Add support for setting the file mode

[koenw]

We're using the local_file provider to manage files with sensitive content, so it's nice to be able to set the file permissions too.

[koenw]

I don't understand why the test fails; locally it passes. I suspect it might have something to do with left-over artifacts from previous test runs, but I'll investigate.

[apparentlymart]

Hi @koenw! Thanks for working on this.

I'm not sure what causes the difference in the test behavior here either, but my first suspicion would be that this is being caused by umask behavior: if Travis is running the tests with a non-empty umask then certain flags within the specified mode will be ignored during creation.

To get the exact mode requested, it would be necessary to call chmod after creation to override the umask. However, I think respecting the umask is the best default behavior because that's then consistent with how files would be created by other programs in the same context. Unfortunately that makes this hard to test, because there is no portable way to update the process umask to force a predictable value. :confounded:

This sort of complexity is, unfortunately, why Terraform does not generally try to do anything special with file permissions: they are necessarily OS-specific. We generally expect the process to be running with a reasonable umask (on platforms where that is a concept) so that files will, in practice, get a good default set of permissions similar to what would happen if you created the file using shell I/O redirection, for example.

Perhaps a reasonable compromise here is to provide a boolean executable argument that can turn on/off the executable mode bits -- which are more-portably supported -- and then we can test if those in particular are set, rather than expecting the whole mode to be respected verbatim

[jukie]

Is anyone still working on this? @koenw I'd be happy to add the requested changes.

[kojiromike]

This could potentially resolve #19. Am I reading right that it's still setting 0777 by default, though? Is that intended to interact with umask?

[irnc]

Modes are now supported (implemented in pull request #30), see file_permission argument released in v1.4.0.

[hashicorp-cla]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}