write_files silently fails to set special bits (setuid/setgid/sticky) in permissions

[azrdev]

Bug report

Trying to create a file with special permission bits set using the write_files module raises no error, the correct permissions are printed to the log, but are never set on the file.

Asked this on IRC and got confirmation from @blackboxsw (thanks!)

Steps to reproduce the problem

# user-data
write_files:
  - path: /usr/local/bin/deploy
    content: "#!/bin/sh"
    owner: root:root
    permissions: '4111'

Logs to /var/log/cloud-init.log a line similar to Writing to /usr/local/bin/deploy - wb: [4111] 379 bytes, that is it contains the desired mode 4111

But the file afterwards has permissions 111 (setuid bit cleared).

Environment details

• Cloud-init version: 21.1-7.el8
• Operating System Distribution: Rocky Linux
• Cloud provider, platform or installer type: Openstack

cloud-init logs

2025-05-15 08:44:56,491 - util.py[DEBUG]: Writing to /usr/local/sbin/vault-deploy-certificates - wb: [4111] 379 bytes

[azrdev]

proposed patch by @blackboxsw

diff --git a/cloudinit/config/cc_write_files.py b/cloudinit/config/cc_write_files.py
index ac9ed6010..250ae3c9a 100644
--- a/cloudinit/config/cc_write_files.py
+++ b/cloudinit/config/cc_write_files.py
@@ -112,6 +112,9 @@ def write_files(name, files, owner: str, ssl_details: Optional[dict] = None):
             path, contents, omode=omode, mode=perms, user=u, group=g
         )
         util.chownbyname(path, u, g)
+        if util.get_permissions(path) != perms:
+            # Original setuid bit permissions were cleared due to chown
+            util.chmod(path, perms)
 
 
 def decode_perms(perm, default):