{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/22055","labels_url":"https://api.github.com/repos/saltstack/salt/issues/22055/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/22055/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/22055/events","html_url":"https://github.com/saltstack/salt/issues/22055","id":64607871,"number":22055,"title":"Running \"sudo salt-key\" resets permissions of /etc/salt/pki to root:root","user":{"login":"maschinetheist","id":11669303,"avatar_url":"https://avatars.githubusercontent.com/u/11669303?v=3","gravatar_id":"","url":"https://api.github.com/users/maschinetheist","html_url":"https://github.com/maschinetheist","followers_url":"https://api.github.com/users/maschinetheist/followers","following_url":"https://api.github.com/users/maschinetheist/following{/other_user}","gists_url":"https://api.github.com/users/maschinetheist/gists{/gist_id}","starred_url":"https://api.github.com/users/maschinetheist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maschinetheist/subscriptions","organizations_url":"https://api.github.com/users/maschinetheist/orgs","repos_url":"https://api.github.com/users/maschinetheist/repos","events_url":"https://api.github.com/users/maschinetheist/events{/privacy}","received_events_url":"https://api.github.com/users/maschinetheist/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/Info%20Needed","name":"Info Needed","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/saltstack/salt/milestones/37","html_url":"https://github.com/saltstack/salt/milestones/Blocked","labels_url":"https://api.github.com/repos/saltstack/salt/milestones/37/labels","id":343741,"number":37,"title":"Blocked","description":"Issues which are blocked in some way, whether they need further discussion, clarification, justification, or are blocked for some other reason.","creator":{"login":"basepi","id":702318,"avatar_url":"https://avatars.githubusercontent.com/u/702318?v=3","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"open_issues":353,"closed_issues":727,"state":"open","created_at":"2013-05-28T22:24:12Z","updated_at":"2016-01-26T22:22:53Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2015-03-26T18:58:22Z","updated_at":"2016-01-27T00:37:35Z","closed_at":null,"body":"This is related to similar issue described by 'mrtizmo' user in https://github.com/saltstack/salt/issues/2220.\r\n\r\nWhenever \"sudo salt-key\" is run, Salt-master resets the permissions of /etc/salt/pki to root:root.  This issue becomes apparent when someone is running salt-master as root user and when there is a requirement to keep different permissions of /etc/salt/pki (for example when you're rsyncing keys to other masters and you don't want to do it as root user).\r\n\r\nExample:\r\n```\r\n$ sudo chown -R salt:salt /etc/salt/pki\r\n\r\n$ sudo ls -l /etc/salt/pki\r\ntotal 8\r\ndrwx------. 7 salt salt 4096 Jan 15 09:12 master\r\ndrwx------. 2 salt salt 4096 Jan 15 09:13 minion\r\n\r\n$ sudo salt-key -L\r\nAccepted Keys:\r\nUnaccepted Keys:\r\nserver.fqdn\r\nRejected Keys:\r\n\r\n$ sudo ls -l /etc/salt/pki\r\ntotal 8\r\ndrwx------. 7 root root 4096 Jan 15 09:12 master\r\ndrwx------. 2 salt salt 4096 Jan 15 09:13 minion\r\n\r\n$ sudo ls -l /etc/salt/pki/master\r\ntotal 28\r\n-r-------T. 1 salt salt 3239 Jan 15 09:12 master.pem\r\n-rw-r--r-T. 1 salt salt  800 Jan 15 09:12 master.pub\r\ndrwxr-xr-t. 2 root root 4096 Mar 26 13:56 minions\r\ndrwxr-xr-t. 2 salt salt 4096 Jan 15 09:12 minions_autosign\r\ndrwxr-xr-t. 2 salt salt 4096 Jan 15 09:12 minions_denied\r\ndrwxr-xr-t. 2 root root 4096 Mar 26 13:56 minions_pre\r\ndrwxr-xr-t. 2 root root 4096 Jan 15 09:12 minions_rejected\r\n```\r\nThis happens regardless if the minion keys are accepted or listed via \"sudo salt-key\".  Is there any way to preserve the permissions of the original user instead of resetting them to root:root?  This moment, whenever salt-master is run as root and any time \"sudo salt-key\" is run, you have to chown the directory permissions manually.\r\n"},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/175314037","html_url":"https://github.com/saltstack/salt/issues/22055#issuecomment-175314037","issue_url":"https://api.github.com/repos/saltstack/salt/issues/22055","id":175314037,"user":{"login":"mianos","id":861789,"avatar_url":"https://avatars.githubusercontent.com/u/861789?v=3","gravatar_id":"","url":"https://api.github.com/users/mianos","html_url":"https://github.com/mianos","followers_url":"https://api.github.com/users/mianos/followers","following_url":"https://api.github.com/users/mianos/following{/other_user}","gists_url":"https://api.github.com/users/mianos/gists{/gist_id}","starred_url":"https://api.github.com/users/mianos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mianos/subscriptions","organizations_url":"https://api.github.com/users/mianos/orgs","repos_url":"https://api.github.com/users/mianos/repos","events_url":"https://api.github.com/users/mianos/events{/privacy}","received_events_url":"https://api.github.com/users/mianos/received_events","type":"User","site_admin":false},"created_at":"2016-01-27T00:37:35Z","updated_at":"2016-01-27T00:37:35Z","body":"This is marked as info needed. What extra info is needed?\r\nCan I provide some more info to get this looked at some time?\r\n This happens if you run master as root and minion as non root exactly as per the document."}}