Issue #5240 has been updated by Nigel Kersten.
Thank you for that excellent summary. <blockquote> If a file resource is defined, given content, but not given an explicit owner/group, there is certainly a conundrum regarding what to do about owner/group if the file need be created. However, in the situation where the file already exists on the client it seems the sane thing to do regarding owner/group when nothing is specified, is nothing. </blockquote> Yes. I'm arguing with you that the sane thing in the latter case is to do nothing, but I'm unsure what we should do in the former case. I think the most logical thing to do is to treat it just like a user creating a file, so pick the user/group that the client is running as, but we should log this and make it obvious what is going on. Another viewpoint would be that the owner/group *are* mandatory values. You can't create files without them, so we could be brutal and fail to apply such resources. That seems less than ideal. ---------------------------------------- Bug #5240: Default ownership https://projects.puppetlabs.com/issues/5240 Author: Markus Falb Status: Investigating Priority: Normal Assignee: Nigel Kersten Category: file Target version: Affected Puppet version: 0.25.5 Keywords: Branch: file { "/bla/bla.txt": ensure => file, source => "puppet:///bla/bla.txt", } The file on puppetmaster belongs to user x with uid y and it is created on the client with uid y whatever user this translates to. A user for uid y may or may not exists on the client. uids/gids on puppetmaster and puppetd are not necessarily synchronised. If I forget to set a ownership explicitly possibly unrelated users on the client may access files. This behaviour is potentially unsecure. On puppetmaster (note the -n switch): #$ ls -n bla.txt -rw-r--r-- 1 502 301 4 8 Nov 16:25 bla.txt The result on the client (user/group does not exist): #$ ls -l bla.txt -rw-r--r-- 1 502 301 4 Nov 8 16:39 bla.txt Expected behaviour: I would like to rely on reasonable defaults. When no user/group is explicitly defined, files should be created with ownership of the user puppet runs as: #$ ls -l bla.txt -rw-r--r-- 1 root root 4 Nov 8 16:39 bla.txt -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://projects.puppetlabs.com/my/account -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/puppet-bugs?hl=en.
