Jira (PUP-1258) Puppet should be filesystem ACL aware

Patrick Hemmer (JIRA) Mon, 30 Dec 2013 10:43:42 -0800

Title: Message Title

Patrick Hemmer commented on an issue

Here is a provider I wrote which subclasses the POSIX provider, and uses getfacl/setfacl to manage permissions. It properly solves all the issues listed.

                                                        Unable to find source-code formatter for language: ruby. Available languages are: actionscript, html, java, _javascript_, none, sql, xhtml, xml
                                                    
Puppet::Type.type(:file).provide :posix_facl, :parent => :posix do
  desc "Uses POSIX & file ACL functionality to manage file ownership and permissions."
  initvars
  commands :getfacl => 'getfacl', :setfacl => 'setfacl'

  def mode
    mode = super
    return mode unless mode.is_a?(String)
    mode = mode.to_i(8)

    output = getfacl('--', resource[:path])
    mode_parts = {}
    output.split("\n").each do |line|
      next if line[0] == '#'
      if line.match(/^(user|group|other)::(\S+)/) then
        mode_parts[$1] = $2
      end
    end
    mode_str = "u=#{mode_parts['user'].gsub('-','')},g=#{mode_parts['group'].gsub('-','')},o=#{mode_parts['other'].gsub('-','')}"

    # we take the original mode from the POSIX provider, strip off the last 3 octal digits, and replace them with what we got from `getfacl`
    mode = (mode & 07000) | (resource.symbolic_mode_to_int(mode_str) & 0777)

    mode.to_s(8)
  end

  def mode=(value)
    setfacl('-m', "user::#{value[-3]},group::#{value[-2]},other::#{value[-1]}", '--', resource[:path])
    if value.length >= 4 then
      # we also need to set flags (which can't be done with setfacl (without a `--restore`)). Pull the current mode, strip off the flags, then add our flags on to it, and then use the normal chmod
      File.chmod((File.stat(resource[:path]).mode & 00777) | (value.to_i(8) & 07000), resource[:path])
    end
  end
end

Add Comment

Puppet /

PUP-1258

Puppet should be aware of when filesystem ACLs are present on a file, and behave just slightly differently on said files.

I've seen other feature requests asking to support filesystem ACLs and this isn't that. It'll be best to explain with an example scenario.

Lets say you have the file '/foo/bar' with an ACL 'mask::rwx' and 'group::r-x'.
Now lets ...

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/groups/opt_out.

Jira (PUP-1258) Puppet should be filesystem ACL aware

Reply via email to