Im trying to puppetize a module which will ensure I have the same path on servers for storing local log files for custom web applications. As such I would like to set the SGID to ensure that even if the file/dirs are owned by apache, anyone belonging to the filer group can still rwx to the same assets. However I am having a problem in setting the mode, I've tried both numeric (2775) and symbolic (u+rwx,g+rwxs,o+rw) and neither appear to work. Here are the results I've seen:

  • Numeric: Appears to behave like 775 (completely ignoring the first value). Even though, according to the docs, puppet states that 2775 is supported, I suspect it's not supported for 2.7.x.

  • Symbolic: It sort of works, except I end up with the following (notice the lowercase t): drwxrwsrwt

Is there another way? Should I just run an Exec and run a shell command to do the chmod g+s?

--- Update 1.23.2014 ---

Weird, so I ran the same test as Zoredache and ended up with the following:

root@dev-a-1 /tmp/puppet # -> puppet --version

root@dev-a-1 /tmp/puppet # -> cat test.pp
file { '/tmp/puppet/test_dir': ensure => directory, mode => 2755 }

root@dev-a-1 /tmp/puppet # -> ls
total 24
drwxr-xr-x. 3 root root  4096 Jan 23 22:03 .
drwxrwxrwx. 8 root root 12288 Jan 23 22:00 ..
drwxr-sr-x. 2 root root  4096 Jan 23 22:03 test_dir
-rw-r--r--. 1 root root    67 Jan 23 22:03 test.pp

--- Update 1.23.2014 #2 ---

I failed to mention, in the op, that the mode was being set in a hiera config file. I didn't mention it because I didn't think it would have caused the issue. However, when I added quotes around the mode ("2755") in the hiera config, everything started working as expected.


It seems to work find for me

root@srv:~# puppet --version

root@srv:~# cat test.pp
file {'/root/test.pp':
  mode => 2775

root@srv:~# puppet apply test.pp
notice: Finished catalog run in 0.06 seconds

root@srv:~# ls -al test.pp
-rwxrwsr-x 1 root root 40 Jan 22 22:54 test.pp

Silly question, but the underlying filesystem supports sgid right? Try simplifying your rules, maybe do an strace on your puppet run and see if the permissions are being set and then being reverted by something you didn't expect.

  • What the heck... Hmmm quite possible it may be upstream. Thanks I'll see if I can sniff it out. For now I just did a separate Exec call and seems to work. – Mike Purcell Jan 23 '14 at 7:01
  • Still not sure why mine isn't working, as the mode is being set via file directive with no upstream default, but as you have demonstrated, puppet 2.7 does support numeric SGID, so accepting answer. Thanks again. – Mike Purcell Jan 23 '14 at 17:23
  • Have you tried by just creating a simple test.pp and applying it? What do you see if you do a strace -e chmod puppet apply test.pp, and what do you see if you do a strace -e chmod puppet agent --test? – Zoredache Jan 23 '14 at 17:29
  • Ran both and didn't see anything out of the ordinary. Added some notes to op. – Mike Purcell Jan 23 '14 at 22:28
  • Weird, I failed to mention that mode was being pulled from a hiera yaml file. When I added quotes around the 0755 in the config, everything started working as expected. Although it still doesn't explain my test similation behavior. – Mike Purcell Jan 23 '14 at 22:49

The filesystem (in your case /tmp) might be mounted with nosuid option.

  • Hmmm good point. I tried from /root/_temp/puppet, and still got drwxr-sr-x. on the dir. – Mike Purcell Jan 24 '14 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.