puppetlabs/puppet — pull request #1891 by jpartlow (2013-09-11 20:47:05+00:00)
Title: (22273) Puppet manages owner/group of own vardir

lib/puppet/defaults.rb has :vardir as a directory setting, but did not
specify an owner or group. If the user/group is changed and puppet is
restarted with a --mkusers setting, vardir will be owned by the previous
user uid, and puppet master will fail to access information under
/var/lib/puppet (if permissions are strict enough). This first
manifests as an inability to read the ca cert under
/var/lib/puppet/ssl/certs. (This assumes running puppet master as root,
which will attempt to manage settings as the service user 'puppet' and
then daemonize as puppet).

This change addes :owner, :group settings of 'service' to the :vardir
entry.