUtils.mv(files, new_resource.home, force: true)
           ::FileUtils.rmdir(src)
           ::FileUtils.chown_R(new_resource.username, new_resource.gid.to_s, new_resource.home)
         end
@@ -347,10 +347,10 @@ user password using shadow hash.")
         # Sets the shell for the user using dscl.
         #
         def dscl_set_shell
-          if new_resource.shell || ::File.exists?("#{new_resource.shell}")
-            run_dscl("create /Users/#{new_resource.username} UserShell '#{new_resource.shell}'")
+          if new_resource.shell
+            run_dscl("create", "/Users/#{new_resource.username}", "UserShell", new_resource.shell)
           else
-            run_dscl("create /Users/#{new_resource.username} UserShell '/usr/bin/false'")
+            run_dscl("create", "/Users/#{new_resource.username}", "UserShell", "/usr/bin/false")
           end
         end
 
@@ -367,9 +367,8 @@ user password using shadow hash.")
 
           # Shadow info is saved as binary plist. Convert the info to binary plist.
           shadow_info_binary = StringIO.new
-          command = Mixlib::ShellOut.new("plutil -convert binary1 -o - -",
-                                         :input => shadow_info.to_plist, :live_stream => shadow_info_binary)
-          command.run_command
+          shell_out_compact("plutil", "-convert", "binary1", "-o", "-", "-",
+                            input: shadow_info.to_plist, live_stream: shadow_info_binary)
 
           if user_info.nil?
             # User is  just created. read_user_info() will read the fresh information
@@ -401,7 +400,7 @@ user password using shadow hash.")
                            # Create a random 4 byte salt
                            salt = OpenSSL::Random.random_bytes(4)
                            encoded_password = OpenSSL::Digest::SHA512.hexdigest(salt + new_resource.password)
-                           hash_value = salt.unpack("H*").first + encoded_password
+                           salt.unpack("H*").first + encoded_password
                          end
 
             shadow_info["SALTED-SHA512"] = StringIO.new
@@ -449,21 +448,21 @@ user password using shadow hash.")
           end
 
           # Remove the user from its groups
-          run_dscl("list /Groups").each_line do |group|
+          run_dscl("list", "/Groups").each_line do |group|
             if member_of_group?(group.chomp)
-              run_dscl("delete /Groups/#{group.chomp} GroupMembership '#{new_resource.username}'")
+              run_dscl("delete", "/Groups/#{group.chomp}", "GroupMembership", new_resource.username)
             end
           end
 
           # Remove user account
-          run_dscl("delete /Users/#{new_resource.username}")
+          run_dscl("delete", "/Users/#{new_resource.username}")
         end
 
         #
         # Locks the user.
         #
         def lock_user
-          run_dscl("append /Users/#{new_resource.username} AuthenticationAuthority ';DisabledUser;'")
+          run_dscl("append", "/Users/#{new_resource.username}", "AuthenticationAuthority", ";DisabledUser;")
         end
 
         #
@@ -471,7 +470,7 @@ user password using shadow hash.")
         #
         def unlock_user
           auth_string = authentication_authority.gsub(/AuthenticationAuthority: /, "").gsub(/;DisabledUser;/, "").strip
-          run_dscl("create /Users/#{new_resource.username} AuthenticationAuthority '#{auth_string}'")
+          run_dscl("create", "/Users/#{new_resource.username}", "AuthenticationAuthority", auth_string)
         end
 
         #
@@ -489,7 +488,7 @@ user password using shadow hash.")
         # This is the interface base User provider requires to provide idempotency.
         #
         def check_lock
-          return @locked = locked?
+          @locked = locked?
         end
 
         #
@@ -501,11 +500,11 @@ user password using shadow hash.")
         # given attribute.
         #
         def diverged?(parameter)
-          parameter_updated?(parameter) && (not new_resource.send(parameter).nil?)
+          parameter_updated?(parameter) && !new_resource.send(parameter).nil?
         end
 
         def parameter_updated?(parameter)
-          not (new_resource.send(parameter) == current_resource.send(parameter))
+          !(new_resource.send(parameter) == current_resource.send(parameter))
         end
 
         #
@@ -551,7 +550,7 @@ user password using shadow hash.")
         def member_of_group?(group_name)
           membership_info = ""
           begin
-            membership_info = run_dscl("read /Groups/#{group_name}")
+            membership_info = run_dscl("read", "/Groups/#{group_name}")
           rescue Chef::Exceptions::DsclCommandFailed
             # Raised if the group doesn't contain any members
           end
@@ -568,14 +567,14 @@ user password using shadow hash.")
 
         # A simple map of Chef's terms to DSCL's terms.
         DSCL_PROPERTY_MAP = {
-          :uid => "uid",
-          :gid => "gid",
-          :home => "home",
-          :shell => "shell",
-          :comment => "realname",
-          :password => "passwd",
-          :auth_authority => "authentication_authority",
-          :shadow_hash => "ShadowHashData",
+          uid: "uid",
+          gid: "gid",
+          home: "home",
+          shell: "shell",
+          comment: "realname",
+          password: "passwd",
+          auth_authority: "authentication_authority",
+          shadow_hash: "ShadowHashData",
         }.freeze
 
         # Directory where the user plist files are stored for versions 10.7 and above
@@ -590,11 +589,11 @@ user password using shadow hash.")
 
           # We flush the cache here in order to make sure that we read fresh information
           # for the user.
-          shell_out("dscacheutil '-flushcache'")
+          shell_out_compact("dscacheutil", "-flushcache") # FIXME: this is MacOS version dependent
 
           begin
             user_plist_file = "#{USER_PLIST_DIRECTORY}/#{new_resource.username}.plist"
-            user_plist_info = run_plutil("convert xml1 -o - #{user_plist_file}")
+            user_plist_info = run_plutil("convert", "xml1", "-o", "-", user_plist_file)
             user_info = Plist.parse_xml(user_plist_info)
           rescue Chef::Exceptions::PlistUtilCommandFailed
           end
@@ -609,7 +608,7 @@ user password using shadow hash.")
         def save_user_info(user_info)
           user_plist_file = "#{USER_PLIST_DIRECTORY}/#{new_resource.username}.plist"
           Plist::Emit.save_plist(user_info, user_plist_file)
-          run_plutil("convert binary1 #{user_plist_file}")
+          run_plutil("convert", "binary1", user_plist_file)
         end
 
         #
@@ -658,7 +657,9 @@ user password using shadow hash.")
         end
 
         def run_dscl(*args)
-          result = shell_out("dscl . -#{args.join(' ')}")
+          argdup = args.dup
+          cmd = argdup.shift
+          result = shell_out_compact("dscl", ".", "-#{cmd}", argdup)
           return "" if ( args.first =~ /^delete/ ) && ( result.exitstatus != 0 )
           raise(Chef::Exceptions::DsclCommandFailed, "dscl error: #{result.inspect}") unless result.exitstatus == 0
           raise(Chef::Exceptions::DsclCommandFailed, "dscl error: #{result.inspect}") if result.stdout =~ /No such key: /
@@ -666,17 +667,19 @@ user password using shadow hash.")
         end
 
         def run_plutil(*args)
-          result = shell_out("plutil -#{args.join(' ')}")
+          argdup = args.dup
+          cmd = argdup.shift
+          result = shell_out_compact("plutil", "-#{cmd}", argdup)
           raise(Chef::Exceptions::PlistUtilCommandFailed, "plutil error: #{result.inspect}") unless result.exitstatus == 0
           if result.stdout.encoding == Encoding::ASCII_8BIT
-            result.stdout.encode("utf-8", "binary", :undef => :replace, :invalid => :replace, :replace => "?")
+            result.stdout.encode("utf-8", "binary", undef: :replace, invalid: :replace, replace: "?")
           else
             result.stdout
           end
         end
 
         def convert_binary_plist_to_xml(binary_plist_string)
-          Mixlib::ShellOut.new("plutil -convert xml1 -o - -", :input => binary_plist_string).run_command.stdout
+          shell_out_compact("plutil", "-convert", "xml1", "-o", "-", "-", input: binary_plist_string).stdout
         end
 
         def convert_to_binary(string)
diff --git a/lib/chef/provider/user/linux.rb b/lib/chef/provider/user/linux.rb
index 968cf771e4..445421ad38 100644
--- a/lib/chef/provider/user/linux.rb
+++ b/lib/chef/provider/user/linux.rb
@@ -24,23 +24,23 @@ class Chef
         provides :user, os: "linux"
 
         def create_user
-          shell_out!(*clean_array("useradd", universal_options, useradd_options, new_resource.username))
+          shell_out_compact!("useradd", universal_options, useradd_options, new_resource.username)
         end
 
         def manage_user
-          shell_out!(*clean_array("usermod", universal_options, usermod_options, new_resource.username))
+          shell_out_compact!("usermod", universal_options, usermod_options, new_resource.username)
         end
 
         def remove_user
-          shell_out!(*clean_array("userdel", userdel_options, new_resource.username))
+          shell_out_compact!("userdel", userdel_options, new_resource.username)
         end
 
         def lock_user
-          shell_out!(*clean_array("usermod", "-L", new_resource.username))
+          shell_out_compact!("usermod", "-L", new_resource.username)
         end
 
         def unlock_user
-          shell_out!(*clean_array("usermod", "-U", new_resource.username))
+          shell_out_compact!("usermod", "-U", new_resource.username)
         end
 
         # common to usermod and useradd
@@ -69,11 +69,11 @@ class Chef
         def useradd_options
           opts = []
           opts << "-r" if new_resource.system
-          if managing_home_dir?
-            opts << "-m"
-          else
-            opts << "-M"
-          end
+          opts << if managing_home_dir?
+                    "-m"
+                  else
+                    "-M"
+                  end
           opts
         end
 
@@ -97,15 +97,12 @@ class Chef
         def check_lock
           # there's an old bug in rhel (https://bugzilla.redhat.com/show_bug.cgi?id=578534)
           # which means that both 0 and 1 can be success.
-          passwd_s = shell_out("passwd", "-S", new_resource.username, returns: [ 0, 1 ])
+          passwd_s = shell_out_compact("passwd", "-S", new_resource.username, returns: [ 0, 1 ])
 
           # checking "does not exist" has to come before exit code handling since centos and ubuntu differ in exit codes
           if passwd_s.stderr =~ /does not exist/
-            if whyrun_mode?
-              return false
-            else
-              raise Chef::Exceptions::User, "User #{new_resource.username} does not exist when checking lock status for #{new_resource}"
-            end
+            return false if whyrun_mode?
+            raise Chef::Exceptions::User, "User #{new_resource.username} does not exist when checking lock status for #{new_resource}"
           end
 
           # now raise if we didn't get a 0 or 1 (see above)
diff --git a/lib/chef/provider/user/pw.rb b/lib/chef/provider/user/pw.rb
index b210374eb9..42d862a983 100644
--- a/lib/chef/provider/user/pw.rb
+++ b/lib/chef/provider/user/pw.rb
@@ -27,49 +27,45 @@ class Chef
 
         def load_current_resource
           super
-          raise Chef::Exceptions::User, "Could not find binary /usr/sbin/pw for #{@new_resource}" unless ::File.exists?("/usr/sbin/pw")
+          raise Chef::Exceptions::User, "Could not find binary /usr/sbin/pw for #{new_resource}" unless ::File.exist?("/usr/sbin/pw")
         end
 
         def create_user
-          command = "pw useradd"
-          command << set_options
-          run_command(:command => command)
+          shell_out_compact!("pw", "useradd", set_options)
           modify_password
         end
 
         def manage_user
-          command = "pw usermod"
-          command << set_options
-          run_command(:command => command)
+          shell_out_compact!("pw", "usermod", set_options)
           modify_password
         end
 
         def remove_user
-          command = "pw userdel #{@new_resource.username}"
-          command << " -r" if managing_home_dir?
-          run_command(:command => command)
+          command = [ "pw", "userdel", new_resource.username ]
+          command << "-r" if managing_home_dir?
+          shell_out_compact!(command)
         end
 
         def check_lock
-          case @current_resource.password
-          when /^\*LOCKED\*/
-            @locked = true
-          else
-            @locked = false
-          end
+          @locked = case current_resource.password
+                    when /^\*LOCKED\*/
+                      true
+                    else
+                      false
+                    end
           @locked
         end
 
         def lock_user
-          run_command(:command => "pw lock #{@new_resource.username}")
+          shell_out_compact!("pw", "lock", new_resource.username)
         end
 
         def unlock_user
-          run_command(:command => "pw unlock #{@new_resource.username}")
+          shell_out_compact!("pw", "unlock", new_resource.username)
         end
 
         def set_options
-          opts = " #{@new_resource.username}"
+          opts = [ new_resource.username ]
 
           field_list = {
             "comment" => "-c",
@@ -80,26 +76,26 @@ class Chef
           }
           field_list.sort { |a, b| a[0] <=> b[0] }.each do |field, option|
             field_symbol = field.to_sym
-            if @current_resource.send(field_symbol) != @new_resource.send(field_symbol)
-              if @new_resource.send(field_symbol)
-                Chef::Log.debug("#{@new_resource} setting #{field} to #{@new_resource.send(field_symbol)}")
-                opts << " #{option} '#{@new_resource.send(field_symbol)}'"
-              end
+            next unless current_resource.send(field_symbol) != new_resource.send(field_symbol)
+            if new_resource.send(field_symbol)
+              Chef::Log.debug("#{new_resource} setting #{field} to #{new_resource.send(field_symbol)}")
+              opts << option
+              opts << new_resource.send(field_symbol)
             end
           end
           if managing_home_dir?
-            Chef::Log.debug("#{@new_resource} is managing the users home directory")
-            opts << " -m"
+            Chef::Log.debug("#{new_resource} is managing the users home directory")
+            opts << "-m"
           end
           opts
         end
 
         def modify_password
-          if (not @new_resource.password.nil?) && (@current_resource.password != @new_resource.password)
+          if !new_resource.password.nil? && (current_resource.password != new_resource.password)
             Chef::Log.debug("#{new_resource} updating password")
-            command = "pw usermod #{@new_resource.username} -H 0"
-            status = popen4(command, :waitlast => true) do |pid, stdin, stdout, stderr|
-              stdin.puts "#{@new_resource.password}"
+            command = "pw usermod #{new_resource.username} -H 0"
+            status = popen4(command, waitlast: true) do |pid, stdin, stdout, stderr|
+              stdin.puts new_resource.password.to_s
             end
 
             unless status.exitstatus == 0
diff --git a/lib/chef/provider/user/solaris.rb b/lib/chef/provider/user/solaris.rb
index 7aa0ceb93a..4e772312ae 100644
--- a/lib/chef/provider/user/solaris.rb
+++ b/lib/chef/provider/user/solaris.rb
@@ -26,7 +26,7 @@ class Chef
       class Solaris < Chef::Provider::User::Useradd
         provides :solaris_user
         provides :user, os: %w{omnios solaris2}
-        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:shell, "-s"], [:uid, "-u"]]
+        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:shell, "-s"], [:uid, "-u"]].freeze
 
         attr_writer :password_file
 
@@ -46,22 +46,22 @@ class Chef
         end
 
         def check_lock
-          user = IO.read(@password_file).match(/^#{Regexp.escape(@new_resource.username)}:([^:]*):/)
+          user = IO.read(@password_file).match(/^#{Regexp.escape(new_resource.username)}:([^:]*):/)
 
           # If we're in whyrun mode, and the user is not created, we assume it will be
           return false if whyrun_mode? && user.nil?
 
-          raise Chef::Exceptions::User, "Cannot determine if #{@new_resource} is locked!" if user.nil?
+          raise Chef::Exceptions::User, "Cannot determine if #{new_resource} is locked!" if user.nil?
 
           @locked = user[1].start_with?("*LK*")
         end
 
         def lock_user
-          shell_out!("passwd", "-l", new_resource.username)
+          shell_out_compact!("passwd", "-l", new_resource.username)
         end
 
         def unlock_user
-          shell_out!("passwd", "-u", new_resource.username)
+          shell_out_compact!("passwd", "-u", new_resource.username)
         end
 
         private
@@ -82,10 +82,9 @@ class Chef
         end
 
         def manage_password
-          if @current_resource.password != @new_resource.password && @new_resource.password
-            Chef::Log.debug("#{@new_resource} setting password to #{@new_resource.password}")
-            write_shadow_file
-          end
+          return unless current_resource.password != new_resource.password && new_resource.password
+          Chef::Log.debug("#{new_resource} setting password to #{new_resource.password}")
+          write_shadow_file
         end
 
         def write_shadow_file
@@ -93,7 +92,7 @@ class Chef
           ::File.open(@password_file) do |shadow_file|
             shadow_file.each do |entry|
               user = entry.split(":").first
-              if user == @new_resource.username
+              if user == new_resource.username
                 buffer.write(updated_password(entry))
               else
                 buffer.write(entry)
@@ -104,7 +103,7 @@ class Chef
 
           # FIXME: mostly duplicates code with file provider deploying a file
           s = ::File.stat(@password_file)
-          mode = s.mode & 07777
+          mode = s.mode & 0o7777
           uid  = s.uid
           gid  = s.gid
 
@@ -116,7 +115,7 @@ class Chef
 
         def updated_password(entry)
           fields = entry.split(":")
-          fields[1] = @new_resource.password
+          fields[1] = new_resource.password
           fields[2] = days_since_epoch
           fields.join(":")
         end
diff --git a/lib/chef/provider/user/useradd.rb b/lib/chef/provider/user/useradd.rb
index 35a106b0b6..cf6f4e727f 100644
--- a/lib/chef/provider/user/useradd.rb
+++ b/lib/chef/provider/user/useradd.rb
@@ -23,25 +23,25 @@ class Chef
   class Provider
     class User
       class Useradd < Chef::Provider::User
-        # MAJOR XXX: this should become the base class of all Useradd providers instead of the linux implementation
+        # the linux version of this has been forked off, this is the base class now of solaris and AIX and should be abandoned
+        # and those provider should be rewritten like the linux version.
 
-        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:password, "-p"], [:shell, "-s"], [:uid, "-u"]]
+        UNIVERSAL_OPTIONS = [[:comment, "-c"], [:gid, "-g"], [:password, "-p"], [:shell, "-s"], [:uid, "-u"]].freeze
 
         def create_user
           command = compile_command("useradd") do |useradd|
             useradd.concat(universal_options)
             useradd.concat(useradd_options)
           end
-          shell_out!(*command)
+          shell_out_compact!(command)
         end
 
         def manage_user
-          unless universal_options.empty?
-            command = compile_command("usermod") do |u|
-              u.concat(universal_options)
-            end
-            shell_out!(*command)
+          return if universal_options.empty?
+          command = compile_command("usermod") do |u|
+            u.concat(universal_options)
           end
+          shell_out_compact!(command)
         end
 
         def remove_user
@@ -49,19 +49,19 @@ class Chef
           command << "-r" if managing_home_dir?
           command << "-f" if new_resource.force
           command << new_resource.username
-          shell_out!(*command)
+          shell_out_compact!(command)
         end
 
         def check_lock
           # we can get an exit code of 1 even when it's successful on
           # rhel/centos (redhat bug 578534). See additional error checks below.
-          passwd_s = shell_out!("passwd", "-S", new_resource.username, :returns => [0, 1])
+          passwd_s = shell_out_compact!("passwd", "-S", new_resource.username, returns: [0, 1])
           if whyrun_mode? && passwd_s.stdout.empty? && passwd_s.stderr.match(/does not exist/)
             # if we're in whyrun mode and the user is not yet created we assume it would be
             return false
           end
 
-          raise Chef::Exceptions::User, "Cannot determine if #{@new_resource} is locked!" if passwd_s.stdout.empty?
+          raise Chef::Exceptions::User, "Cannot determine if #{new_resource} is locked!" if passwd_s.stdout.empty?
 
           status_line = passwd_s.stdout.split(" ")
           case status_line[1]
@@ -76,7 +76,7 @@ class Chef
           unless passwd_s.exitstatus == 0
             raise_lock_error = false
             if %w{redhat centos}.include?(node[:platform])
-              passwd_version_check = shell_out!("rpm -q passwd")
+              passwd_version_check = shell_out_compact!("rpm", "-q", "passwd")
               passwd_version = passwd_version_check.stdout.chomp
 
               unless passwd_version == "passwd-0.73-1"
@@ -93,11 +93,11 @@ class Chef
         end
 
         def lock_user
-          shell_out!("usermod", "-L", new_resource.username)
+          shell_out_compact!("usermod", "-L", new_resource.username)
         end
 
         def unlock_user
-          shell_out!("usermod", "-U", new_resource.username)
+          shell_out_compact!("usermod", "-U", new_resource.username)
         end
 
         def compile_command(base_command)
@@ -130,12 +130,10 @@ class Chef
         end
 
         def update_options(field, option, opts)
-          if @current_resource.send(field).to_s != new_resource.send(field).to_s
-            if new_resource.send(field)
-              Chef::Log.debug("#{new_resource} setting #{field} to #{new_resource.send(field)}")
-              opts << option << new_resource.send(field).to_s
-            end
-          end
+          return unless current_resource.send(field).to_s != new_resource.send(field).to_s
+          return unless new_resource.send(field)
+          Chef::Log.debug("#{new_resource} setting #{field} to #{new_resource.send(field)}")
+          opts << option << new_resource.send(field).to_s
         end
 
         def useradd_options
@@ -150,8 +148,8 @@ class Chef
           # Pathname#cleanpath does a better job than ::File::expand_path (on both unix and windows)
           # ::File.expand_path("///tmp") == ::File.expand_path("/tmp") => false
           # ::File.expand_path("\\tmp") => "C:/tmp"
-          return true if @current_resource.home.nil? && new_resource.home
-          new_resource.home && Pathname.new(@current_resource.home).cleanpath != Pathname.new(new_resource.home).cleanpath
+          return true if current_resource.home.nil? && new_resource.home
+          new_resource.home && Pathname.new(current_resource.home).cleanpath != Pathname.new(new_resource.home).cleanpath
         end
 
       end
diff --git a/lib/chef/provider/user/windows.rb b/lib/chef/provider/user/windows.rb
index b086a1e32b..0afa8fa14a 100644
--- a/lib/chef/provider/user/windows.rb
+++ b/lib/chef/provider/user/windows.rb
@@ -31,31 +31,30 @@ class Chef
 
         def initialize(new_resource, run_context)
           super
-          @net_user = Chef::Util::Windows::NetUser.new(@new_resource.username)
+          @net_user = Chef::Util::Windows::NetUser.new(new_resource.username)
         end
 
         def load_current_resource
-          if @new_resource.gid
+          if new_resource.gid
             Chef::Log.warn("The 'gid' attribute is not implemented by the Windows platform. Please use the 'group' resource to assign a user to a group.")
           end
 
-          @current_resource = Chef::Resource::User.new(@new_resource.name)
-          @current_resource.username(@new_resource.username)
-          user_info = nil
+          @current_resource = Chef::Resource::User.new(new_resource.name)
+          current_resource.username(new_resource.username)
           begin
             user_info = @net_user.get_info
 
-            @current_resource.uid(user_info[:user_id])
-            @current_resource.comment(user_info[:full_name])
-            @current_resource.home(user_info[:home_dir])
-            @current_resource.shell(user_info[:script_path])
+            current_resource.uid(user_info[:user_id])
+            current_resource.comment(user_info[:full_name])
+            current_resource.home(user_info[:home_dir])
+            current_resource.shell(user_info[:script_path])
           rescue Chef::Exceptions::UserIDNotFound => e
             # e.message should be "The user name could not be found" but checking for that could cause a localization bug
             @user_exists = false
-            Chef::Log.debug("#{@new_resource} does not exist (#{e.message})")
+            Chef::Log.debug("#{new_resource} does not exist (#{e.message})")
           end
 
-          @current_resource
+          current_resource
         end
 
         # Check to see if the user needs any changes
@@ -64,12 +63,12 @@ class Chef
         # <true>:: If a change is required
         # <false>:: If the users are identical
         def compare_user
-          unless @net_user.validate_credentials(@new_resource.password)
-            Chef::Log.debug("#{@new_resource} password has changed")
+          unless @net_user.validate_credentials(new_resource.password)
+            Chef::Log.debug("#{new_resource} password has changed")
             return true
           end
           [ :uid, :comment, :home, :shell ].any? do |user_attrib|
-            !@new_resource.send(user_attrib).nil? && @new_resource.send(user_attrib) != @current_resource.send(user_attrib)
+            !new_resource.send(user_attrib).nil? && new_resource.send(user_attrib) != current_resource.send(user_attrib)
           end
         end
 
@@ -98,7 +97,7 @@ class Chef
         end
 
         def set_options
-          opts = { :name => @new_resource.username }
+          opts = { name: new_resource.username }
 
           field_list = {
             "comment" => "full_name",
@@ -110,14 +109,12 @@ class Chef
 
           field_list.sort { |a, b| a[0] <=> b[0] }.each do |field, option|
             field_symbol = field.to_sym
-            if @current_resource.send(field_symbol) != @new_resource.send(field_symbol)
-              if @new_resource.send(field_symbol)
-                unless field_symbol == :password
-                  Chef::Log.debug("#{@new_resource} setting #{field} to #{@new_resource.send(field_symbol)}")
-                end
-                opts[option.to_sym] = @new_resource.send(field_symbol)
-              end
+            next unless current_resource.send(field_symbol) != new_resource.send(field_symbol)
+            next unless new_resource.send(field_symbol)
+            unless field_symbol == :password
+              Chef::Log.debug("#{new_resource} setting #{field} to #{new_resource.send(field_symbol)}")
             end
+            opts[option.to_sym] = new_resource.send(field_symbol)
           end
           opts
         end