Create and manage /var/chef via @dir directive

[ngie]

Summary

Create and manage /var/chef via the @dir directive

This allows me to install rubygem-chef and run chef-solo out of the box
as shown in the Test Plan section.

PR: 222481

Test Plan

$ ls -ld /var/chef
ls: /var/chef: No such file or directory
$ pkg add /usr/obj/usr/ports/sysutils/rubygem-chef/work/pkg/rubygem-chef-13.2.20_1.txz
Installing rubygem-chef-13.2.20_1...
Extracting rubygem-chef-13.2.20_1: 100%
$ ls -ld /var/chef
drwxr-xr-x  2 root  wheel  512 Sep 20 15:24 /var/chef
$ pkg delete -y rubygem-chef
Updating database digests format: 100%            
Checking integrity... done (0 conflicting)        
Deinstallation has been requested for the following 1 packages (of 0 packages in the universe):      

Installed packages to be REMOVED:                 
        rubygem-chef-13.2.20_1                   

Number of packages to be removed: 1

The operation will free 33 MiB.
[1/1] Deinstalling rubygem-chef-13.2.20_1...
[1/1] Deleting files for rubygem-chef-13.2.20_1: 100%
$ ls -ld /var/chef
ls: /var/chef: No such file or directory
$

[ngie]

Manage the ownership and mode for /var/chef in the plist instead of assuming
that what was done in post-install "was enough".

[mat]

sysutils/rubygem-chef/pkg-plist

41

root, wheel and 0755 are the default, you do not need to set them.

[ngie]

sysutils/rubygem-chef/pkg-plist

41

This seems to rely on undocumented behavior from getmode/setmode and the predefined umask for whoever is building the package (which might not be 0022?). I would much rather make this explicit as the implicitness could result in a security hole being introduced into a chef install.

% umask
0022

Example (both with and without the explicit user/group/mode):

# With explicit user/group/mode
% umask 0000
% make -C /usr/ports/sysutils/rubygem-chef install
...
% ls -ld /var/chef/
drwxr-xr-x  2 root  wheel  512 Sep 26 13:55 /var/chef/

# Without explicit mode/user/group in pkg-plist
% ls -ld /var/chef/
drwxrwxrwx  2 root  wheel  512 Sep 26 13:59 /var/chef/
%

Not setting an explicit mode is ripe for failure when dealing with determinism and opens the door to potential security holes..

[ngie]

Ping.

[mat]

sysutils/rubygem-chef/pkg-plist

41

Changing umask is not supported. Maybe report this to the pkg maintainers as a bug, but do not add the default permissions to directories.

[ngie]

Remove user/group/mode tuple from @dir directive

Requested by: mat

[matthew]

Since you created the PR a month ago, you can commit this now with:

Approved by: matthew, maintainer timeout (30+ days)