{"action":"created","issue":{"url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/204","repository_url":"https://api.github.com/repos/TomPoulton/hiera-eyaml","labels_url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/204/comments","events_url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/204/events","html_url":"https://github.com/TomPoulton/hiera-eyaml/issues/204","id":170141982,"number":204,"title":"eyamp.pp breaks ACLs on Ext4 file systems","user":{"login":"FayeG","id":12444986,"avatar_url":"https://avatars.githubusercontent.com/u/12444986?v=3","gravatar_id":"","url":"https://api.github.com/users/FayeG","html_url":"https://github.com/FayeG","followers_url":"https://api.github.com/users/FayeG/followers","following_url":"https://api.github.com/users/FayeG/following{/other_user}","gists_url":"https://api.github.com/users/FayeG/gists{/gist_id}","starred_url":"https://api.github.com/users/FayeG/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FayeG/subscriptions","organizations_url":"https://api.github.com/users/FayeG/orgs","repos_url":"https://api.github.com/users/FayeG/repos","events_url":"https://api.github.com/users/FayeG/events{/privacy}","received_events_url":"https://api.github.com/users/FayeG/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-09T11:20:26Z","updated_at":"2016-08-09T11:32:35Z","closed_at":"2016-08-09T11:32:34Z","body":"The eyamp.pp class defined the private key permissions to be 0600. This value is hard coded.\r\n\r\nHowever when working with a team we use ACL on ext4 using a mask of r--. While this doesn't open up the permissions any more than needed it unfortunately means that via \"ls -l\" the file looks like it has 0640 permissions when actually is has \"-rw-r-----+\" and when looking at the ACL 'group' and 'other' are both set to \"---\", viz:\r\n\r\n0 codo:~\\# getfacl /etc/puppet/keys/private_key.pkcs7.pem\r\ngetfacl: Removing leading '/' from absolute path names\r\n\\# file: etc/puppet/keys/private_key.pkcs7.pem\r\n\\# owner: puppet\r\n\\# group: puppet\r\nuser::rw-\r\nuser:someuser:r-x              #effective:**r--**\r\ngroup::---\r\nmask::r--\r\nother::---\r\n\r\n0 codo:~# ls -l /etc/puppet/keys/private_key.pkcs7.pem\r\n-rw-r-----+ 1 puppet puppet 1675 Aug  4 14:57 /etc/puppet/keys/private_key.pkcs7.pem\r\n0 codo:~#\r\n\r\nOf course  eyamp.pp \"fixes\" this by setting it back to \"0600\" and damages the ACL while doing so, viz:\r\n\r\n0 codo:~# puppet_run.sh \r\nInfo: Retrieving pluginfacts\r\nInfo: Retrieving plugin\r\nInfo: Loading facts\r\nInfo: Loading facts\r\nInfo: Caching catalog for codo.xxx.xxx\r\nInfo: Applying configuration version '[test] 6df1c6c Change Phoenix dnsmasq servers. Both are now link local.'\r\nNotice: /Stage[main]/Hiera::Eyaml/File[/etc/puppet/keys/private_key.pkcs7.pem]/mode: mode changed '0640' to '0600'\r\nNotice: Finished catalog run in 58.87 seconds\r\n0 codo:~# getfacl /etc/puppet/keys/private_key.pkcs7.pem\r\ngetfacl: Removing leading '/' from absolute path names\r\n\\# file: etc/puppet/keys/private_key.pkcs7.pem\r\n\\# owner: puppet\r\n\\# group: puppet\r\nuser::rw-\r\nuser:someuser:r-x              #effective:**---**\r\ngroup::---\r\nmask::---\r\nother::---\r\n\r\n0 codo:~#\r\n\r\nPlease can the permissions of the private key be made optional so we can pass a value of \"0640\" into it? \r\nWe already have puppet classes that can handle the ACL part.\r\n"},"comment":{"url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/comments/238526613","html_url":"https://github.com/TomPoulton/hiera-eyaml/issues/204#issuecomment-238526613","issue_url":"https://api.github.com/repos/TomPoulton/hiera-eyaml/issues/204","id":238526613,"user":{"login":"sihil","id":1236466,"avatar_url":"https://avatars.githubusercontent.com/u/1236466?v=3","gravatar_id":"","url":"https://api.github.com/users/sihil","html_url":"https://github.com/sihil","followers_url":"https://api.github.com/users/sihil/followers","following_url":"https://api.github.com/users/sihil/following{/other_user}","gists_url":"https://api.github.com/users/sihil/gists{/gist_id}","starred_url":"https://api.github.com/users/sihil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sihil/subscriptions","organizations_url":"https://api.github.com/users/sihil/orgs","repos_url":"https://api.github.com/users/sihil/repos","events_url":"https://api.github.com/users/sihil/events{/privacy}","received_events_url":"https://api.github.com/users/sihil/received_events","type":"User","site_admin":false},"created_at":"2016-08-09T11:32:34Z","updated_at":"2016-08-09T11:32:34Z","body":"I believe you want to raise an issue with the `puppet-hiera` project who owns the file you are talking about (for managing `hiera-eyaml` configuration). See https://github.com/voxpupuli/puppet-hiera/blob/master/manifests/eyaml.pp\r\n\r\nThis project is for the `hiera-eyaml` plugin itself.\r\n\r\nHope you can find a solution quickly."}}
{"actor":{"display_login":"sihil"}}