charmhelpers/contrib/openstack/files/policy_rc_d_script.py appears to lose executable bit upon installation

[Paul Goins]

This was observed on a charm where we're newly testing deferred restarts. We found that the /var/lib/charm/<app>/policy-rc.d file was missing its executable bit, resulting in invoke-rc.d returning exit code 104 (action allowed) when it should have been returning exit code 101 (action NOT allowed).

I see that charmhelpers/contrib/openstack/files/policy_rc_d_script.py clearly has an executable bit in the repository. However, upon installation, the executable bit is no longer set. Rather than having mode 0755, it has mode 0644. (And to rule out umask-related issues, my umask is set to 0002, so I don't think that would explain this.)

I see this behavior whether I install via pip (either via wheels or via the tarball), or via "python setup.py install" on the unzipped tarball.

The side effect of this behavior is: charmhelpers/contrib/openstack.policy_rcd.py:install_policy_rcd() installs the policy-rc.d script, but without the executable bit, "invoke-rc.d <service> <action>" won't actually filter anything out. However, I can clearly see it works once I set the executable bit myself.

Indeed, it appears that charm-layer-ovn has implemented a workaround for this very issue, although the author seems to have believed this was an issue with reactive charms rather than something more general:

        if 'enable-auto-restarts' in ch_core.hookenv.config().keys():
            deferred_events.configure_deferred_restarts(
                self.deferable_services)
            # Reactive charms execute perm missing.
            os.chmod(
                '/var/lib/charm/{}/policy-rc.d'.format(
                    ch_core.hookenv.service_name()),
                0o755)

I think either something needs to be tweaked so that setup.py installs the file with the appropriate permissions, or the charmhelpers code itself needs to set the executable flag.