python::umask has no effect on exec ressources

[jfschneider]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 7.26.0
• Ruby: ruby 2.7.8p225 (2023-03-30 revision 1f4d455848) [x86_64-linux]
• Distribution: RHEL9
• Module version: 7.0.0

How to reproduce (e.g Puppet code you use)

# cat test.pp
class {'python':
  umask => '0022'
}
python::pyvenv {'/opt/testvenv':
  ensure => 'present'
}
# umask
0077
# puppet apply test.pp
Notice: /Stage[main]/Main/Python::Pyvenv[/opt/testvenv]/File[/opt/testvenv]/ensure: created
Notice: /Stage[main]/Main/Python::Pyvenv[/opt/testvenv]/Exec[python_virtualenv_/opt/testvenv]/returns: executed successfully
Notice: Applied catalog in 7.63 seconds

What are you seeing

# ls -l /opt/testvenv
drwx------ 2 root root    181 Oct 24 13:30 bin
drwx------ 2 root root      6 Oct 24 13:30 include
drwx------ 3 root root     23 Oct 24 13:30 lib
lrwxrwxrwx 1 root root      3 Oct 24 13:30 lib64 -> lib
-rw------- 1 root root 425433 Oct 24 13:30 pip.log
-rw------- 1 root root     66 Oct 24 13:30 pyvenv.cfg

What behaviour did you expect instead

# ls -l /opt/testvenv/
total 452
drwxr-xr-x 2 root root    181 Oct 24 13:35 bin
drwxr-xr-x 2 root root      6 Oct 24 13:34 include
drwxr-xr-x 3 root root     23 Oct 24 13:34 lib
lrwxrwxrwx 1 root root      3 Oct 24 13:34 lib64 -> lib
-rw-r--r-- 1 root root 425433 Oct 24 13:35 pip.log
-rw-r--r-- 1 root root     66 Oct 24 13:34 pyvenv.cfg

Output log

Any additional information you'd like to impart

I think this would resolve the issue:

--- init.pp     2023-10-23 15:36:38.943250566 +0200
+++ init2.pp    2023-10-24 13:36:53.273864271 +0200
@@ -73,7 +73,7 @@
   -> Class['python::config']

   # Set default umask.
-  exec { default:
+  Exec {
     umask => $umask,
   }

(According to https://www.puppet.com/docs/puppet/7/lang_defaults.html)

[arlt]

@jfschneider Exec is the correct usage, but...

• python::pip has an umask parameter (without a default) and uses this umask for the exec
• python::pyenv has no umask parameter and uses no umask for the exec (only the default)

I am not a big fan of defaults like umask for exec.
The problem: The define is called e.g. from another module. If the default for exec-umask is set here, too...

I would recommend to:

• remove the exec default from init.pp (has no effect) but keep the umask parameter
• python::pyenv: add Optional[Python::Umask] $umask = $python::umask,
• python::pip: change ... $umask = $python::umask,
• use umask => $umask in each exec

Btw: python::dotfile, python::install, python::pip::bootstrap and python::requirements have no umask settings for exec, too.

The problem is, that the default umask in RHEL 9 changed.