Jira (PUP-5491) The "client_data" Directory Permissions are Changed After Puppet Agent Run

[Ryan Gard (JIRA)]

Title: Message Title

Ryan Gard created an issue   Puppet / PUP-5491 The "client_data" Directory Permissions are Changed After Puppet Agent Run Issue Type: Bug Assignee: Ethan Brown Components: Windows Created: 2015/11/10 5:37 PM Environment: Puppet Agent: 9c0a93a43b597dca2ce14485b635389b3dfbbeca PE Version: 2015.2.1 Master OS: CentOS 7 x64 Agent OS: Windows Server 2008 R2 x64 Labels: windows Priority: Normal Reporter: Ryan Gard Description If a user runs the Puppet Agent on a Windows node after initial registration the ACE for SYSTEM is changed: C:\ProgramData\PuppetLabs\puppet\cache>icacls.exe client_data client_data BUILTIN\Administrators:(F) NT AUTHORITY\SYSTEM:(RX) Everyone:(Rc,S,RA) CREATOR OWNER:(CI)(IO)(F) CREATOR GROUP:(CI)(IO)(RX) CREATOR OWNER:(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(OI)(IO)(R)   Successfully processed 1 files; Failed processing 0 files Also the ACE for SYSTEM on other assets is weird: C:\ProgramData\PuppetLabs\puppet\cache\client_data>icacls.exe catalog\ catalog\ BUILTIN\Administrators:(I)(F) CREATOR OWNER:(I)(CI)(IO)(F) W2K8R2\None:(I)(RX) CREATOR GROUP:(I)(CI)(IO)(RX) CREATOR OWNER:(I)(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(I)(OI)(IO)(R)   Successfully processed 1 files; Failed processing 0 files C:\ProgramData\PuppetLabs\puppet\cache\client_data>icacls.exe catalog\w2k8r2.vm.json catalog\w2k8r2.vm.json BUILTIN\Administrators:(R,W,D,WDAC,WO) W2K8R2\None:(R,W) Everyone:(Rc,S,RA) NT AUTHORITY\SYSTEM:(F)   Successfully processed 1 files; Failed processing 0 files Attachments None Repro Steps Install the Puppet Agent onto the SUT. Open the Puppet Console. Register the SUT with the master: puppet agent -t --server centos7.vm --certname w2k8r2.vm Sign the cert on the master: puppet cert sign --all Run the Puppet Agent on the SUT: puppet agent -t --server centos7.vm --certname w2k8r2.vm Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\cache\client_data\catalog\" directory: cd C:\ProgramData\PuppetLabs\puppet\cache\ icacls.exe client_data\{noformat}   h2. Expect   The ACE for SYSTEM should be full control.   h2. Actual   The ACE for SYSTEM is only RX: C:\ProgramData\PuppetLabs\puppet\cache>icacls.exe client_data client_data BUILTIN\Administrators:(F) NT AUTHORITY\SYSTEM:(RX) Everyone:(Rc,S,RA) CREATOR OWNER:(CI)(IO)(F) CREATOR GROUP:(CI)(IO)(RX) CREATOR OWNER:(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(OI)(IO)(R) Successfully processed 1 files; Failed processing 0 files Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.