cfengine/core — pull request #838 by lpefferkorn (2013-07-30 20:53:03+00:00)
Title: Give a more precise error when ACL cannot be set

Hello,

I would like to improve error message when ACL cannot be set.

Sample policy:

body common control {
bundlesequence => { "my_acl" };
}

bundle agent my_acl {
files:
"/foo"
acl => template;
}

body acl template {
acl_method => "overwrite";
acl_type => "posix";
acl_directory_inherit => "parent";
aces => {
"user:*:r(wwx),-r:allow",
"group:*:+rw:allow",
"mask:x:allow",
"all:r"
};
}

Create an immutable file (on a filesystem with ACL option, here ext4 on Debian Wheezy)
# touch /foo
# chattr +i /foo

Before the patch:

# cf-agent -lKIf ../policies/acl.cf
Error setting new Access ACL on file '/foo' (are required ACEs present?)
Failed checking access ACL on /foo
Promise belongs to bundle 'my_acl' in file '../policies/acl.cf' near line 7
Error setting new Access ACL on file '/foo' (are required ACEs present?)
Failed checking access ACL on /foo
Promise belongs to bundle 'my_acl' in file '../policies/acl.cf' near line 7

After:

# cf-agent -lKIf ../policies/acl.cf
Error setting new Access ACL on file '/foo' (acl_set_file: Operation not permitted), are required ACEs present ?
Failed checking access ACL on /foo
Promise belongs to bundle 'my_acl' in file '../policies/acl.cf' near line 7
Error setting new Access ACL on file '/foo' (acl_set_file: Operation not permitted), are required ACEs present ?
Failed checking access ACL on /foo
Promise belongs to bundle 'my_acl' in file '../policies/acl.cf' near line 7

**acl_set_file: Operation not permitted** message helps to find the error faster