saltstack/salt — pull request #1680 by grierj (2012-07-24 21:57:14+00:00)
Title: Allowing more permissive pki group ownership

Allow for an optional directive that allows the salt pki_dir
to be owned by any group that root is a member of, not just
the primary group listed in the passwd directory. This is
potentially insecure, but allows some limited access for
headless accounts to run salt via the API or without sudo
if there are reasons for that to happen.

Please review closely as I don't specifically know if this
fits into acceptable parameters of your security model.
Let me know if you have any questions.