Disable rights change for pdns config dir

[KawaiDesu]

Do not touch right for powerdns config and leave it as in package. Because of 750 (default is 755) I unable to place additional configuration files in config directory.

[KawaiDesu]

Failed build is unrelated to my PR:
Failed to fetch http://repo.powerdns.com/ubuntu/pool/main/p/pdns/pdns-server_4.1.3-1pdns.artful_amd64.deb 404 Not Found"

[atosatto]

Yes I can confirm that the issue with the CI is not related to your PR.
We will fix the CI and ask you to rebase your work on it.

[atosatto]

Can we explicitely set

owner: root
group: root
mode: 0755

instead of using the defaults?

[atosatto]

Ping @KawaiDesu :)

[atosatto]

Just rebased @KawaiDesu's work and implemented the code-review feedback.

[atosatto]

Thanks @KawaiDesu for digging into the file permissions set by the role.
The new permissions set by the role now makes possible to hot-reload Lua configuration and scripts files without restarting the service.

[KawaiDesu]

@atosatto sorry for long reaction.
My pull request was about to not touch rights at all, because package must set them as intended and there is no reason to check or even change them after installation. Maybe, this can be fully parameterized (mode, owner, group) but totally not hardcoded as in different distribution (theoretically) can be different rights in package.
Mode 0755 for /etc/powerdns fixes our problem. but as concept still doubtful.

[atosatto]

Hi @KawaiDesu sorry for taking over your PR but I thought this was abandoned.

Mode 0755 for /etc/powerdns fixes our problem. but as concept still doubtful.

The PowerDNS Recursor is started as root of any system and then the permissions are stripped to the one of the user and group configured by the setuid and setgid options (respectively pdns_rec_user and pdns_rec_group in our Ansible role.

Setting the permissions to 755 ensure that any user and group configured as runtime user for the PowerDNS Recursor service can access the folder.
The permissions of the configuration files are then restricted in order not to allow to be read / edit by not authorized users.

Note that the permissions set by the Ansible role won't be changed upgrading the package.
You can find, as an example, the .rpmspec file used to build the PowerDNS Recursor packages on CentOS/RHEL here: https://github.com/PowerDNS/pdns/blob/master/builder-support/specs/pdns-recursor.spec.