File is executable when X option is set on directory

[grodriguezl]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 6.7.2
• Ruby:
• Distribution: CentOS 7
• Module version: Last commit, after fe6c5ca

Scenario

Hi
I have this directory with the following permissions:

ls -l /backup2
total 0
-rw-r--r--. 1 root     root      0 ago  2 15:40 file0
drwx------. 2 postgres postgres 19 ago  2 15:40 test1
drwx------. 2 root     root      6 ago  2 15:39 test2

How to reproduce (e.g Puppet code you use)

posix_acl { "/backup2":
    action     => set,
    permission => [
      'user:syncuser:rwX',
      'mask::rwX',
    ],
    recursive  => true,
   }

What are you seeing

File /backup2/file0 is executable

getfacl file0
# file: file0
# owner: root
# group: root
user::rw-
user:syncuser:rwx
group::r--
mask::rwx
other::r--

What behaviour did you expect instead

File /backup2/file0 is not executable.
I would expect every file inside /backup2 to be not executable and every dir inside /backup executable.

getfacl file0
# file: file0
# owner: root
# group: root
user::rw-
user:syncuser:rw-
group::r--
mask::rw-
other::r--

Debug log

Executing: '/usr/bin/setfacl -R -n -m user:syncuser:rwx /backup2'
Executing: '/usr/bin/setfacl -R -n -m mask::rwx /backup2'

Any additional information you'd like to impart

If I run setfacl -n -R -m u:syncuser:rwX /backup2 and setfacl -n -R -m m::rwX /backup2 manually the result is the expected one with file0 being not executable

[ekohl]

Fixed in #61 but unreleased.

[grodriguezl]

I am using the latest and unreleased version from master branch (after #61).

This line

puppet-posix_acl/lib/puppet/provider/posix_acl/posixacl.rb

Line 91 in fe6c5ca

new_perm = @resource.value(:permission).map(&:downcase)

changes X to x for comparison purposes.

Later

puppet-posix_acl/lib/puppet/provider/posix_acl/posixacl.rb

Line 92 in fe6c5ca

perm_to_set = new_perm - cur_perm

puppet-posix_acl/lib/puppet/provider/posix_acl/posixacl.rb

Lines 107 to 108 in fe6c5ca

	perm_to_set.each do |perm|
	set_perm(perm, @resource.value(:path))

perm_to_set has x instead of X. At the end, the applied permission is x which makes all files within a directory executables.

[ekohl]

Apologies, didn't read carefully.

[ekohl]

@jadestorm could you have a look?

[jadestorm]

@ekohl Hrm. I'll take a look but it probably won't be for a few days or even potentially weeks as things are busy at work. Feel free to revert the PR and I'll resubmit if you want! Regardless I'll try to take care of it asap. =) Thanks!

[jadestorm]

@ekohl I'm working on this right now btw -- I'll submit a second PR for the fix. Thanks for catching this @grodriguezl !

[jadestorm]

See #65 In my tests it solved the issue. It's not the cleanest thing in the world.