3 files changed, 57 insertions, 2 deletions
diff --git a/lib/chef/provider/service.rb b/lib/chef/provider/service.rb
index d716e44342..bb6de35d78 100644
--- a/lib/chef/provider/service.rb
+++ b/lib/chef/provider/service.rb
@@ -56,6 +56,9 @@ class Chef
         if @new_resource.running.nil?
           @new_resource.running(@current_resource.running)
         end
+        if ( @new_resource.masked.nil? )
+          @new_resource.masked(@current_resource.masked)
+        end
       end
 
       def shared_resource_requirements
@@ -97,6 +100,32 @@ class Chef
         @new_resource.enabled(false)
       end
 
+      def action_mask
+        if @current_resource.masked
+          Chef::Log.debug("#{@new_resource} already masked - nothing to do")
+        else
+          converge_by("mask service #{@new_resource}") do
+            mask_service
+            Chef::Log.info("#{@new_resource} masked")
+          end
+        end
+        load_new_resource_state
+        @new_resource.masked(true)
+      end
+
+      def action_unmask
+        if @current_resource.masked
+          converge_by("unmask service #{@new_resource}") do
+            unmask_service
+            Chef::Log.info("#{@new_resource} masked")
+          end
+        else
+          Chef::Log.debug("#{@new_resource} already unmasked - nothing to do")
+        end
+        load_new_resource_state
+        @new_resource.masked(false)
+      end
+
       def action_start
         unless @current_resource.running
           converge_by("start service #{@new_resource}") do
diff --git a/lib/chef/provider/service/systemd.rb b/lib/chef/provider/service/systemd.rb
index e70576fea7..9948d28c0f 100644
--- a/lib/chef/provider/service/systemd.rb
+++ b/lib/chef/provider/service/systemd.rb
@@ -48,12 +48,14 @@ class Chef::Provider::Service::Systemd < Chef::Provider::Service::Simple
         @status_check_success = false
         current_resource.running(false)
         current_resource.enabled(false)
+        current_resource.masked(false)
       end
     else
       current_resource.running(is_active?)
     end
 
     current_resource.enabled(is_enabled?)
+    current_resource.masked(is_masked?)
     current_resource
   end
 
@@ -119,6 +121,14 @@ class Chef::Provider::Service::Systemd < Chef::Provider::Service::Simple
     shell_out!("#{systemctl_path} disable #{new_resource.service_name}")
   end
 
+  def mask_service
+    shell_out!("#{systemctl_path} mask #{new_resource.service_name}")
+  end
+
+  def unmask_service
+    shell_out!("#{systemctl_path} unmask #{new_resource.service_name}")
+  end
+
   def is_active?
     shell_out("#{systemctl_path} is-active #{new_resource.service_name} --quiet").exitstatus == 0
   end
@@ -127,6 +137,11 @@ class Chef::Provider::Service::Systemd < Chef::Provider::Service::Simple
     shell_out("#{systemctl_path} is-enabled #{new_resource.service_name} --quiet").exitstatus == 0
   end
 
+  def is_masked?
+    s = shell_out("#{systemctl_path} is-enabled #{new_resource.service_name}")
+    s..exitstatus != 0 && s.stdout.include?('masked', 'masked-runtime')
+  end
+
   private
 
   def systemctl_path
diff --git a/lib/chef/resource/service.rb b/lib/chef/resource/service.rb
index 849afebad0..616af6cf11 100644
--- a/lib/chef/resource/service.rb
+++ b/lib/chef/resource/service.rb
@@ -24,16 +24,18 @@ class Chef
     class Service < Chef::Resource
       identity_attr :service_name
 
-      state_attrs :enabled, :running
+      state_attrs :enabled, :running, :masked
 
       default_action :nothing
-      allowed_actions :enable, :disable, :start, :stop, :restart, :reload
+      allowed_actions :enable, :disable, :start, :stop, :restart, :reload,
+                      :mask, :unmask
 
       def initialize(name, run_context = nil)
         super
         @service_name = name
         @enabled = nil
         @running = nil
+        @masked = nil
         @parameters = nil
         @pattern = service_name
         @start_command = nil
@@ -140,6 +142,15 @@ class Chef
         )
       end
 
+      # if the service is masked or not
+      def masked(arg=nil)
+        set_or_return(
+          :masked,
+          arg,
+          :kind_of => [ TrueClass, FalseClass ]
+        )
+      end
+
       # Priority arguments can have two forms:
       #
       # - a simple number, in which the default start runlevels get