Chef remote_directory permissions

chefdirectorypermissions

I have checked https://docs.chef.io/resource_remote_directory.html and http://joerussbowman.tumblr.com/post/58241535331/chef-remote-directory-is-basically first of all.

chef-client version 12.2.1

OS CentOS 6.6

I'm doing a bit of work with deploying our tomcat deployment to a node, the recipe looks like this

user 'tomcat' do
  comment 'Tomcat User generated by chef'
  uid 2004
  home '/opt/tomcat'
  shell '/bin/bash'
end

remote_directory '/opt/tomcat' do
  source 'tomcat-6.0.35'
  owner 'tomcat'
  group 'tomcat'
  mode '0755'
  files_owner 'tomcat'
  files_group 'tomcat'
  files_mode '0644'
end

remote_directory '/opt/tomcat/bin' do
  source 'bin'
  files_owner 'tomcat'
  files_group 'tomcat'
  files_mode '0755'
  owner 'tomcat'
  group 'tomcat'
  mode '0755'
end

For some reason this would leave random directories as root.root

[~~~~~~~~~~~ tomcat]~ ll
total 88
drwxr-xr-x 4 root   root    4096 Apr  8 13:59 appconfig
drwxr-xr-x 2 tomcat tomcat  4096 Apr  8 13:59 bin
drwxr-xr-x 4 tomcat tomcat  4096 Apr  8 13:59 conf
drwxr-xr-x 2 tomcat tomcat  4096 Apr  8 13:59 lib
-rw-r--r-- 1 tomcat tomcat 37951 Apr  8 13:59 LICENSE
-rw-r--r-- 1 tomcat tomcat   558 Apr  8 13:59 NOTICE
-rw-r--r-- 1 tomcat tomcat  8680 Apr  8 13:59 RELEASE-NOTES
-rw-r--r-- 1 tomcat tomcat  6670 Apr  8 13:59 RUNNING.txt
drwxr-xr-x 3 root   root    4096 Apr  8 13:59 shared
drwxr-xr-x 7 root   root    4096 Apr  8 13:59 webapps

This odd behaviour continues throughout the tree where directories are not set to tomcat.tomcat (always the same ones are left as root.root)

The only addition recipes are a java one from the supermarket and a basic one to copy over mod_jk and install httpd.

So question is – is it me doing something silly, reading the documentation incorrectly or a glitch.

If it's me, what am I doing wrong. Cheers.

Note I have also tried adding the following, which still doesn't recurs correctly.

directory '/opt/tomcat' do
  owner 'tomcat'
  group 'tomcat'
  recursive true
end

Best Answer

First off, you're not losing your mind - this is actually the intended behavior for any directory-style resource when doing recursive directory creation.

The first level of the remote directory is being set correctly - it's the recursive ones that are not.

Docs reference:

The remote_directory resource can be used to recursively create the path outside of remote directory structures, but the permissions of those outside paths are not managed. This is because the recursive attribute only applies group, mode, and owner attribute values to the remote directory itself and any inner directories the resource copies.

Here's how I'd attempt to do this:

%w(
  /opt/tomcat/appconfig
  /opt/tomcat/bin
  /opt/tomcat/shared
  /opt/tomcat/webapps
).each do |path|
  remote_directory path do
    files_owner 'tomcat'
    files_group 'tomcat'
    files_mode '0755'
    owner 'tomcat'
    group 'tomcat'
    mode '0755'
  end
end

This will loop through all of the subdirectories in the list and set their permissions correctly.

There may be some tweaks to this block based on how the files are laid out in the cookbook structure, but the general message here is that you have to manage subdirectories.

Another approach would be to use a raw Ruby method to enforce permissions like so:

ruby_block 'set permissions for tomcat dir' do
  block do
    require 'fileutils'
    FileUtils.chown 'tomcat', 'tomcat', '/opt/tomcat'
  end
  action :run
end

For more on this approach, see:

Related Topic