Jira (PUP-6393) /var/lib/puppet/state permission check within RPM

[Mihai-George Cornateanu (JIRA)]

Title: Message Title

Mihai-George Cornateanu created an issue   Puppet / PUP-6393 /var/lib/puppet/state permission check within RPM Issue Type: Improvement Assignee: Unassigned Created: 2016/06/08 8:33 AM Priority: Normal Reporter: Mihai-George Cornateanu Found the following issue when I tried to make the system PCI-DSS v3 compliant: [root@puppet-agent ~]# rpm -Va --nofiledigest | grep '^.M' .M....... /var/lib/puppet/state [root@puppet-agent ~]# This is happening because of the permissions on /var/lib/puppet/state changes with each puppet run. RPM states that it should not have the sticky bit enabled or permissions of "others", but puppet is setting them after each run. File System RPM Package drwxr-xr-t drwxr-x--- [root@puppet-agent ~]# ls -la /var/lib/puppet | grep state drwxr-xr-t 3 puppet puppet 4096 Jun 8 14:45 state [root@puppet-agent ~]# rpm --setperms puppet [root@puppet-agent ~]# ls -la /var/lib/puppet | grep state drwxr-x--- 3 puppet puppet 4096 Jun 8 14:45 state [root@puppet-agent ~]# puppet agent --test Info: Retrieving pluginfacts [...] Notice: Finished catalog run in 2.90 seconds [root@puppet-agent ~]# ls -la /var/lib/puppet | grep state drwxr-xr-t 3 puppet puppet 4096 Jun 8 14:45 state [root@puppet-agent ~]# Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.