Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Joshua Cooper commented on an issue Re: Allow Inheritance when setting Deny ACEs Catching up on this. Prior to 3.4.0, Puppet would silently remove deny aces present on an existing directory/file. In 3.4.0 and up, we added the ability to preserve deny aces. See 67a5aa6192f for #11563. Note this only affects cases where the deny ace is created external to puppet, and then puppet tries to manage the file resource. Puppet itself will never create a deny ace (unless you're using the ACL module). Add Comment Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs With Access Control Entries (ACEs) on Windows, we currently use [AddAccessDeniedAce|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx] which does not include inheritance and/or propagation to child objects, but [AddAccessDeniedAceEx|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx] does. We are al... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Group
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title
Tony Vu commented on an issue
Re: Allow Inheritance when setting Deny ACEs
From what I can tell, puppet 3.4.3 cannot actually create files that have explicit Deny entries inherited from the directory settings. I get something like this:
#cat test.pp
file {'C:\bob\myfile' :
ensure => file,
content => "whee",
}
#bob is an empty folder that explicitly denies write access to Users
C:\Users\Administrator>puppet apply test.pp
Notice: Compiled catalog for win-qp47voha2p4.localdomain in environment producti
on in 0.16 seconds
Error: Could not set 'file' on ensure: No such file or directory - C:/bob/myfile
20140416-656-12n3qpn.lock at 4:C:/Users/Administrator/test.pp
Error: Could not set 'file' on ensure: No such file or directory - C:/bob/myfile
20140416-656-12n3qpn.lock at 4:C:/Users/Administrator/test.pp
Wrapped exception:
No such file or directory - C:/bob/myfile20140416-656-12n3qpn.lock
Error: /Stage[main]/Main/File[C:\bob\myfile]/ensure: change from absent to file
failed: Could not set 'file' on ensure: No such file or directory - C:/bob/myfil
e20140416-656-12n3qpn.lock at 4:C:/Users/Administrator/test.pp
Notice: Finished catalog run in 0.59 seconds
The inheritance now works in 3.5.1, so now the deny entries are correctly inherited from their parent folders.
Add Comment
Puppet / PUP-2100
Allow Inheritance when setting Deny ACEs
With Access Control Entries (ACEs) on Windows, we currently use [AddAccessDeniedAce|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx] which does not include inheritance and/or propagation to child objects, but [AddAccessDeniedAceEx|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx] does. We are al...
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Tony Vu assigned an issue to Tony Vu Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Tony Vu Assignee: Tony Vu Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Kenn Hussey updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Kenn Hussey Sprint: Week 2014-3-26 to 2014-4-02 , Week 2014-4-02 to 2014-4-09 Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Peter Huene assigned an issue to Peter Huene Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Peter Huene Assignee: Peter Huene Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds commented on an issue Re: Allow Inheritance when setting Deny ACEs The fix will need to be backported into PUP-1987 targeted at Puppet.version less than 3.6.0. That will be tracked as part of ticket PUP-1987. Add Comment Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs With Access Control Entries (ACEs) on Windows, we currently use [AddAccessDeniedAce|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx] which does not include inheritance and/or propagation to child objects, but [AddAccessDeniedAceEx|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx] does. We are al... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Rob Reynolds Labels: windows Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Rob Reynolds Sprint: Week 2014-3-26 to 2014-4-02 Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Rob Reynolds We are With Access Control Entries (ACEs) on Windows, we currently using use [AddAccessDeniedAce|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx] which does not include inheritance and /or propagation to child objects , but [AddAccessDeniedAceEx|http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964(v=vs.85).aspx] does. We are already using AddAccessAllowedAceEx when setting access allowed ACEs and we should use the same behavior for denied ACEs. Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Rob Reynolds We are currently using [ AddAccessDeniedAce | http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx ] which does not include inheritance and propagation, but [ AddAccessDeniedAceEx |http://msdn.microsoft.com/en-us/library/windows/desktop/aa374964 ( v=vs.85 ) .aspx] does. We are already using AddAccessAllowedAceEx when setting allowed ACEs and we should use the same behavior for denied ACEs. Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds updated an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Change By: Rob Reynolds We are currently using AddAccessDeniedAce http://msdn.microsoft.com/en-us/library/windows/desktop/aa374962(v=vs.85).aspx which does not include inheritance and propagation, but AddAccessDeniedAceEx () does. Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-2100) Allow Inheritance when setting Deny ACEs
Title: Message Title Rob Reynolds created an issue Puppet / PUP-2100 Allow Inheritance when setting Deny ACEs Issue Type: Bug Assignee: Rob Reynolds Created: 31/Mar/14 9:54 AM Fix Versions: 3.6.0 Priority: Normal Reporter: Rob Reynolds Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.
