[FEATURE REQUEST] zfs.filesystem_present should support 'mode'

[darkpixel]

There currently doesn't appear to be a way to set permissions on a file, folder or zfs dataset without creating it.

For example:

/tank/mydataset:
  zfs.filesystem_present: []

Will create tank/mydataset. But if I want to set permissions on it, I need to:

set_permissions_on_mydataset:
  file.directory:
    - name: /tank/mydataset
    - owner: root
    - group: whatever
    - mode: 0777
    - require:
      - /tank/mydataset

Unfortunately what happens--especially in the ZFS world is that the dataset actually exists, but it hasn't been mounted. For example with encryption.

This causes salt to create the directory on the root filesystem and assign it permissions which don't actually apply to the dataset.

It can similarly happen when you have a system that manages files and folders outside of salt. If you want to set permissions on a folder or file, but not create it if it doesn't exist...there really isn't a way to handle it.

I have to hack something up like:

set_permissions_on_mydataset:
  cmd.run:
    - name: 'chmod 0777 /tank/mydataset'
    - unless: 'stat -c "%a" /tank/mydataset | grep 0777'

Maybe add 'permissions' to the file module?

/tank/mydataset:
  file.permissions:
    - mode: 0752

[krionbsd]

Unfortunately what happens--especially in the ZFS world is that the dataset actually exists, but it hasn't been mounted. For example with encryption.

This causes salt to create the directory on the root filesystem and assign it permissions which don't actually apply to the dataset.

That's absolutely logical, you might run zfs module to mount dataset first and then apply permissions to it in your state.

[darkpixel]

Back before ZFS supported native encryption, we used salt to manage LUKS to 'unlock' the drives, followed by a zpool import. Occasionally things wouldn't go so well and before the pool could be imported some process (like samba) would trample all over /tank followed by salt setting permissions on the unmounted filesystem. I would have to abort everything, zfs umount -a, rm -rf /tank, then zfs mount -a, make sure it worked, then go highstate again.

Fortunately the issues are less with native encryption, but they still happen.