{"record":{"id":"9396547f6649a504","repo":"puppetlabs/puppet","slug":"do-not-directly-call-the-init-script-for-resou","errorCode":null,"errorMessage":"Do not directly call the init script for '#{@resource[:name]}'; use 'service' instead","messagePattern":"Do not directly call the init script for '#(.+?)'; use 'service' instead","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/service/redhat.rb","lineNumber":56,"sourceCode":"    # For Suse OS family, chkconfig returns 0 even if the service is disabled or non-existent\n    # Therefore, check the output for '<name>  on' (or '<name>  B for boot services)\n    # to see if it is enabled\n    return :false unless Puppet.runtime[:facter].value('os.family') != 'Suse' || output =~ /^#{name}\\s+(on|B)$/\n\n    :true\n  end\n\n  # Don't support them specifying runlevels; always use the runlevels\n  # in the init scripts.\n  def enable\n    chkconfig(\"--add\", @resource[:name])\n    chkconfig(@resource[:name], :on)\n  rescue Puppet::ExecutionFailure => detail\n    raise Puppet::Error, \"Could not enable #{name}: #{detail}\", detail.backtrace\n  end\n\n  def initscript\n    raise Puppet::Error, \"Do not directly call the init script for '#{@resource[:name]}'; use 'service' instead\"\n  end\n\n  # use hasstatus=>true when its set for the provider.\n  def statuscmd\n    ((@resource.provider.get(:hasstatus) == true) || (@resource[:hasstatus] == :true)) && [command(:service), @resource[:name], \"status\"]\n  end\n\n  def restartcmd\n    (@resource[:hasrestart] == :true) && [command(:service), @resource[:name], \"restart\"]\n  end\n\n  def startcmd\n    [command(:service), @resource[:name], \"start\"]\n  end\n\n  def stopcmd\n    [command(:service), @resource[:name], \"stop\"]\n  end","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/service/redhat.rb#L38-L74","documentation":"The redhat provider overrides initscript to unconditionally raise, deliberately blocking any code path that would execute /etc/init.d/<name> directly. All its operations go through /sbin/service instead (statuscmd/restartcmd/startcmd build command(:service) arrays); the guard exists so subclasses or base-class fallbacks that resolve the script path cannot silently bypass the service wrapper.","triggerScenarios":"Anything invoking provider.initscript on the redhat provider: custom providers inheriting from it that call super-side helpers, code calling provider.initscript directly (e.g. to inspect or execute the script), or resource attribute combinations that drop the provider back to base-class command resolution instead of the service-command paths.","commonSituations":"Module code or Bolt tasks poking provider.initscript for discovery; setting hasstatus => false / omitting the attributes such that base-class status/start paths would need the raw script; third-party providers subclassing Provider::Service::Redhat with old assumptions.","solutions":["Do not call initscript on this provider; use command(:service) based commands or the provider's own startcmd/stopcmd/statuscmd","In manifests, leave hasstatus/hasrestart unset or true on redhat-family services so the /sbin/service paths are used","For custom logic, invoke /sbin/service <name> <action> (or systemctl on EL7+) explicitly instead of the script path","If you truly need the script path, read File.join('/etc/init.d', name) yourself rather than the provider API"],"exampleFix":"# before\ndef my_start\n  [initscript, :start] # raises on the redhat provider\nend\n\n# after\ndef my_start\n  [command(:service), @resource[:name], 'start']\nend","handlingStrategy":"validation","validationCode":"# in the profile: refuse attribute combos that fall back to init-script paths on redhat\nif $provider == 'redhat' and ($hasstatus == false or $hasrestart == false) {\n  fail(\"${title}: redhat provider forbids direct init script use; keep hasstatus/hasrestart enabled\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat initscript on redhat as private API — never call it from modules, Bolt tasks, or custom providers","Leave hasstatus/hasrestart unset (or true) for redhat-family services so /sbin/service paths are used","For custom start/stop logic, set the status/start/stop commands on the resource instead of reaching into the provider"],"tags":["puppet","redhat","service","initscript","guard"],"backgroundTag":"unsupported-operation","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}