Merge pull request #835 from wyardley/wyardley-703

[fix] ownership and permissions on conf files

Author: bastelfreak

manifests/config.pp

@@ -146,23 +146,23 @@
 
   file { '/etc/rabbitmq':
     ensure => directory,
-    owner  => '0',
-    group  => '0',
-    mode   => '0755',
+    owner  => $rabbitmq_user,
+    group  => $rabbitmq_group,
+    mode   => '2755',
   }
 
   file { '/etc/rabbitmq/ssl':
     ensure => directory,
-    owner  => '0',
-    group  => '0',
-    mode   => '0755',
+    owner  => $rabbitmq_user,
+    group  => $rabbitmq_group,
+    mode   => '2750',
   }
 
   file { 'rabbitmq.config':
     ensure  => file,
     path    => $config_path,
     content => template($config),
-    owner   => '0',
+    owner   => $rabbitmq_user,
     group   => $rabbitmq_group,
     mode    => '0640',
   }
@@ -171,7 +171,7 @@
     ensure  => file,
     path    => $env_config_path,
     content => template($env_config),
-    owner   => '0',
+    owner   => $rabbitmq_user,
     group   => $rabbitmq_group,
     mode    => '0640',
   }
@@ -180,7 +180,7 @@
     ensure  => file,
     path    => $inetrc_config_path,
     content => template($inetrc_config),
-    owner   => '0',
+    owner   => $rabbitmq_user,
     group   => $rabbitmq_group,
     mode    => '0640',
   }
@@ -190,7 +190,7 @@
       ensure  => file,
       path    => '/etc/rabbitmq/enabled_plugins',
       content => template('rabbitmq/enabled_plugins.erb'),
-      owner   => '0',
+      owner   => $rabbitmq_user,
       group   => $rabbitmq_group,
       mode    => '0640',
       require => File['/etc/rabbitmq'],
@@ -202,7 +202,7 @@
       ensure  => file,
       path    => '/etc/rabbitmq/rabbitmqadmin.conf',
       content => template('rabbitmq/rabbitmqadmin.conf.erb'),
-      owner   => '0',
+      owner   => $rabbitmq_user,
       group   => $rabbitmq_group,
       mode    => '0640',
       require => File['/etc/rabbitmq'],

spec/acceptance/class_spec.rb

@@ -37,6 +37,19 @@ class { 'erlang': epel_enable => true}
       it { is_expected.to be_enabled }
       it { is_expected.to be_running }
     end
+
+    describe file('/etc/rabbitmq') do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_owned_by 'rabbitmq' }
+      it { is_expected.to be_grouped_into 'rabbitmq' }
+    end
+
+    describe file('/etc/rabbitmq/ssl') do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_owned_by 'rabbitmq' }
+      it { is_expected.to be_grouped_into 'rabbitmq' }
+      it { is_expected.not_to be_readable.by('others') }
+    end
   end
 
   context 'disable and stop service' do

spec/classes/rabbitmq_spec.rb

@@ -310,21 +310,34 @@
         it {
           is_expected.to contain_file('/etc/rabbitmq').with(
             'ensure' => 'directory',
-            'mode'   => '0755'
+            'owner'  => 'rabbitmq',
+            'group'  => 'rabbitmq',
+            'mode'   => '2755'
           )
         }
       end
 
       describe 'manages configuration file correctly' do
         it {
           is_expected.to contain_file('rabbitmq.config').with(
-            'owner' => '0',
+            'owner' => 'rabbitmq',
             'group' => 'rabbitmq',
             'mode'  => '0640'
           )
         }
       end
 
+      describe 'manages SSL directory correctly' do
+        it {
+          is_expected.to contain_file('/etc/rabbitmq/ssl').with(
+            'ensure' => 'directory',
+            'owner'  => 'rabbitmq',
+            'group'  => 'rabbitmq',
+            'mode'   => '2750'
+          )
+        }
+      end
+
       describe 'does not contain pre-ranch settings with default config' do
         it do
           is_expected.to contain_file('rabbitmq.config'). \