CFE-4590: Made default_directory_create_mode configurable via Augments

MPF.md

@@ -677,6 +677,33 @@ This [augments file][Augments] is a way to specify that `cf-monitord` should be
 }
 ```
 
+### Configure default directory creation permissions for update policy
+The `default_directory_create_mode` attribute in `body agent control` enables
+users to specify custom permissions (e.g., 0755) for automatically created
+directories, avoiding the need for explicit perms promises on each parent
+directory when deeper paths are required.
+
+The mode string may be symbolic (`a+rx`, `a=rx`) or numerical, like `chmod`.
+
+To override the default for **cf-agent** configure `default:update_def.control_agent_default_directory_create_mode`, for example:
+
+```json
+{
+    "variables": {
+        "default:update_def.control_agent_default_directory_create_mode": {
+            "value": "755"
+        }
+    }
+}
+```
+
+**See also:** [`default_directory_create_mode` in `body agent control`][cf-agent#default_directory_create_mode]
+
+**History:**
+
+- Added in CFEngine 3.27.0
+
+
 ## Main policy (promises.cf)
 
 The following settings are defined in `controls/def.cf` can be set from an
@@ -2813,6 +2840,35 @@ Maximum time between automatic WAL checkpoints. If this value is specified witho
 
 * Added in 3.20.0, 3.18.2
 
+### Configure default directory creation permissions for main policy
+
+The `default_directory_create_mode` attribute in `body agent control` enables
+users to specify custom permissions (e.g., 0755) for automatically created
+directories, avoiding the need for explicit perms promises on each parent
+directory when deeper paths are required.
+
+The mode string may be symbolic (`a+rx`, `a=rx`) or numerical, like `chmod`.
+
+The default permissions can be overridden via Augments, for example:
+
+To override the default for **cf-agent** configure `default:def.control_agent_default_directory_create_mode`, for example:
+
+```json
+{
+    "variables": {
+        "default:def.control_agent_default_directory_create_mode": {
+            "value": "755"
+        }
+    }
+}
+```
+
+**See also:** [`default_directory_create_mode` in `body common control`][Components#default_directory_create_mode], [`default_directory_create_mode` in `body agent control`][cf-agent#default_directory_create_mode]
+
+**History:**
+
+- Added in CFEngine 3.27.0
+
 ## Recommendations
 
 The MPF includes policy that inspects the system and makes recommendations about

controls/cf_agent.cf

@@ -45,6 +45,10 @@ body agent control
       # EMPTY list is not valid for environment attribute Ref: CFE-3927. So, we
       # do some validation on it so we can apply it selectively.
 
+@if minimum_version(3.27.0)
+      default_directory_create_mode => "$(def.control_agent_default_directory_create_mode)";
+@endif
+
    _control_agent_environment_vars_validated::
 
       environment => { @(def.control_agent_environment_vars) };

controls/def.cf

@@ -344,6 +344,12 @@ bundle common def
                            " the binary default of 10080 minutes (1 week)" );
 
       # Agent controls
+
+      "control_agent_default_directory_create_mode" -> { "CFE-4590" }
+        string => ifelse( isvariable("control_agent_default_directory_create_mode"),
+                          "$(control_agent_default_directory_create_mode)",
+                          "700");
+
 @if minimum_version(3.18.0)
       # TODO When 3.18 is the oldest supported LTS, redact this macro and associated protections
       "control_agent_files_single_copy" -> { "CFE-3622" }

controls/update_def.cf.in

@@ -156,6 +156,11 @@ bundle common update_def
         if => and( "mpf_update_control_agent_default_repository",
                    not( isvariable( "control_agent_default_repository" ) ) );
 
+      "control_agent_default_directory_create_mode" -> { "CFE-4590" }
+        string => ifelse( isvariable("control_agent_default_directory_create_mode"),
+                          "$(control_agent_default_directory_create_mode)",
+                          "700");
+
     enable_cfengine_enterprise_hub_ha::
       "standby_servers" slist => filter("$(sys.policy_hub)", "ha_def.ips", false, true, 10);
       "policy_servers" slist => { "$(sys.policy_hub)", "@(standby_servers)" };

update.cf.in

@@ -193,6 +193,9 @@ body agent control
 @if minimum_version(3.27.0)
       # The order in which promises are evaluated (top_down|classic)
         evaluation_order => "$(default:def.control_agent_update_evaluation_order)";
+
+      # The permissions automatically created directories should have
+        default_directory_create_mode => "$(default:update_def.control_agent_default_directory_create_mode)";
 @endif
 
     control_agent_agentfacility_configured::