saltstack/salt — pull request #1030 by teancom (2012-03-31 21:09:44+00:00)
Title: Allow integrated software to read keys

From a comment I put right into the code:

Allow the pki dir to be 700 or 750, but nothing else.
This prevents other users from writing out keys, while
allowing the use-case of 3rd-party software (like django)
to read in what it needs to integrate.

If the permissions aren't correct, default to the more secure 700.

This will allow our custom django-based cmdb/virtualization control software to continue working.

I also did a #todo while I was in there - adding logging if we are unable to change the permissions of the pki dir to be safe.