#import late_command
#if $str($getVar('puppet_auto_setup','')) == "1"
in-target mkdir -p /etc/puppet /var/lib/hiera && \
in-target touch /var/lib/hiera/common.yaml /etc/puppet/hiera.yaml && \
    #if $getVar('puppet_master','') != ''
in-target $late_command.late_file("""[main]
    logdir = /var/log/puppet
    rundir = /var/run/puppet
    ssldir = $vardir/ssl
    pluginsync = true
[agent]
    classfile = $vardir/classes.txt
    localconfig = $vardir/localconfig
    server = %(puppet_master)s
    report = false
    configtimeout = 600
""" % {"puppet_master": $puppet_master},
    "/etc/puppet/puppet.conf", source_method="content") \
    #else
true \
    #end if
#end if

#import late_command
#if $str($getVar('puppet_auto_setup','')) == "1"
in-target mkdir -p /etc/puppet /var/lib/hiera && \
in-target touch /var/lib/hiera/common.yaml /etc/puppet/hiera.yaml && \
in-target touch /var/log/puppet.log && \
in-target chmod 600 /var/log/puppet.log && \
    #if $getVar('puppet_master','') != ''
in-target $late_command.late_file("""[main]
    logdir = /var/log/puppet
    rundir = /var/run/puppet
    ssldir = $vardir/ssl
    pluginsync = true
[agent]
    classfile = $vardir/classes.txt
    localconfig = $vardir/localconfig
    server = %(puppet_master)s
    report = false
    configtimeout = 600
""" % {"puppet_master": $puppet_master},
    "/etc/puppet/puppet.conf", source_method="content") \
    #else
true \
    #end if
#end if

Make /var/log/puppet.log readable only to its owner
Make /var/log/puppet.log readable only to its owner

This file is currently world-readable and exposes all passwords used for
deployment, including OpenStack services and MySQL database.

The commit changes permissions only for classical provisioning.
Related review for IBP: I0be5ffd806ddf708344205fe374f716e4cd2d831

Change-Id: Ib5cbc088a572369224ba56052657069b0bbea52e
Related-bug: 1486399
