Skip to content

Commit 9990f2e

Browse files
committed
Set script's group to 0 if script owner is root
When files on a puppetmaster are owned by a non-root user, concatfragments.sh gets installed on the nodes with a group owner matching the one of the master. This has no security implications since the file is mode 755, but does lead to possible ping-pong situations when switching between environments where the files on the master have different group ownership. Use '0' instead of 'root', since the root user's main group isn't always 'root' on some BSDs, but always '0'.
1 parent 30fbfe1 commit 9990f2e

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

manifests/setup.pp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@
3737

3838
$script_owner = $::osfamily ? { 'windows' => undef, default => $::id }
3939

40+
$script_group = $script_owner ? { 'root' => '0', default => undef }
41+
4042
$script_mode = $::osfamily ? { 'windows' => undef, default => '0755' }
4143

4244
$script_command = $::osfamily? {
@@ -51,6 +53,7 @@
5153
file { $script_path:
5254
ensure => file,
5355
owner => $script_owner,
56+
group => $script_group,
5457
mode => $script_mode,
5558
source => "puppet:///modules/concat/${script_name}",
5659
}

0 commit comments

Comments
 (0)