File permissions set on manifests

[Graham Pugh]

Hi,

Since moving my munki_repo to an external Linux VM, any changes made to manifests using MunkiAdmin cause the permissions on the files to become inappropriate. The permissions are usually changed to 0700, which is no good because the user associated with the munki_repo is not 'apache', and so any http requests to read the manifest (e.g. by a client, or by MunkiWebAdmin), fail.

In my case it seems to be the case that the permissions need to be set 775. This allows Munki clients and MunkiReport-PHP to read the manifests, and the MunkiWebAdmin wsgi account, manifestutil CLI, and MunkiAdmin (both via mounted SMB share) to write to them.  Setting the permissions on the repo to 2775 worked for preventing MunkiWebAdmin from changing them, but this doesn't work from MunkiAdmin, which is manipulating the repo via a mounted SMB share.

So, my question - would it be possible to change the code in MunkiAdmin so that it doesn't affect the ownership / permissions of any manifest it changes?  (and also ideally set new manifests according to the existing permissions of the underlying 'manifests' folder).

Additionally, if it were possible to connect directly from the MunkiAdmin GUI to an smb/afp/WebDAV share, that would be very excellent!

Thanks,

Graham

[zack.m...@bsd7.org]

HI Graham,

I have the Preference to Open the Previous Repo set in mine. I just have to make sure my repo is mounted before opening MunkiAdmin. That might fix MunkiAdmin not connecting directly. As for the others, that might be a bug to mention on the Github, as that is where most of the issues are stated. You could also chown -R _apache and than add your munki user with RW privs also. I just had to chown the web user on our repo here.