smoeding/puppet-file_capability

Manage Linux file capabilities with Puppet

puppet-file_capability's Issues

File capability not applied

Hi, I'm having problem with file_capability that aren't applying automatically:

Oct 14 09:24:37 w24 puppet-agent[16900]: (/File[/opt/puppetlabs/puppet/cache/lib/puppet/provider/file_capability]/ensure) created
Oct 14 09:24:38 w24 puppet-agent[16900]: (/File[/opt/puppetlabs/puppet/cache/lib/puppet/provider/file_capability/linux.rb]/ensure) defined content as 
Oct 14 09:24:47 w24 puppet-agent[16900]: (/File[/opt/puppetlabs/puppet/cache/lib/puppet/type/file_capability.rb]/ensure) defined content as '{md5}3cfc
Oct 14 09:25:27 w24 puppet-agent[16900]: (/Stage[main]/File_capability/File_capability[/usr/bin/telegraf]/ensure) created
Oct 14 09:27:03 w24 puppet-agent[16900]: Applied catalog in 109.45 seconds

the catalog was later successfully applied (but capability is not effectively set)

...
Oct 15 07:27:27 w24 puppet-agent[5769]: Applied catalog in 145.00 seconds
Oct 15 07:57:23 w24 puppet-agent[16848]: Applied catalog in 146.73 seconds
Oct 15 08:27:24 w24 puppet-agent[2603]: Applied catalog in 115.49 seconds
...

however the change is actually applied with corrective change when puppet agent -t is executed under root from shell:

$ puppet agent -t
...
Notice: /Stage[main]/File_capability/File_capability[/usr/bin/telegraf]/ensure: created (corrective)
Notice: Applied catalog in 17.64 seconds
[email protected] ~ # getcap /usr/bin/telegraf
/usr/bin/telegraf = cap_net_admin,cap_net_raw+ep

From debug log:

Debug: file_capability: exists? /usr/bin/telegraf
Debug: Executing: '/sbin/setcap -q -v cap_net_admin,cap_net_raw=ep /usr/bin/telegraf'
Debug: Executing: '/sbin/getcap -v /usr/bin/telegraf'
Debug: file_capability: create /usr/bin/telegraf
Debug: Executing: '/sbin/setcap -q cap_net_admin,cap_net_raw=ep /usr/bin/telegraf'
Notice: /Stage[main]/File_capability/File_capability[/usr/bin/telegraf]/ensure: created (corrective)
Debug: /Stage[main]/File_capability/File_capability[/usr/bin/telegraf]: The container Class[File_capability] will propagate my refresh event
Debug: Class[File_capability]: The container Stage[main] will propagate my refresh event

Puppet agent is running as root, permissions shouldn't be problem:

root     21909  0.0  0.0 230948 18740 ?        Sl   Oct13   1:04 /opt/puppetlabs/puppet/bin/ruby /opt/puppetlabs/puppet/bin/mcollectived --config=/etc/puppetlabs/mcollective/server.cfg --pidfile=/var/run/puppetlabs/mcollective.pid --daemonize

# puppet --version
5.5.16

OS is Debian 9: 4.9.110-3+deb9u6.

Any ideas what could be wrong?