Since /etc/mysql/my.cnf contains the [client] section, normal

users need to be able to read that file.  We should set 0644
on /etc/mysql/my.cnf, but use 0400 on /etc/my.cnf and
/root/.my.cnf because they contain passwords in plaintext.

Author: justinellison

manifests/config.pp

@@ -25,18 +25,19 @@
     }
     file{'/root/.my.cnf':
       content => template('mysql/my.cnf.pass.erb'),
+      mode  => '0400',
     }
     if $etc_root_password {
        file{'/etc/my.cnf':
           content => template('mysql/my.cnf.pass.erb'),
           require => Exec['set_mysql_rootpw'],
+          mode  => '0400',
        }
     }
   }
   File {
     owner => 'root',
     group => 'root',
-    mode  => '0400',
     notify  => Exec['mysqld-restart'],
     require => Package['mysql-server']
   }