Pack Install shouldn't set '755' permissions on all pack content

History leads to 2015 and https://github.com/StackStorm/st2/pull/2009 https://github.com/StackStorm/st2/pull/2012 changes.

Current code: https://github.com/StackStorm/st2/blob/1bcd21c6469f8ab2dfe97e2d19001f266880054e/contrib/packs/actions/pack_mgmt/download.py#L219-L238 (thanks @nmaludy)

I don't think it's good that during a pack install we additionally set 755 permissions (+x) on all files in a pack, including yaml files and everything else. Additionally, +x on "others" is even more nasty.

Instead we should try to rely on permissions set from git, eg. preserve the original permissions from the pack + change ownership so stackstorm-related services can work OK.

TODO

• Revert the change
• Research corner cases
• Test
  • Make sure git preserves the original pack permissions
  • Check WebUI (icons?)
  • Check st2flow (including save & run)
    • EL6
    • EL7
    • Ubuntu14
    • Ubuntu16
• Compatibility: find all executable files (like .sh) in StackStorm/exchange packs and explicitly set +x (if not set)
• Hide the pack content (dir) for "other" users, allow only for owners + stackstorm groups (?)

A note from @enykeev

we need both st2api and actionrunner to be able to read and write them. At the same time, we don’t want to run st2api with sudo privileges as it would create additional risk

Initial effort would be to check if this can even work and won't break everything.