Jira (PUP-5480) Puppet does not apply inheritable SYSTEM permissions to directories it manages on Windows under certain circumstances

[Ryan Gard (JIRA)]

Title: Message Title

Ryan Gard commented on PUP-5480   Re: Puppet does not apply inheritable SYSTEM permissions to directories it manages on Windows under certain circumstances Functional Review Verified as fixed in build 9c0a93a43b597dca2ce14485b635389b3dfbbeca. Environment PE Version: 2015.2.3 Agent OS: Windows Server 2008 R2 x64 Master OS: CentOS 7 x64 Reproduction Steps Install the Puppet Agent onto the SUT. msiexec.exe /i puppet-agent-1.2.7.421.g9c0a93a-x64.msi /qn /L*V C:\Windows\TEMP\install-puppet.log PUPPET_AGENT_STARTUP_MODE=Manual Open the Puppet Console. Register the SUT with the master: puppet agent -t --server centos7.vm --certname w2k8r2.vm Sign the cert on the master: puppet cert sign --all Run the Puppet Agent on the SUT: puppet agent -t --server centos7.vm --certname w2k8r2.vm Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\cache\client_data" directory: cd C:\ProgramData\PuppetLabs\puppet\cache\ icacls.exe client_data\ Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\cache\client_data\catalog" directory: icacls.exe client_data\catalog Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\cache\client_data\catalog\w2k8r2.vm.json" file: icacls.exe client_data\catalog\w2k8r2.vm.json Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\etc\ssl" directory: cd C:\ProgramData\PuppetLabs\puppet icacls.exe etc\ssl Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs" directory: icacls.exe etc\ssl\certs Get the ACL for the "C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\w2k8r2.vm.pem" file: icacls.exe etc\ssl\certs\w2k8r2.vm.pem Console Output C:\>cd C:\ProgramData\PuppetLabs\puppet\cache\   C:\ProgramData\PuppetLabs\puppet\cache>icacls.exe client_data\ client_data\ BUILTIN\Administrators:(F) W2K8R2\None:(RX) Everyone:(Rc,S,RA) NT AUTHORITY\SYSTEM:(OI)(CI)(F) CREATOR OWNER:(CI)(IO)(F) CREATOR GROUP:(CI)(IO)(RX) CREATOR OWNER:(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(OI)(IO)(R)   Successfully processed 1 files; Failed processing 0 files   C:\ProgramData\PuppetLabs\puppet\cache>icacls.exe client_data\catalog client_data\catalog NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F) BUILTIN\Administrators:(I)(F) CREATOR OWNER:(I)(CI)(IO)(F) W2K8R2\None:(I)(RX) CREATOR GROUP:(I)(CI)(IO)(RX) CREATOR OWNER:(I)(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(I)(OI)(IO)(R)   Successfully processed 1 files; Failed processing 0 files   C:\ProgramData\PuppetLabs\puppet\cache>icacls.exe client_data\catalog\w2k8r2.vm. json client_data\catalog\w2k8r2.vm.json BUILTIN\Administrators:(R,W,D,WDAC,WO) W2K8R2\None:(R,W) Everyone:(Rc,S,RA) NT AUTHORITY\SYSTEM:(F)   Successfully processed 1 files; Failed processing 0 files   C:\ProgramData\PuppetLabs\puppet\cache>cd ..   C:\ProgramData\PuppetLabs\puppet>icacls.exe etc\ssl etc\ssl BUILTIN\Administrators:(F) W2K8R2\None:(RX,W,DC) Everyone:(Rc,S,X,RA) NT AUTHORITY\SYSTEM:(OI)(CI)(F) CREATOR OWNER:(CI)(IO)(F) CREATOR GROUP:(CI)(IO)(RX,W,DC) CREATOR OWNER:(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(OI)(IO)(R,W,DC)   Successfully processed 1 files; Failed processing 0 files   C:\ProgramData\PuppetLabs\puppet>icacls.exe etc\ssl\certs etc\ssl\certs BUILTIN\Administrators:(F) W2K8R2\None:(RX) Everyone:(RX) NT AUTHORITY\SYSTEM:(OI)(CI)(F) CREATOR OWNER:(CI)(IO)(F) CREATOR GROUP:(CI)(IO)(RX) CREATOR OWNER:(OI)(IO)(R,W,D,WDAC,WO,DC) CREATOR GROUP:(OI)(IO)(R)   Successfully processed 1 files; Failed processing 0 files   C:\ProgramData\PuppetLabs\puppet>icacls.exe etc\ssl\certs\w2k8r2.vm.pem etc\ssl\certs\w2k8r2.vm.pem NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(R,W,D,WDAC,WO,DC) W2K8R2\None:(I)(R)   Successfully processed 1 files; Failed processing 0 files Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.