puppetlabs/puppet — pull request #2111 by joshcooper (2013-11-26 06:02:52+00:00)
Title:  Be more explicit about when the SYSTEM ACE is overwritten

Previously, when the specs were not run as SYSTEM, the mode property
would be considered out-of-sync, due to the S_IEXTRA bit being set. So
puppet would rebuild the DACL and remove the inherited SYSTEM ACEs as
expected in the test.

When the specs were run as SYSTEM, the mode was not out-of-sync. This
is because the default DACL for the SYSTEM accounts sets the owner to
Administrators, group to SYSTEM, and an effective mode of 0770. In
other words, there were only two ACEs and they could be mapped into
our POSIX mode.

Commit 5a2d7b89d fixed this by explicitly setting the group to 'None'
thereby forcing the resource to be out-of-sync. However, this means
that the resource was out-of-sync in the SYSTEM case due to the group
property, and out-of-sync in the non-SYSTEM case due to the mode
property.

This commit makes the specs more explicit about when the resource is
insync and not. The former is pending, the latter explicitly sets the
owner and group to 'None', something that will never happen by
default.