opscode/chef — pull request #597 by adamedx (2013-01-18 19:57:53+00:00)
Title: CHEF-3467: Cookbook file resource permissions not inherited from parent ...

...on Windows when no rights specified

The issue is that if the rights for a cookbook_file resource are left unspecified in a recipe, the target file will end up with explicit ACEs and zero inherited ACEs, even though if you were to simply create a file in the target directory yourself (through a tool or system call like CreateFile) there would be no explicit ACEs and only inherited ACEs from the parent. The latter is the behavior one would expect, and is also the behavior exhibited by the file resource itself and all other resources that derive from it.

The reason this occurs just for cookbook_file is that cookbook_file uses a special method implemented in file called deploy_tempfile that stages the target file first in a temp directory before moving it to its intended destination. Because of the unique default permissions that files under temp have and the semantics of moving files on Windows, inherited ACEs on the temp file are converted to explicit ACEs when the file is moved.

This issue does not occur if the recipe specifies some any rights at all because the inheritance flag is then set on the dacl; this is the undesirable workaround being employed by users at the moment.

The fix is a spot-fix just for this case -- for cookbook_file only, on Windows only and only if no rights are specified, set ttemp file's dacl to inherit. When the file is moved, it behaves like a file created by default in the target directory.

Note that even this very specific fix could be generalized slightly by placing it in the implementation of deploy_tempfile, though deploy_tempfile is only used by cookbook_file at the moment.