[chef] Re: Re: Re: Re: Re: Template resource: default value for mode attribute?

[Faiz Kazi < >]

On Sun, 5 Jun 2011 10:02:33 -0700
Adam Jacob 
<
 >
 wrote:

Here's an ad-hoc patch we use locally to address this problem
(shown against v0.10). 

Basically,  mv was being used to move the rendered template
to the resulting file. This has at least the following drawbacks:
1. mv may preserve mode/ownership, but the mode/ownership of
   the rendered template is not based on that of the original file.
   This means in the absence of an explicit mode, the file
   ends up with it's original mode modified (hence the bug)
2. SELinux - mv is trickier than cp.  
   
http://www.centos.org/docs/5/html/Deployment_Guide-en-US/rhlcommon-chapter-0017.html

Faiz

> Yeah - if you don't specify a mode, we shouldn't be modifying it -
> that's definitely a bug, if we're behaving that way.
> 
> Adam
> 
> On Sat, Jun 4, 2011 at 11:44 PM, Faiz Kazi 
> <
 >
> wrote:
> > Ah, I see.
> >
> > What about suggestion (1), though?  I think it might
> > be a less of a surprise to users if the effect
> > of applying a template resource respected the original
> > mode of the file (in the absence of a mode attribute).
> >
> > If requesting such a change in behavior is not an
> > option, it would still be useful for the wiki to
> > explicitly mention the umask defaults that apply
> > in the absence of a mode.
> >
> > (I'm happy to do the wiki edit if it's too much of a bother)
> >
> > Faiz
> >
> > On Fri, 3 Jun 2011 12:27:16 -0700
> > Adam Jacob 
> > <
 >
> >  wrote:
> >
> >> This is not always the default - it's going to be a reflection of
> >> the user who runs chef's umask. Most operating systems will have
> >> this be 0600, but not all of them will - so you can't rely on it
> >> as a general rule.
> >>
> >> Adam
> >>
> >> On Fri, Jun 3, 2011 at 7:43 AM, Matt Ray 
> >> <
 >
> >>  wrote:
> >> > I verified this and I've updated the Template entry on the
> >> > Resources page to reflect the default.
> >> > http://wiki.opscode.com/display/chef/Resources#Resources-Template
> >> >
> >> > Thanks,
> >> > Matt Ray
> >> > Senior Technical Evangelist | Opscode Inc.
> >> > 
 
> >> >  | (512) 731-2218
> >> > Twitter, IRC, GitHub: mattray
> >> >
> >> >
> >> >
> >> > On Thu, Jun 2, 2011 at 9:34 PM, Faiz Kazi 
> >> > <
 >
> >> > wrote:
> >> >>
> >> >> It appears that if one does not specify a mode,
> >> >> files generated/overwritten by template resources
> >> >> end up having permissions like -rw------- (0600).
> >> >>
> >> >> This seems like a sane default. But maybe the
> >> >> documentation should make this explicit.
> >> >> Right now, the template resource wiki page
> >> >> http://wiki.opscode.com/display/chef/Resources#Resources-Template
> >> >> reads:
> >> >>
> >> >> Attribute:      mode
> >> >> Description:    "The octal mode of the file - 0755"
> >> >> Default Value:  (nothing here)
> >> >>
> >> >> Take for example the simple case of managing /etc/hosts.
> >> >> This file usually has permissions -rw-r--r--.
> >> >>
> >> >> template '/etc/hosts'
> >> >>  source 'hosts.erb'
> >> >> end
> >> >>
> >> >> .. will overwrite /etc/hosts as expected, but if one
> >> >> forgets to pass in the mode attribute, '/etc/hosts'
> >> >> ends up as readable only by root (i.e., -rw-------).
> >> >>
> >> >> This is not really a major problem (I simply make sure
> >> >> to pass in a mode explicitly).
> >> >> but as a suggestion:
> >> >>
> >> >> (1) For existing files that get 'templated',
> >> >> chef-client could just leave the permissions untouched.
> >> >>
> >> >> OR
> >> >>
> >> >> (2) Fix the docs to make it very clear that unless
> >> >> one specifies a mode explicitly, the file
> >> >> created/overwritten by the template will end up
> >> >> with the default mode (and that the default
> >> >> mode is 0600, not 0755)
> >> >>
> >> >>
> >> >> For the record, I'm still running 0.9.16.
> >> >>
> >> >> Thanks,
> >> >> Faiz
> >> >>
> >> >>
> >> >>
> >> >>
> >> >
> >>
> >>
> >>
> >
> 
> 
> 
--- /home/faiz/.rvm/gems/ruby-1.9.2-p180/gems/chef-0.10.0/lib/chef/provider/template.rb	2011-06-10 14:04:39.000000000 +0900
+++ template.rb	2011-06-10 15:02:32.000000000 +0900
@@ -36,22 +36,27 @@
       end
 
       def action_create
         render_with_context(template_location) do |rendered_template|
           rendered(rendered_template)
           if ::File.exist?(@new_resource.path) && content_matches?
             Chef::Log.debug("
  content has not changed.")
             set_all_access_controls(@new_resource.path)
           else
             backup
-            set_all_access_controls(rendered_template.path)
-            FileUtils.mv(rendered_template.path, @new_resource.path)
+            set_all_access_controls(rendered_template.path) # probably not needed?
+            # cp+rm instead of mv: only the contents, not the mode, must
+            # be transfered from the rendered_template to the actual file.
+            FileUtils.cp(rendered_template.path, @new_resource.path)
+            FileUtils.rm(rendered_template.path)
+            # This will set modes/ownership only if specified with the resource.
+            set_all_access_controls(@new_resource.path)
             Chef::Log.info("
  updated content")
             @new_resource.updated_by_last_action(true)
           end
         end
       end
 
       def action_create_if_missing
         if ::File.exists?(@new_resource.path)
           Chef::Log.debug("
  exists - taking no action")
         else