puppetlabs/puppet — pull request #2513 by jpartlow (2014-04-07 20:53:19+00:00)
Title: (PUP-1986) Ignore source_permissions when downloading plugins on POSIX

Module pluginsync is handled by creating a Catalog with a File resource,
and Puppet's File resource defaults to replicating the source file
owner, group and mode. However, owner/group are additionally set to
Process.owner/group for a pluginsync download on POSIX, which will
typically be root during an agent run.

This combination of behavior meant that a root agent run on the puppet
master would cause Puppet's $libdir to be reset to the mode of the first
source module lib, but owned by root.

The puppet master, running as root, chuser's to the service user. In a
Webrick setup, requests are handled by that service user; in a Rack
setup, it depends on how the Rack service has been setup, but typically
it is the service user again. So, if the source module had restrictive
permissions, the puppet master, running as the service user, could end
up no longer being able to read $libdir.

On Windows, we were already setting the File type's source_permissions
parameter to :ignore when pluginsyncing. This commit sets
source_permissions to ignore regardless of the platform, leaving
$libdir's mode unchanged on POSIX as well.

TODO unfortunately this means that owner/group of $libdir are still
being managed on POSIX by pluginsync, which will take precedence over
settings. This seems wrong.