1

Im trying to puppetize a module which will ensure I have the same path on servers for storing local log files for custom web applications. As such I would like to set the SGID to ensure that even if the file/dirs are owned by apache, anyone belonging to the filer group can still rwx to the same assets. However I am having a problem in setting the mode, I've tried both numeric (2775) and symbolic (u+rwx,g+rwxs,o+rw) and neither appear to work. Here are the results I've seen:

  • Numeric: Appears to behave like 775 (completely ignoring the first value). Even though, according to the docs, puppet states that 2775 is supported, I suspect it's not supported for 2.7.x.

  • Symbolic: It sort of works, except I end up with the following (notice the lowercase t): drwxrwsrwt

Is there another way? Should I just run an Exec and run a shell command to do the chmod g+s?

--- Update 1.23.2014 ---

Weird, so I ran the same test as Zoredache and ended up with the following:

root@dev-a-1 /tmp/puppet # -> puppet --version
2.7.24

root@dev-a-1 /tmp/puppet # -> cat test.pp
file { '/tmp/puppet/test_dir': ensure => directory, mode => 2755 }

root@dev-a-1 /tmp/puppet # -> ls
total 24
drwxr-xr-x. 3 root root  4096 Jan 23 22:03 .
drwxrwxrwx. 8 root root 12288 Jan 23 22:00 ..
drwxr-sr-x. 2 root root  4096 Jan 23 22:03 test_dir
-rw-r--r--. 1 root root    67 Jan 23 22:03 test.pp

--- Update 1.23.2014 #2 ---

I failed to mention, in the op, that the mode was being set in a hiera config file. I didn't mention it because I didn't think it would have caused the issue. However, when I added quotes around the mode ("2755") in the hiera config, everything started working as expected.

Improve this question

2 Answers 2

Reset to default
0

It seems to work find for me

root@srv:~# puppet --version
2.7.23

root@srv:~# cat test.pp
file {'/root/test.pp':
  mode => 2775
}

root@srv:~# puppet apply test.pp
notice: Finished catalog run in 0.06 seconds

root@srv:~# ls -al test.pp
-rwxrwsr-x 1 root root 40 Jan 22 22:54 test.pp

Silly question, but the underlying filesystem supports sgid right? Try simplifying your rules, maybe do an strace on your puppet run and see if the permissions are being set and then being reverted by something you didn't expect.

Improve this answer
5
  • What the heck... Hmmm quite possible it may be upstream. Thanks I'll see if I can sniff it out. For now I just did a separate Exec call and seems to work.
    – Mike Purcell
    Jan 23, 2014 at 7:01
  • Still not sure why mine isn't working, as the mode is being set via file directive with no upstream default, but as you have demonstrated, puppet 2.7 does support numeric SGID, so accepting answer. Thanks again.
    – Mike Purcell
    Jan 23, 2014 at 17:23
  • Have you tried by just creating a simple test.pp and applying it? What do you see if you do a strace -e chmod puppet apply test.pp, and what do you see if you do a strace -e chmod puppet agent --test?
    – Zoredache
    Jan 23, 2014 at 17:29
  • Ran both and didn't see anything out of the ordinary. Added some notes to op.
    – Mike Purcell
    Jan 23, 2014 at 22:28
  • Weird, I failed to mention that mode was being pulled from a hiera yaml file. When I added quotes around the 0755 in the config, everything started working as expected. Although it still doesn't explain my test similation behavior.
    – Mike Purcell
    Jan 23, 2014 at 22:49
1

The filesystem (in your case /tmp) might be mounted with nosuid option.

Improve this answer
1
  • Hmmm good point. I tried from /root/_temp/puppet, and still got drwxr-sr-x. on the dir.
    – Mike Purcell
    Jan 24, 2014 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .