@ediosyncratic , the regexp is pre-existing. I just updated it with a single character.

@markburgess, I was under the impression that chmod was called directly. If that's not the case then this change won't be sufficient. With regard to the behavior, that wasn't my experience. I have the following test policy:

    bundle agent example {
        files:
            "/tmp/foo/." perms => m("0755"), create => "true", depth_search => recurse("inf");
    }

    body perms m(m) {
        mode => "$(m)";
    }

    body depth_search recurse(d) {
        depth => "$(d)";
        xdev  => "true";
    }

This is what happens when I run it.

    /tmp/foo> ls -l
    total 0
    -r--r----- 1 root root 0 Mar 19 14:41 bar
    -r-xr----- 1 root root 0 Mar 19 14:41 baz
    /tmp/foo> sudo cf-agent -KI -f ~/cf_test/perms.cf -b example ; ls -l
    2014-03-19T14:53:43+0000     info: Using command line specified bundlesequence
    2014-03-19T14:53:43+0000     info: /example/files/'/tmp/foo/.': Object '/tmp/foo/./bar' had permission 0440, changed it to 0755
    total 0
    -rwxrwxrwx 1 root root 0 Mar 19 08:10 bar
    -rwxrwxrwx 1 root root 0 Mar 19 08:13 baz

Regular files that should not be executable are made executable.

I've tried this with the both `0755` and `ugo+rwx` perms passed to the body with the same result. If I use `0644` then the executable bit is stripped from all modes on both files. If I use `ugo+rw` then group and other do not get executable bit set on `baz`.

This is using 3.5.3.

I'm trying to replicate the behavior of `chmod -R ugo+rwX /tmp/foo`.