Per conversation with @ccaum, switching to a whitelist approach to file permissions and using a default of 0400; overriding it to 0644 when needed.

Author: justinellison

manifests/config.pp

@@ -25,19 +25,18 @@
     }
     file{'/root/.my.cnf':
       content => template('mysql/my.cnf.pass.erb'),
-      mode  => '0400',
     }
     if $etc_root_password {
        file{'/etc/my.cnf':
           content => template('mysql/my.cnf.pass.erb'),
           require => Exec['set_mysql_rootpw'],
-          mode  => '0400',
        }
     }
   }
   File {
     owner => 'root',
     group => 'root',
+    mode  => '0400',
     notify  => Exec['mysqld-restart'],
     require => Package['mysql-server']
   }
@@ -52,5 +51,6 @@
 
   file { '/etc/mysql/my.cnf':
     content => template('mysql/my.cnf.erb'),
+    mode    => '0644'
   }
 }