From 32ecfe7ed8852f58d2eb65ecd9589d408939f629 Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <daniel.wozniak@broadcom.com>
Date: Mon, 31 Aug 2026 18:52:57 -0700
Subject: [PATCH 1/3] Isolate salt daemon writable state under
 /var/lib/salt/<daemon>/ (#70198)

Default SALT_ONEDIR_HARDEN=1 on 3009.0+ so each daemon's writable
state lives under per-daemon /var/lib/salt/<daemon>/{home,extras-<py>}
directories and /opt/saltstack/salt stays root:root 0755. Set
SALT_ONEDIR_HARDEN=0 in /etc/default/salt-setup (DEB) or
/etc/sysconfig/salt-minion-setup (RPM) to restore the legacy
chown -R salt /opt/saltstack/salt behavior for one release; the
opt-out is deprecated and will be removed in a future release.

Runtime salt-pip and the onedir _salt_onedir_extras .pth hook honor
SALT_EXTRAS_DIR so packages installed via salt-pip continue to be
importable by the daemon after the packaging layer relocates the
extras tree. Postinst / posttrans scriptlets migrate any populated
legacy /opt/saltstack/salt/extras-<py>/ contents into the per-daemon
location once, idempotent no-op otherwise.
---
 changelog/70198.added.md                      |   1 +
 .../releases/templates/3009.0.md.template     |  30 ++
 pkg/common/onedir/_salt_onedir_extras.py      |  18 +-
 pkg/debian/salt-api.postinst                  |  40 ++-
 pkg/debian/salt-api.preinst                   |  22 +-
 pkg/debian/salt-cloud.postinst                |  40 ++-
 pkg/debian/salt-cloud.preinst                 |  52 ++++
 pkg/debian/salt-common.dirs                   |   1 +
 pkg/debian/salt-common.preinst                |  21 +-
 pkg/debian/salt-master.postinst               |  53 +++-
 pkg/debian/salt-master.preinst                |  22 +-
 pkg/debian/salt-minion.postinst               |  63 ++++-
 pkg/debian/salt-minion.preinst                |  25 +-
 pkg/debian/salt-syndic.postinst               |  40 ++-
 pkg/debian/salt-syndic.preinst                |  22 +-
 pkg/rpm/salt.spec                             | 263 ++++++++++++++++--
 salt/scripts.py                               |  24 +-
 .../pkg/integration/test_onedir_harden.py     | 169 +++++++++++
 tests/pytests/unit/test_salt_onedir_extras.py | 103 +++++++
 tests/pytests/unit/test_scripts.py            |  48 +++-
 20 files changed, 977 insertions(+), 80 deletions(-)
 create mode 100644 changelog/70198.added.md
 create mode 100755 pkg/debian/salt-cloud.preinst
 create mode 100644 tests/pytests/pkg/integration/test_onedir_harden.py
 create mode 100644 tests/pytests/unit/test_salt_onedir_extras.py

diff --git a/changelog/70198.added.md b/changelog/70198.added.md
new file mode 100644
index 000000000000..7eda00d92cf3
--- /dev/null
+++ b/changelog/70198.added.md
@@ -0,0 +1 @@
+Isolate salt daemon writable state under per-daemon `/var/lib/salt/<daemon>/` directories so the `/opt/saltstack/salt` onedir tree stays `root:root 0755`. `SALT_ONEDIR_HARDEN=1` is now the default on 3009.0+; `SALT_ONEDIR_HARDEN=0` restores the legacy `chown -R salt /opt/saltstack/salt` behavior for one release and emits a deprecation warning. `salt-pip` and `_salt_onedir_extras.py` honor `SALT_EXTRAS_DIR` at runtime so the relocated extras tree stays importable by the daemon.
diff --git a/doc/topics/releases/templates/3009.0.md.template b/doc/topics/releases/templates/3009.0.md.template
index 9df09f0899e9..27799792fdeb 100644
--- a/doc/topics/releases/templates/3009.0.md.template
+++ b/doc/topics/releases/templates/3009.0.md.template
@@ -6,6 +6,36 @@
 Add release specific details below
 -->
 
+## Hardened onedir layout (`SALT_ONEDIR_HARDEN=1` by default)
+
+Starting with 3009.0, the Linux packaging isolates each salt daemon's
+writable state under per-daemon directories:
+
+- `/var/lib/salt/minion/{home,extras-<py>}` for `salt-minion`
+- `/var/lib/salt/master/{home,extras-<py>}` for `salt-master`
+- `/var/lib/salt/syndic/{home,extras-<py>}` for `salt-syndic`
+- `/var/lib/salt/api/{home,extras-<py>}` for `salt-api`
+- `/var/lib/salt/cloud/{home,extras-<py>}` for `salt-cloud`
+
+The `/opt/saltstack/salt` onedir tree now stays owned by
+`root:root` at `0755` — the packaging postinst / posttrans scriptlets
+no longer chown the tree to the salt user. On upgrade from a legacy
+install, the existing `/opt/saltstack/salt/extras-<py>` contents are
+migrated into the per-daemon `/var/lib/salt/<daemon>/extras-<py>`
+directory automatically.
+
+`salt-pip install` and the runtime `_salt_onedir_extras` import hook
+honor the `SALT_EXTRAS_DIR` environment variable so packages installed
+via `salt-pip` continue to be importable by the daemon at runtime.
+
+### Opting out for one release
+
+Set `SALT_ONEDIR_HARDEN=0` in `/etc/default/salt-setup` (DEB) or
+`/etc/sysconfig/salt-minion-setup` (RPM) to keep the legacy
+`chown -R salt /opt/saltstack/salt` behavior. This opt-out is available
+for the 3009 release cycle only; the legacy layout will be removed in a
+future release. See {issue}`70198`.
+
 <!--
 Do not edit the changelog below.
 This is auto generated.
diff --git a/pkg/common/onedir/_salt_onedir_extras.py b/pkg/common/onedir/_salt_onedir_extras.py
index 366136ba2a98..1593be1627d3 100644
--- a/pkg/common/onedir/_salt_onedir_extras.py
+++ b/pkg/common/onedir/_salt_onedir_extras.py
@@ -1,14 +1,22 @@
+import os
 import pathlib
 import sys
 
 
 def setup(pth_file_path):
-    # Discover the extras-<py-major>.<py-minor> directory
-    extras_parent_path = pathlib.Path(pth_file_path).resolve().parent.parent
-    if not sys.platform.startswith("win"):
-        extras_parent_path = extras_parent_path.parent
+    # Honor SALT_EXTRAS_DIR when set (packaging with SALT_ONEDIR_HARDEN
+    # relocates the extras tree outside /opt/saltstack/salt so the onedir
+    # can stay read-only). See issue #70198. Fall back to the historical
+    # <relenv_root>/extras-<py-major>.<py-minor> location otherwise.
+    extras_override = os.environ.get("SALT_EXTRAS_DIR")
+    if extras_override:
+        extras_path = extras_override
+    else:
+        extras_parent_path = pathlib.Path(pth_file_path).resolve().parent.parent
+        if not sys.platform.startswith("win"):
+            extras_parent_path = extras_parent_path.parent
 
-    extras_path = str(extras_parent_path / "extras-{}.{}".format(*sys.version_info))
+        extras_path = str(extras_parent_path / "extras-{}.{}".format(*sys.version_info))
 
     if extras_path in sys.path and sys.path[0] != extras_path:
         # The extras directory must come first
diff --git a/pkg/debian/salt-api.postinst b/pkg/debian/salt-api.postinst
index 668d36d953e8..73ff5fd09d93 100644
--- a/pkg/debian/salt-api.postinst
+++ b/pkg/debian/salt-api.postinst
@@ -20,6 +20,22 @@ set -e
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
+    # Source setup configuration so SALT_ONEDIR_HARDEN / SALT_HOME /
+    # SALT_EXTRAS_DIR are visible. See issue #70198.
+    if [ -f /etc/default/salt-setup ]; then
+        . /etc/default/salt-setup
+    fi
+    if [ -f /etc/sysconfig/salt-minion-setup ]; then
+        . /etc/sysconfig/salt-minion-setup
+    fi
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/api/home
+        if [ -z "$SALT_EXTRAS_DIR" ]; then
+            PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+            [ -n "$PY_VER" ] && SALT_EXTRAS_DIR=/var/lib/salt/api/extras-${PY_VER}
+        fi
+    fi
     if db_get salt-api/user; then
       if [ "$RET" != "root" ]; then
         if [ ! -e "/var/log/salt/api" ]; then
@@ -29,7 +45,29 @@ case "$1" in
         # Only set ownership on fresh install, preserve on upgrade
         if [ -z "$2" ]; then
             chown $RET:$RET /var/log/salt/api
-            chown -R $RET:$RET /opt/saltstack/salt || true
+            if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+                install -d -m 0755 -o "$RET" -g "$RET" /var/lib/salt/api
+                [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_HOME"
+                [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_EXTRAS_DIR"
+            else
+                logger -t salt-api "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/api/ layout." 2>/dev/null || true
+                chown -R $RET:$RET /opt/saltstack/salt || true
+                if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                    chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+                fi
+            fi
+        fi
+        # Upgrade migration: hardened only. Move populated legacy extras
+        # into per-daemon location, idempotent otherwise.
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
         fi
       fi
     fi
diff --git a/pkg/debian/salt-api.preinst b/pkg/debian/salt-api.preinst
index 474676474be2..e63ed49c155c 100644
--- a/pkg/debian/salt-api.preinst
+++ b/pkg/debian/salt-api.preinst
@@ -16,10 +16,10 @@ set -e
 # Source setup configuration if present. The DEB-conventional location is
 # /etc/default/salt-setup; /etc/sysconfig/salt-minion-setup is honored as
 # well for cross-distro parity with the RPM packaging. Either file may
-# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, or SALT_EXTRAS_DIR.
-# Values in the sourced files win over inherited env vars; the [ -n ... ]
-# || guards below preserve whatever was set, falling back to the hardcoded
-# defaults only when nothing was supplied.
+# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, SALT_EXTRAS_DIR,
+# or SALT_ONEDIR_HARDEN. Values in the sourced files win over inherited
+# env vars; the [ -n ... ] || guards below preserve whatever was set,
+# falling back to the hardcoded defaults only when nothing was supplied.
 if [ -f /etc/default/salt-setup ]; then
     . /etc/default/salt-setup
 fi
@@ -27,11 +27,23 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 
-[ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt-api
+# writable state out of /opt/saltstack/salt into /var/lib/salt/api/ so
+# the onedir tree can stay root-owned and 0755. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
 [ -n "$SALT_USER" ] || SALT_USER=salt
 [ -n "$SALT_NAME" ] || SALT_NAME="Salt"
 [ -n "$SALT_GROUP" ] || SALT_GROUP=salt
 
+# SALT_HOME default in hardened mode points at the per-daemon dir under
+# /var/lib/salt/api. Explicit SALT_HOME still wins.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/api/home
+else
+    [ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+fi
+
 case "$1" in
   install)
     # Propagate the resolved SALT_USER (from /etc/default/salt-setup,
diff --git a/pkg/debian/salt-cloud.postinst b/pkg/debian/salt-cloud.postinst
index 08eb932503e4..66d91656649e 100644
--- a/pkg/debian/salt-cloud.postinst
+++ b/pkg/debian/salt-cloud.postinst
@@ -20,14 +20,50 @@ set -e
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
+    # Source setup configuration so SALT_ONEDIR_HARDEN / SALT_HOME /
+    # SALT_EXTRAS_DIR are visible. See issue #70198.
+    if [ -f /etc/default/salt-setup ]; then
+        . /etc/default/salt-setup
+    fi
+    if [ -f /etc/sysconfig/salt-minion-setup ]; then
+        . /etc/sysconfig/salt-minion-setup
+    fi
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/cloud/home
+        if [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+            SALT_EXTRAS_DIR=/var/lib/salt/cloud/extras-${PY_VER}
+        fi
+    fi
     if db_get salt-master/user
     then
       if [ "$RET" != "root" ]; then
-        PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush;")
         # Only set ownership on fresh install, preserve on upgrade
         if [ -z "$2" ]; then
             chown -R $RET:$RET /etc/salt/cloud.deploy.d /opt/saltstack/salt/lib/python${PY_VER}/site-packages/salt/cloud/deploy
-            chown -R $RET:$RET /opt/saltstack/salt || true
+            if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+                install -d -m 0755 -o "$RET" -g "$RET" /var/lib/salt/cloud
+                [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_HOME"
+                [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_EXTRAS_DIR"
+            else
+                logger -t salt-cloud "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/cloud/ layout." 2>/dev/null || true
+                chown -R $RET:$RET /opt/saltstack/salt || true
+                if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                    chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+                fi
+            fi
+        fi
+        # Upgrade migration: hardened only, one-shot.
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
         fi
       fi
     fi
diff --git a/pkg/debian/salt-cloud.preinst b/pkg/debian/salt-cloud.preinst
new file mode 100755
index 000000000000..a7a362ec0800
--- /dev/null
+++ b/pkg/debian/salt-cloud.preinst
@@ -0,0 +1,52 @@
+#!/bin/sh
+# preinst script for salt-cloud.
+#
+# See: dh_installdeb(1).
+
+set -e
+
+# Summary of how this script can be called:
+#        * <new-preinst> 'install'
+#        * <new-preinst> 'install' <old-version>
+#        * <new-preinst> 'upgrade' <old-version>
+#        * <old-preinst> 'abort-upgrade' <new-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package.
+
+# Source setup configuration if present. The DEB-conventional location is
+# /etc/default/salt-setup; /etc/sysconfig/salt-minion-setup is honored as
+# well for cross-distro parity with the RPM packaging. Either file may
+# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, SALT_EXTRAS_DIR,
+# or SALT_ONEDIR_HARDEN. Values in the sourced files win over inherited
+# env vars; the [ -n ... ] || guards below preserve whatever was set,
+# falling back to the hardcoded defaults only when nothing was supplied.
+if [ -f /etc/default/salt-setup ]; then
+    . /etc/default/salt-setup
+fi
+if [ -f /etc/sysconfig/salt-minion-setup ]; then
+    . /etc/sysconfig/salt-minion-setup
+fi
+
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt-cloud
+# writable state out of /opt/saltstack/salt into /var/lib/salt/cloud/
+# so the onedir tree can stay root-owned and 0755. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
+[ -n "$SALT_USER" ] || SALT_USER=salt
+[ -n "$SALT_NAME" ] || SALT_NAME="Salt"
+[ -n "$SALT_GROUP" ] || SALT_GROUP=salt
+
+# SALT_HOME default in hardened mode points at the per-daemon dir under
+# /var/lib/salt/cloud. Explicit SALT_HOME still wins.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/cloud/home
+else
+    [ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+fi
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/pkg/debian/salt-common.dirs b/pkg/debian/salt-common.dirs
index 381ec1f48ce0..6dcb26f7f80e 100644
--- a/pkg/debian/salt-common.dirs
+++ b/pkg/debian/salt-common.dirs
@@ -1,6 +1,7 @@
 /var/cache/salt
 /var/log/salt
 /var/run/salt
+/var/lib/salt
 /usr/share/fish/vendor_completions.d
 /opt/saltstack/salt
 /etc/salt
diff --git a/pkg/debian/salt-common.preinst b/pkg/debian/salt-common.preinst
index c0e1ef443d01..44ec53f1519e 100644
--- a/pkg/debian/salt-common.preinst
+++ b/pkg/debian/salt-common.preinst
@@ -27,12 +27,31 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 
-[ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt user's
+# writable state out of /opt/saltstack/salt into per-daemon
+# /var/lib/salt/<daemon>/. Setting SALT_ONEDIR_HARDEN=0 preserves the
+# legacy layout for one release. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
 [ -n "$SALT_USER" ] || SALT_USER=salt
 [ -n "$SALT_NAME" ] || SALT_NAME="Salt"
 [ -n "$SALT_GROUP" ] || SALT_GROUP=salt
 [ -n "$SALT_SHELL" ] || SALT_SHELL=/usr/sbin/nologin
 
+# SALT_HOME default depends on SALT_ONEDIR_HARDEN. In hardened mode the
+# salt user's account home moves under /var/lib/salt so
+# /opt/saltstack/salt can stay root-owned and 0755. The per-daemon
+# preinst scripts may reassign SALT_HOME to /var/lib/salt/<daemon>/home
+# so whichever daemon's preinst runs last owns the passwd home entry;
+# this is intentional -- see issue #70198.
+if [ -z "$SALT_HOME" ]; then
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        SALT_HOME=/var/lib/salt/home
+    else
+        SALT_HOME=/opt/saltstack/salt
+    fi
+fi
+
 case "$1" in
   install|upgrade)
     # create user to avoid running server as root
diff --git a/pkg/debian/salt-master.postinst b/pkg/debian/salt-master.postinst
index 1a64bbcde8ea..68e7ebb94b6e 100644
--- a/pkg/debian/salt-master.postinst
+++ b/pkg/debian/salt-master.postinst
@@ -21,6 +21,22 @@ set -e
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
+    # Source setup configuration so SALT_ONEDIR_HARDEN / SALT_HOME /
+    # SALT_EXTRAS_DIR are visible. See issue #70198.
+    if [ -f /etc/default/salt-setup ]; then
+        . /etc/default/salt-setup
+    fi
+    if [ -f /etc/sysconfig/salt-minion-setup ]; then
+        . /etc/sysconfig/salt-minion-setup
+    fi
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/master/home
+        if [ -z "$SALT_EXTRAS_DIR" ]; then
+            PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+            [ -n "$PY_VER" ] && SALT_EXTRAS_DIR=/var/lib/salt/master/extras-${PY_VER}
+        fi
+    fi
     if db_get salt-master/user; then
       if [ "$RET" != "root" ]; then
         if [ ! -e "/var/log/salt/master" ]; then
@@ -33,11 +49,38 @@ case "$1" in
         fi
         # Only set ownership on fresh install, preserve on upgrade
         if [ -z "$2" ]; then
-            chown -R $RET:$RET /etc/salt/pki/master /etc/salt/master.d \
-                               /var/log/salt/master /var/log/salt/key \
-                               /var/cache/salt/master /var/run/salt/master \
-                               /opt/saltstack/salt \
-                               || true
+            if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+                install -d -m 0755 -o "$RET" -g "$RET" /var/lib/salt/master
+                [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_HOME"
+                [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_EXTRAS_DIR"
+                chown -R $RET:$RET /etc/salt/pki/master /etc/salt/master.d \
+                                   /var/log/salt/master /var/log/salt/key \
+                                   /var/cache/salt/master /var/run/salt/master \
+                                   || true
+            else
+                logger -t salt-master "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/master/ layout." 2>/dev/null || true
+                chown -R $RET:$RET /etc/salt/pki/master /etc/salt/master.d \
+                                   /var/log/salt/master /var/log/salt/key \
+                                   /var/cache/salt/master /var/run/salt/master \
+                                   /opt/saltstack/salt \
+                                   || true
+                if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                    chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+                fi
+            fi
+        fi
+        # Upgrade migration: hardened only, one-shot. If legacy extras
+        # populated and new empty, move contents. Runs on both fresh
+        # install (no-op) and upgrade (migrates once).
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
         fi
       fi
     fi
diff --git a/pkg/debian/salt-master.preinst b/pkg/debian/salt-master.preinst
index fcf7b0b991bf..fd4f45eb120b 100644
--- a/pkg/debian/salt-master.preinst
+++ b/pkg/debian/salt-master.preinst
@@ -16,10 +16,10 @@ set -e
 # Source setup configuration if present. The DEB-conventional location is
 # /etc/default/salt-setup; /etc/sysconfig/salt-minion-setup is honored as
 # well for cross-distro parity with the RPM packaging. Either file may
-# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, or SALT_EXTRAS_DIR.
-# Values in the sourced files win over inherited env vars; the [ -n ... ]
-# || guards below preserve whatever was set, falling back to the hardcoded
-# defaults only when nothing was supplied.
+# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, SALT_EXTRAS_DIR,
+# or SALT_ONEDIR_HARDEN. Values in the sourced files win over inherited
+# env vars; the [ -n ... ] || guards below preserve whatever was set,
+# falling back to the hardcoded defaults only when nothing was supplied.
 if [ -f /etc/default/salt-setup ]; then
     . /etc/default/salt-setup
 fi
@@ -27,11 +27,23 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 
-[ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt master's
+# writable state out of /opt/saltstack/salt into /var/lib/salt/master/
+# so the onedir tree can stay root-owned and 0755. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
 [ -n "$SALT_USER" ] || SALT_USER=salt
 [ -n "$SALT_NAME" ] || SALT_NAME="Salt"
 [ -n "$SALT_GROUP" ] || SALT_GROUP=salt
 
+# SALT_HOME default in hardened mode points at the per-daemon dir under
+# /var/lib/salt/master. Explicit SALT_HOME still wins.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/master/home
+else
+    [ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+fi
+
 case "$1" in
   install)
     # Propagate the resolved SALT_USER (from /etc/default/salt-setup,
diff --git a/pkg/debian/salt-minion.postinst b/pkg/debian/salt-minion.postinst
index b7bd71a977a2..8a5900a21281 100644
--- a/pkg/debian/salt-minion.postinst
+++ b/pkg/debian/salt-minion.postinst
@@ -21,16 +21,25 @@ set -e
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
-    # Source setup configuration if present so SALT_EXTRAS_DIR can
-    # relocate the extras dir chown target. /etc/default/salt-setup is
-    # the DEB-conventional location; /etc/sysconfig/salt-minion-setup is
-    # honored for cross-distro parity with the RPM packaging.
+    # Source setup configuration if present so SALT_ONEDIR_HARDEN /
+    # SALT_HOME / SALT_EXTRAS_DIR are visible. /etc/default/salt-setup
+    # is the DEB-conventional location; /etc/sysconfig/salt-minion-setup
+    # is honored for cross-distro parity with the RPM packaging.
     if [ -f /etc/default/salt-setup ]; then
         . /etc/default/salt-setup
     fi
     if [ -f /etc/sysconfig/salt-minion-setup ]; then
         . /etc/sysconfig/salt-minion-setup
     fi
+    # Default SALT_ONEDIR_HARDEN=1 on 3009.0+. See issue #70198.
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/minion/home
+        if [ -z "$SALT_EXTRAS_DIR" ]; then
+            PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+            [ -n "$PY_VER" ] && SALT_EXTRAS_DIR=/var/lib/salt/minion/extras-${PY_VER}
+        fi
+    fi
     if db_get salt-minion/user
     then
       if [ "$RET" != "root" ]; then
@@ -42,15 +51,43 @@ case "$1" in
           touch /var/log/salt/key
           chmod 640 /var/log/salt/key
         fi
-        chown -R $RET:$RET /etc/salt/pki/minion /etc/salt/minion.d \
-                           /var/log/salt/minion /var/cache/salt/minion \
-                           /var/run/salt/minion \
-                           /opt/saltstack/salt \
-                           || true
-        # If SALT_EXTRAS_DIR points outside /opt/saltstack/salt, chown it
-        # explicitly so the relocated extras tree is writable too.
-        if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
-            chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            # Hardened: create per-daemon writable dirs and chown ONLY
+            # those. /opt/saltstack/salt stays root:root 0755.
+            install -d -m 0755 -o "$RET" -g "$RET" /var/lib/salt/minion
+            [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_EXTRAS_DIR"
+            chown -R $RET:$RET /etc/salt/pki/minion /etc/salt/minion.d \
+                               /var/log/salt/minion /var/cache/salt/minion \
+                               /var/run/salt/minion \
+                               || true
+            # Upgrade migration: if the legacy extras dir has contents
+            # and the new location is empty, move contents across. This
+            # is a one-shot no-op-if-already-migrated migration.
+            if [ -n "$PY_VER" ] \
+               && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+               && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+               && [ -d "$SALT_EXTRAS_DIR" ] \
+               && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+                mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+                mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+                rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+                chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+            fi
+        else
+            # Legacy layout. Log deprecation notice; will be removed
+            # after one release. See issue #70198.
+            logger -t salt-minion "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/minion/ layout." 2>/dev/null || true
+            chown -R $RET:$RET /etc/salt/pki/minion /etc/salt/minion.d \
+                               /var/log/salt/minion /var/cache/salt/minion \
+                               /var/run/salt/minion \
+                               /opt/saltstack/salt \
+                               || true
+            # If SALT_EXTRAS_DIR points outside /opt/saltstack/salt,
+            # chown it explicitly so the relocated tree is writable too.
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+            fi
         fi
       fi
     fi
diff --git a/pkg/debian/salt-minion.preinst b/pkg/debian/salt-minion.preinst
index 9a9ec4420a14..b623e87ffb2c 100644
--- a/pkg/debian/salt-minion.preinst
+++ b/pkg/debian/salt-minion.preinst
@@ -16,10 +16,10 @@ set -e
 # Source setup configuration if present. The DEB-conventional location is
 # /etc/default/salt-setup; /etc/sysconfig/salt-minion-setup is honored as
 # well for cross-distro parity with the RPM packaging. Either file may
-# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, or SALT_EXTRAS_DIR.
-# Values in the sourced files win over inherited env vars; the [ -n ... ]
-# || guards below preserve whatever was set, falling back to the hardcoded
-# defaults only when nothing was supplied.
+# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, SALT_EXTRAS_DIR,
+# or SALT_ONEDIR_HARDEN. Values in the sourced files win over inherited
+# env vars; the [ -n ... ] || guards below preserve whatever was set,
+# falling back to the hardcoded defaults only when nothing was supplied.
 if [ -f /etc/default/salt-setup ]; then
     . /etc/default/salt-setup
 fi
@@ -27,11 +27,26 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 
-[ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt daemon's
+# writable state out of /opt/saltstack/salt into /var/lib/salt/minion/
+# so the onedir tree can stay root-owned and 0755. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
 [ -n "$SALT_USER" ] || SALT_USER=salt
 [ -n "$SALT_NAME" ] || SALT_NAME="Salt"
 [ -n "$SALT_GROUP" ] || SALT_GROUP=salt
 
+# In hardened mode, the salt user's home defaults to per-daemon
+# /var/lib/salt/minion/home. Explicit SALT_HOME (env var or setup file)
+# always wins. SALT_EXTRAS_DIR default is deferred to postinst -- it
+# depends on /opt/saltstack/salt/bin/python3, which isn't unpacked yet
+# on a fresh install.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/minion/home
+else
+    [ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+fi
+
 case "$1" in
   install)
     # Propagate the resolved SALT_USER (from /etc/default/salt-setup,
diff --git a/pkg/debian/salt-syndic.postinst b/pkg/debian/salt-syndic.postinst
index 9a94793124c6..16a75bbda271 100644
--- a/pkg/debian/salt-syndic.postinst
+++ b/pkg/debian/salt-syndic.postinst
@@ -21,6 +21,22 @@ set -e
 case "$1" in
   configure)
     . /usr/share/debconf/confmodule
+    # Source setup configuration so SALT_ONEDIR_HARDEN / SALT_HOME /
+    # SALT_EXTRAS_DIR are visible. See issue #70198.
+    if [ -f /etc/default/salt-setup ]; then
+        . /etc/default/salt-setup
+    fi
+    if [ -f /etc/sysconfig/salt-minion-setup ]; then
+        . /etc/sysconfig/salt-minion-setup
+    fi
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/syndic/home
+        if [ -z "$SALT_EXTRAS_DIR" ]; then
+            PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+            [ -n "$PY_VER" ] && SALT_EXTRAS_DIR=/var/lib/salt/syndic/extras-${PY_VER}
+        fi
+    fi
     if db_get salt-syndic/user; then
       if [ "$RET" != "root" ]; then
         if [ ! -e "/var/log/salt/syndic" ]; then
@@ -30,7 +46,29 @@ case "$1" in
         # Only set ownership on fresh install, preserve on upgrade
         if [ -z "$2" ]; then
             chown $RET:$RET /var/log/salt/syndic
-            chown -R $RET:$RET /opt/saltstack/salt || true
+            if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+                install -d -m 0755 -o "$RET" -g "$RET" /var/lib/salt/syndic
+                [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_HOME"
+                [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$RET" -g "$RET" "$SALT_EXTRAS_DIR"
+            else
+                logger -t salt-syndic "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/syndic/ layout." 2>/dev/null || true
+                chown -R $RET:$RET /opt/saltstack/salt || true
+                if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                    chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
+                fi
+            fi
+        fi
+        # Upgrade migration: hardened only. Move populated legacy extras
+        # into per-daemon location, idempotent otherwise.
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $RET:$RET "$SALT_EXTRAS_DIR" || true
         fi
       fi
     fi
diff --git a/pkg/debian/salt-syndic.preinst b/pkg/debian/salt-syndic.preinst
index a9dec3966522..adfe63654020 100644
--- a/pkg/debian/salt-syndic.preinst
+++ b/pkg/debian/salt-syndic.preinst
@@ -16,10 +16,10 @@ set -e
 # Source setup configuration if present. The DEB-conventional location is
 # /etc/default/salt-setup; /etc/sysconfig/salt-minion-setup is honored as
 # well for cross-distro parity with the RPM packaging. Either file may
-# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, or SALT_EXTRAS_DIR.
-# Values in the sourced files win over inherited env vars; the [ -n ... ]
-# || guards below preserve whatever was set, falling back to the hardcoded
-# defaults only when nothing was supplied.
+# pre-set SALT_HOME, SALT_USER, SALT_GROUP, SALT_NAME, SALT_EXTRAS_DIR,
+# or SALT_ONEDIR_HARDEN. Values in the sourced files win over inherited
+# env vars; the [ -n ... ] || guards below preserve whatever was set,
+# falling back to the hardcoded defaults only when nothing was supplied.
 if [ -f /etc/default/salt-setup ]; then
     . /etc/default/salt-setup
 fi
@@ -27,11 +27,23 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 
-[ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt syndic's
+# writable state out of /opt/saltstack/salt into /var/lib/salt/syndic/
+# so the onedir tree can stay root-owned and 0755. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
 [ -n "$SALT_USER" ] || SALT_USER=salt
 [ -n "$SALT_NAME" ] || SALT_NAME="Salt"
 [ -n "$SALT_GROUP" ] || SALT_GROUP=salt
 
+# SALT_HOME default in hardened mode points at the per-daemon dir under
+# /var/lib/salt/syndic. Explicit SALT_HOME still wins.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/syndic/home
+else
+    [ -n "$SALT_HOME" ] || SALT_HOME=/opt/saltstack/salt
+fi
+
 case "$1" in
   install)
     # Propagate the resolved SALT_USER (from /etc/default/salt-setup,
diff --git a/pkg/rpm/salt.spec b/pkg/rpm/salt.spec
index 17c853bfc33a..2d740776224a 100644
--- a/pkg/rpm/salt.spec
+++ b/pkg/rpm/salt.spec
@@ -343,6 +343,7 @@ rm -rf %{buildroot}
 %dir %{_var}/cache/salt
 %dir %{_var}/run/salt
 %dir %{_var}/log/salt
+%dir %{_var}/lib/salt
 %doc %{_mandir}/man1/spm.1*
 %{_bindir}/spm
 %{_bindir}/salt-pip
@@ -432,17 +433,35 @@ rm -rf %{buildroot}
 
 %pre
 # Source setup configuration if present so SALT_USER/SALT_GROUP/
-# SALT_HOME/SALT_NAME from /etc/sysconfig/salt-minion-setup override
-# the rpm-built-in defaults. The shell variables (when set) win over
-# the macro-expanded defaults below.
+# SALT_HOME/SALT_NAME/SALT_ONEDIR_HARDEN from
+# /etc/sysconfig/salt-minion-setup override the rpm-built-in defaults.
+# The shell variables (when set) win over the macro-expanded defaults
+# below.
 if [ -f /etc/sysconfig/salt-minion-setup ]; then
     . /etc/sysconfig/salt-minion-setup
 fi
 [ -n "$SALT_USER" ] || SALT_USER=%{_SALT_USER}
 [ -n "$SALT_GROUP" ] || SALT_GROUP=%{_SALT_GROUP}
-[ -n "$SALT_HOME" ] || SALT_HOME=%{_SALT_HOME}
 [ -n "$SALT_NAME" ] || SALT_NAME=%{_SALT_NAME}
 
+# SALT_ONEDIR_HARDEN=1 (default on 3009.0+) relocates the salt user's
+# writable state out of /opt/saltstack/salt into per-daemon
+# /var/lib/salt/<daemon>/. Setting SALT_ONEDIR_HARDEN=0 preserves the
+# legacy layout for one release. See issue #70198.
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+
+# SALT_HOME default depends on SALT_ONEDIR_HARDEN. In hardened mode the
+# salt user's account home moves under /var/lib/salt so
+# /opt/saltstack/salt can stay root-owned and 0755. Per-daemon
+# scriptlets may reassign SALT_HOME to /var/lib/salt/<daemon>/home.
+if [ -z "$SALT_HOME" ]; then
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        SALT_HOME=/var/lib/salt/home
+    else
+        SALT_HOME=%{_SALT_HOME}
+    fi
+fi
+
 # create user to avoid running server as root
 # 1. create group if not existing
 if ! getent group $SALT_GROUP; then
@@ -728,6 +747,13 @@ fi
 # %%systemd_post salt-minion.service
 if [ $1 -gt 1 ] ; then
   # Upgrade
+  # SALT_ONEDIR_HARDEN default flip on 3009.0+ (issue #70198). Honor an
+  # opt-out SALT_ONEDIR_HARDEN=0 for the deprecation window.
+  [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+  if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -z "$SALT_EXTRAS_DIR" ]; then
+      PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+      [ -n "$PY_VER" ] && SALT_EXTRAS_DIR=/var/lib/salt/minion/extras-${PY_VER}
+  fi
   # Restore ownership before restarting service
   if [ -f "/tmp/.salt-minion-upgrade-ownership" ]; then
     OWNERSHIP=$(cat /tmp/.salt-minion-upgrade-ownership)
@@ -749,17 +775,36 @@ if [ $1 -gt 1 ] ; then
     chown $OWNERSHIP /var/cache/salt/minion/proc
     chmod 750 /var/cache/salt/minion/proc
 
-    # Restore ownership of the main installation directory for salt-pip access
-    chown -R $OWNERSHIP /opt/saltstack/salt
-    # Also restore ownership of extras directory if it exists. Honor an
-    # explicit SALT_EXTRAS_DIR override (from /etc/sysconfig/salt-minion-setup)
-    # so packagers can relocate the extras dir; otherwise discover any
-    # extras-* directories under the install root.
-    if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
-        chown -R $OWNERSHIP "$SALT_EXTRAS_DIR"
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        # Hardened layout: keep /opt/saltstack/salt root-owned; chown
+        # only the per-daemon writable dirs. See issue #70198.
+        install -d -m 0755 -o "$USER_GROUP" -g "${OWNERSHIP#*:}" /var/lib/salt/minion
+        install -d -m 0755 -o "$USER_GROUP" -g "${OWNERSHIP#*:}" /var/lib/salt/minion/home
+        [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$USER_GROUP" -g "${OWNERSHIP#*:}" "$SALT_EXTRAS_DIR"
+        # Upgrade migration: move populated legacy extras into new
+        # per-daemon location. Idempotent no-op if already migrated.
+        if [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $OWNERSHIP "$SALT_EXTRAS_DIR" || true
+        fi
     else
-        # Use find to handle wildcard expansion safely in scriptlet
-        find /opt/saltstack/salt -maxdepth 1 -name "extras-*" -exec chown -R $OWNERSHIP {} +
+        logger -t salt-minion "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/minion/ layout." 2>/dev/null || true
+        # Restore ownership of the main installation directory for
+        # salt-pip access (legacy)
+        chown -R $OWNERSHIP /opt/saltstack/salt
+        # Also restore ownership of extras directory if it exists.
+        if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+            chown -R $OWNERSHIP "$SALT_EXTRAS_DIR"
+        else
+            # Use find to handle wildcard expansion safely in scriptlet
+            find /opt/saltstack/salt -maxdepth 1 -name "extras-*" -exec chown -R $OWNERSHIP {} +
+        fi
     fi
 
     # Create marker file to tell %posttrans this was an upgrade
@@ -808,7 +853,14 @@ if [ -f /etc/sysconfig/salt-minion-setup ]; then
 fi
 [ -n "$SALT_USER" ] || SALT_USER=%{_SALT_USER}
 [ -n "$SALT_GROUP" ] || SALT_GROUP=%{_SALT_GROUP}
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
 PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush();")
+if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+    [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/cloud/home
+    if [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+        SALT_EXTRAS_DIR=/var/lib/salt/cloud/extras-${PY_VER}
+    fi
+fi
 if [ ! -e "/var/log/salt/cloud" ]; then
   touch /var/log/salt/cloud
   chmod 640 /var/log/salt/cloud
@@ -817,8 +869,30 @@ if [ $1 -gt 1 ] ; then
     # Upgrade: preserve existing ownership, don't reset to defaults
     :
 else
-        chown -R $SALT_USER:$SALT_GROUP /etc/salt/cloud.deploy.d /var/log/salt/cloud /opt/saltstack/salt/lib/python${PY_VER}/site-packages/salt/cloud/deploy /opt/saltstack/salt
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" /var/lib/salt/cloud
+            [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_EXTRAS_DIR"
+            chown -R $SALT_USER:$SALT_GROUP /etc/salt/cloud.deploy.d /var/log/salt/cloud /opt/saltstack/salt/lib/python${PY_VER}/site-packages/salt/cloud/deploy
+        else
+            logger -t salt-cloud "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/cloud/ layout." 2>/dev/null || true
+            chown -R $SALT_USER:$SALT_GROUP /etc/salt/cloud.deploy.d /var/log/salt/cloud /opt/saltstack/salt/lib/python${PY_VER}/site-packages/salt/cloud/deploy /opt/saltstack/salt
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
+            fi
+        fi
     fi
+# Upgrade migration: hardened only, one-shot. Idempotent no-op otherwise.
+if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+   && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+   && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+   && [ -d "$SALT_EXTRAS_DIR" ] \
+   && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+    mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+    mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+    rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+    chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
+fi
 
     %posttrans master
     # Honor SALT_USER/SALT_GROUP overrides; same rationale as %posttrans cloud.
@@ -827,6 +901,15 @@ else
     fi
     [ -n "$SALT_USER" ] || SALT_USER=%{_SALT_USER}
     [ -n "$SALT_GROUP" ] || SALT_GROUP=%{_SALT_GROUP}
+    # SALT_ONEDIR_HARDEN default flip on 3009.0+ (issue #70198).
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/master/home
+        if [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+            SALT_EXTRAS_DIR=/var/lib/salt/master/extras-${PY_VER}
+        fi
+    fi
     if [ ! -e "/var/log/salt/master" ]; then
       touch /var/log/salt/master
       chmod 640 /var/log/salt/master
@@ -839,7 +922,29 @@ else
         # Upgrade: preserve existing ownership, don't reset to defaults
         :
     else
-        chown -R $SALT_USER:$SALT_GROUP /etc/salt/pki/master /etc/salt/master.d /var/log/salt/master /var/log/salt/key /var/cache/salt/master /var/run/salt/master /opt/saltstack/salt
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" /var/lib/salt/master
+            [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_EXTRAS_DIR"
+            chown -R $SALT_USER:$SALT_GROUP /etc/salt/pki/master /etc/salt/master.d /var/log/salt/master /var/log/salt/key /var/cache/salt/master /var/run/salt/master
+        else
+            logger -t salt-master "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/master/ layout." 2>/dev/null || true
+            chown -R $SALT_USER:$SALT_GROUP /etc/salt/pki/master /etc/salt/master.d /var/log/salt/master /var/log/salt/key /var/cache/salt/master /var/run/salt/master /opt/saltstack/salt
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
+            fi
+        fi
+    fi
+    # Upgrade migration: hardened only, one-shot.
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+       && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+       && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+       && [ -d "$SALT_EXTRAS_DIR" ] \
+       && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+        mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+        chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
     fi
 
 
@@ -850,6 +955,14 @@ else
     fi
     [ -n "$SALT_USER" ] || SALT_USER=%{_SALT_USER}
     [ -n "$SALT_GROUP" ] || SALT_GROUP=%{_SALT_GROUP}
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/syndic/home
+        if [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+            SALT_EXTRAS_DIR=/var/lib/salt/syndic/extras-${PY_VER}
+        fi
+    fi
     if [ ! -e "/var/log/salt/syndic" ]; then
       touch /var/log/salt/syndic
       chmod 640 /var/log/salt/syndic
@@ -858,7 +971,29 @@ else
         # Upgrade: preserve existing ownership, don't reset to defaults
         :
     else
-        chown -R $SALT_USER:$SALT_GROUP /var/log/salt/syndic /opt/saltstack/salt
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" /var/lib/salt/syndic
+            [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_EXTRAS_DIR"
+            chown -R $SALT_USER:$SALT_GROUP /var/log/salt/syndic
+        else
+            logger -t salt-syndic "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/syndic/ layout." 2>/dev/null || true
+            chown -R $SALT_USER:$SALT_GROUP /var/log/salt/syndic /opt/saltstack/salt
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
+            fi
+        fi
+    fi
+    # Upgrade migration: hardened only, one-shot.
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+       && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+       && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+       && [ -d "$SALT_EXTRAS_DIR" ] \
+       && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+        mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+        chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
     fi
 
 
@@ -869,6 +1004,14 @@ else
     fi
     [ -n "$SALT_USER" ] || SALT_USER=%{_SALT_USER}
     [ -n "$SALT_GROUP" ] || SALT_GROUP=%{_SALT_GROUP}
+    [ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+    PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        [ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/api/home
+        if [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+            SALT_EXTRAS_DIR=/var/lib/salt/api/extras-${PY_VER}
+        fi
+    fi
     if [ ! -e "/var/log/salt/api" ]; then
       touch /var/log/salt/api
       chmod 640 /var/log/salt/api
@@ -877,7 +1020,29 @@ else
         # Upgrade: preserve existing ownership, don't reset to defaults
         :
     else
-        chown -R $SALT_USER:$SALT_GROUP /var/log/salt/api /opt/saltstack/salt
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" /var/lib/salt/api
+            [ -n "$SALT_HOME" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$SALT_USER" -g "$SALT_GROUP" "$SALT_EXTRAS_DIR"
+            chown -R $SALT_USER:$SALT_GROUP /var/log/salt/api
+        else
+            logger -t salt-api "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/api/ layout." 2>/dev/null || true
+            chown -R $SALT_USER:$SALT_GROUP /var/log/salt/api /opt/saltstack/salt
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
+            fi
+        fi
+    fi
+    # Upgrade migration: hardened only, one-shot.
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -n "$PY_VER" ] \
+       && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+       && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+       && [ -d "$SALT_EXTRAS_DIR" ] \
+       && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+        mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+        rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+        chown -R $SALT_USER:$SALT_GROUP "$SALT_EXTRAS_DIR" || true
     fi
 
 %posttrans minion
@@ -891,6 +1056,19 @@ if [ ! -e "/var/log/salt/key" ]; then
   chmod 640 /var/log/salt/key
 fi
 
+# SALT_ONEDIR_HARDEN default flip on 3009.0+ (issue #70198). Honor
+# opt-out SALT_ONEDIR_HARDEN=0 for the deprecation window. Read setup
+# file early so hardening flag/paths are visible in both branches below.
+if [ -f /etc/sysconfig/salt-minion-setup ]; then
+    . /etc/sysconfig/salt-minion-setup
+fi
+[ -n "$SALT_ONEDIR_HARDEN" ] || SALT_ONEDIR_HARDEN=1
+PY_VER=$(/opt/saltstack/salt/bin/python3 -c "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info)); sys.stdout.flush()" 2>/dev/null || echo "")
+if [ "$SALT_ONEDIR_HARDEN" = "1" ] && [ -z "$SALT_EXTRAS_DIR" ] && [ -n "$PY_VER" ]; then
+    SALT_EXTRAS_DIR=/var/lib/salt/minion/extras-${PY_VER}
+fi
+[ -n "$SALT_HOME" ] || SALT_HOME=/var/lib/salt/minion/home
+
 # Check for preserved ownership marker (from %pre)
 if [ -f "/tmp/.salt-minion-upgrade-ownership" ]; then
     # Upgrade case where we detected previous user
@@ -914,8 +1092,29 @@ if [ -f "/tmp/.salt-minion-upgrade-ownership" ]; then
     chown $OWNERSHIP /var/cache/salt/minion/proc
     chmod 750 /var/cache/salt/minion/proc
 
-    # Restore ownership of the main installation directory for salt-pip access
-    chown -R $OWNERSHIP /opt/saltstack/salt
+    if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+        # Hardened: keep /opt/saltstack/salt root-owned; chown only the
+        # per-daemon writable dirs. See issue #70198.
+        install -d -m 0755 -o "${OWNERSHIP%:*}" -g "${OWNERSHIP#*:}" /var/lib/salt/minion
+        install -d -m 0755 -o "${OWNERSHIP%:*}" -g "${OWNERSHIP#*:}" "$SALT_HOME"
+        [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "${OWNERSHIP%:*}" -g "${OWNERSHIP#*:}" "$SALT_EXTRAS_DIR"
+        # Upgrade migration: move populated legacy extras into new
+        # per-daemon location. Idempotent no-op if already migrated.
+        if [ -n "$PY_VER" ] \
+           && [ -d "/opt/saltstack/salt/extras-${PY_VER}" ] \
+           && [ -n "$(ls -A /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null)" ] \
+           && [ -d "$SALT_EXTRAS_DIR" ] \
+           && [ -z "$(ls -A ${SALT_EXTRAS_DIR} 2>/dev/null)" ]; then
+            mv /opt/saltstack/salt/extras-${PY_VER}/* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            mv /opt/saltstack/salt/extras-${PY_VER}/.[!.]* "$SALT_EXTRAS_DIR"/ 2>/dev/null || true
+            rmdir /opt/saltstack/salt/extras-${PY_VER} 2>/dev/null || true
+            chown -R $OWNERSHIP "$SALT_EXTRAS_DIR" || true
+        fi
+    else
+        logger -t salt-minion "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/minion/ layout." 2>/dev/null || true
+        # Restore ownership of the main installation directory for salt-pip access
+        chown -R $OWNERSHIP /opt/saltstack/salt
+    fi
 
     # Clean up
     rm -f /tmp/.salt-minion-upgrade-ownership
@@ -924,11 +1123,6 @@ if [ -f "/tmp/.salt-minion-upgrade-ownership" ]; then
 else
     # Fresh install or upgrade from root
 
-    # Check for configuration file in /etc/sysconfig/salt-minion-setup
-    if [ -f /etc/sysconfig/salt-minion-setup ]; then
-        . /etc/sysconfig/salt-minion-setup
-    fi
-
     # SALT_MINION_USER is the historical minion-specific knob; SALT_USER
     # is the new generic knob from issue #69402. Either may be set in
     # /etc/sysconfig/salt-minion-setup; the minion-specific knob wins so
@@ -939,11 +1133,20 @@ else
     # For fresh installs, set ownership based on environment variables or defaults
     if [ -n "$_MN_USER" ] && [ "$_MN_USER" != "root" ]; then
         chown -R $_MN_USER:$_MN_GROUP /etc/salt/pki/minion /etc/salt/minion.d /var/log/salt/minion /var/cache/salt/minion /var/run/salt/minion /var/log/salt /var/cache/salt
-        # Ensure the main installation directory is also owned by the salt user for salt-pip
-        chown -R $_MN_USER:$_MN_GROUP /opt/saltstack/salt
-        # Also chown an explicitly relocated extras dir if set.
-        if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
-            chown -R $_MN_USER:$_MN_GROUP "$SALT_EXTRAS_DIR"
+        if [ "$SALT_ONEDIR_HARDEN" = "1" ]; then
+            # Hardened: per-daemon writable dirs only; /opt/saltstack/salt
+            # stays root:root 0755. See issue #70198.
+            install -d -m 0755 -o "$_MN_USER" -g "$_MN_GROUP" /var/lib/salt/minion
+            install -d -m 0755 -o "$_MN_USER" -g "$_MN_GROUP" "$SALT_HOME"
+            [ -n "$SALT_EXTRAS_DIR" ] && install -d -m 0755 -o "$_MN_USER" -g "$_MN_GROUP" "$SALT_EXTRAS_DIR"
+        else
+            logger -t salt-minion "SALT_ONEDIR_HARDEN=0: legacy /opt/saltstack/salt chown layout is deprecated and will be removed in a future release; unset the variable or set it to 1 to opt into the hardened per-daemon /var/lib/salt/minion/ layout." 2>/dev/null || true
+            # Ensure the main installation directory is also owned by the salt user for salt-pip
+            chown -R $_MN_USER:$_MN_GROUP /opt/saltstack/salt
+            # Also chown an explicitly relocated extras dir if set.
+            if [ -n "$SALT_EXTRAS_DIR" ] && [ -d "$SALT_EXTRAS_DIR" ]; then
+                chown -R $_MN_USER:$_MN_GROUP "$SALT_EXTRAS_DIR"
+            fi
         fi
     fi
 fi
diff --git a/salt/scripts.py b/salt/scripts.py
index b2002b1dc6c7..aea7fa71592d 100644
--- a/salt/scripts.py
+++ b/salt/scripts.py
@@ -7,6 +7,7 @@
 import logging
 import multiprocessing
 import os
+import pathlib
 import signal
 import subprocess
 import sys
@@ -698,6 +699,24 @@ def _get_onedir_env_path():
     return None
 
 
+def _resolve_extras_dir(relenv_path):
+    """
+    Resolve the salt-pip extras target directory.
+
+    Honors the ``SALT_EXTRAS_DIR`` env var (set by the packaging
+    scriptlets, or manually by the operator) so ``salt-pip install``
+    writes to the same directory that the packaging chown targets.
+    Falls back to the historical ``<relenv_root>/extras-<py>``
+    computation when the env var is unset.
+
+    See issue #70198.
+    """
+    override = os.environ.get("SALT_EXTRAS_DIR")
+    if override:
+        return override
+    return str(pathlib.Path(relenv_path) / "extras-{}.{}".format(*sys.version_info))
+
+
 def _supervisor_config_dir():
     """
     Return the salt config directory to use when the keepalive supervisor
@@ -790,7 +809,10 @@ def salt_pip(config_dir=None):
         )
         sys.exit(salt.defaults.exitcodes.EX_GENERIC)
     else:
-        extras = str(relenv_path / "extras-{}.{}".format(*sys.version_info))
+        # SALT_EXTRAS_DIR (set by the packaging postinst under
+        # SALT_ONEDIR_HARDEN) wins over the historical
+        # <relenv_root>/extras-<py> fallback. See issue #70198.
+        extras = _resolve_extras_dir(relenv_path)
 
     # Use provided config_dir, or SALT_CONFIG_DIR env var, or SALT_MINION_CONFIG env var, or fall back to default location
     if config_dir:
diff --git a/tests/pytests/pkg/integration/test_onedir_harden.py b/tests/pytests/pkg/integration/test_onedir_harden.py
new file mode 100644
index 000000000000..e98819446a0b
--- /dev/null
+++ b/tests/pytests/pkg/integration/test_onedir_harden.py
@@ -0,0 +1,169 @@
+"""
+Coverage for the SALT_ONEDIR_HARDEN packaging default (issue #70198).
+
+3009.0 flips ``SALT_ONEDIR_HARDEN=1`` on by default so the salt daemon's
+writable state lives under per-daemon ``/var/lib/salt/<daemon>/``
+directories and ``/opt/saltstack/salt`` stays root:root 0755. The tests
+below verify that layout on a freshly-installed package, plus the
+runtime contract that ``salt-pip`` and the daemon's Python honor the
+``SALT_EXTRAS_DIR`` env var so the relocated tree stays importable.
+
+These are Linux-package-only tests -- Windows uses a different packaging
+model entirely.
+"""
+
+import os
+import pathlib
+import subprocess
+
+import packaging.version
+import pytest
+
+pytestmark = [
+    pytest.mark.skip_unless_on_linux,
+]
+
+
+@pytest.fixture
+def py_ver():
+    """Onedir Python major.minor, e.g. ``3.11``."""
+    proc = subprocess.run(
+        [
+            "/opt/saltstack/salt/bin/python3",
+            "-c",
+            "import sys; sys.stdout.write('{}.{}'.format(*sys.version_info))",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return proc.stdout.strip()
+
+
+def _skip_pre_3009(install_salt):
+    """
+    SALT_ONEDIR_HARDEN default flip lands on 3009.0. Older builds still
+    ship the legacy layout, so these assertions can't apply.
+    """
+    if packaging.version.parse(install_salt.version) < packaging.version.parse(
+        "3009.0"
+    ):
+        pytest.skip("SALT_ONEDIR_HARDEN=1 default lands on 3009.0")
+
+
+def test_onedir_tree_is_root_owned(install_salt, salt_master):
+    """
+    Under the hardened default, /opt/saltstack/salt stays owned by
+    root:root at 0755 -- the postinst/posttrans no longer chowns the
+    onedir tree to the salt user.
+    """
+    _skip_pre_3009(install_salt)
+    if os.environ.get("SALT_ONEDIR_HARDEN") == "0":
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.exists()
+    assert (
+        tree.owner() == "root"
+    ), f"/opt/saltstack/salt owner is {tree.owner()!r}, expected root"
+    assert (
+        tree.group() == "root"
+    ), f"/opt/saltstack/salt group is {tree.group()!r}, expected root"
+
+
+def test_per_daemon_writable_dirs_owned_by_salt(install_salt, salt_master, py_ver):
+    """
+    Under the hardened default, each daemon's writable state lives at
+    /var/lib/salt/<daemon>/{home,extras-<py>} and those dirs are owned
+    by the salt user, not root.
+    """
+    _skip_pre_3009(install_salt)
+    if os.environ.get("SALT_ONEDIR_HARDEN") == "0":
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    # salt-master is definitely installed in the pkg test fixture; assert
+    # its per-daemon dir. Other daemons are checked only if their base
+    # dir exists (multi-role hosts get more coverage; single-role hosts
+    # get the daemon they've installed).
+    master_dir = pathlib.Path("/var/lib/salt/master")
+    assert (
+        master_dir.exists()
+    ), "expected /var/lib/salt/master to exist under SALT_ONEDIR_HARDEN=1"
+    assert master_dir.owner() == "salt"
+
+    home = master_dir / "home"
+    if home.exists():
+        assert home.owner() == "salt"
+
+    extras = master_dir / f"extras-{py_ver}"
+    if extras.exists():
+        assert extras.owner() == "salt"
+
+    # Spot-check any other daemon that's also installed.
+    for daemon in ("minion", "syndic", "api", "cloud"):
+        daemon_dir = pathlib.Path(f"/var/lib/salt/{daemon}")
+        if daemon_dir.exists():
+            assert daemon_dir.owner() == "salt", (
+                f"/var/lib/salt/{daemon} owner is {daemon_dir.owner()!r},"
+                " expected salt"
+            )
+
+
+def test_salt_pip_honors_salt_extras_dir(install_salt, tmp_path, py_ver):
+    """
+    Runtime contract: ``salt-pip install`` honors the SALT_EXTRAS_DIR
+    env var (packaging layer sets this under SALT_ONEDIR_HARDEN=1 so
+    packages land in the same place the daemon's Python imports from).
+
+    The unit tests already cover the extras-resolution helper; this
+    integration test verifies the resolved value actually reaches pip's
+    ``--target`` and PYTHONPATH via the real salt-pip binary.
+    """
+    _skip_pre_3009(install_salt)
+
+    override = tmp_path / "override-extras"
+    override.mkdir()
+
+    env = os.environ.copy()
+    env["SALT_EXTRAS_DIR"] = str(override)
+
+    # Install a small pure-python package that has no compiled deps so
+    # the test is fast and portable across archs.
+    proc = subprocess.run(
+        [
+            "/opt/saltstack/salt/bin/salt-pip",
+            "install",
+            "--no-deps",
+            "six",
+        ],
+        env=env,
+        capture_output=True,
+        text=True,
+        timeout=180,
+        check=False,
+    )
+    assert proc.returncode == 0, (
+        f"salt-pip install failed under SALT_EXTRAS_DIR override:\n"
+        f"stdout={proc.stdout!r}\nstderr={proc.stderr!r}"
+    )
+
+    # Verify the package landed under the override, not under
+    # /opt/saltstack/salt/extras-<py>.
+    assert (override / "six.py").exists() or list(override.glob("six-*")), (
+        f"six was not installed into SALT_EXTRAS_DIR override {override}; "
+        f"tree contents: {list(override.iterdir())}"
+    )
+
+    # Clean up so we don't pollute subsequent tests.
+    subprocess.run(
+        [
+            "/opt/saltstack/salt/bin/salt-pip",
+            "uninstall",
+            "-y",
+            "six",
+        ],
+        env=env,
+        capture_output=True,
+        timeout=60,
+        check=False,
+    )
diff --git a/tests/pytests/unit/test_salt_onedir_extras.py b/tests/pytests/unit/test_salt_onedir_extras.py
new file mode 100644
index 000000000000..13cfe4a4b8a7
--- /dev/null
+++ b/tests/pytests/unit/test_salt_onedir_extras.py
@@ -0,0 +1,103 @@
+"""
+Unit tests for ``pkg/common/onedir/_salt_onedir_extras.py``.
+
+This module is the ``.pth``-installed hook that prepends the salt-pip
+extras directory to ``sys.path`` at interpreter startup. It runs before
+salt itself is importable, so it lives outside the ``salt`` package.
+"""
+
+import importlib.util
+import pathlib
+import sys
+
+import pytest
+
+_EXTRAS_MODULE_PATH = (
+    pathlib.Path(__file__).resolve().parents[3]
+    / "pkg"
+    / "common"
+    / "onedir"
+    / "_salt_onedir_extras.py"
+)
+
+
+@pytest.fixture
+def extras_module():
+    """
+    Load ``_salt_onedir_extras`` fresh from disk so each test starts with
+    the sys.path shape the interpreter would present at startup.
+    """
+    spec = importlib.util.spec_from_file_location(
+        "_salt_onedir_extras_under_test", _EXTRAS_MODULE_PATH
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _default_extras_path(pth_file_path):
+    """Recompute the historical <relenv_root>/extras-<py> path."""
+    parent = pathlib.Path(pth_file_path).resolve().parent.parent
+    if not sys.platform.startswith("win"):
+        parent = parent.parent
+    return str(parent / "extras-{}.{}".format(*sys.version_info))
+
+
+def test_setup_falls_back_to_relenv_extras(extras_module, monkeypatch, tmp_path):
+    """
+    Without SALT_EXTRAS_DIR set, the extras dir is derived from the
+    ``.pth`` file's on-disk location (the historical behavior).
+    """
+    monkeypatch.delenv("SALT_EXTRAS_DIR", raising=False)
+    pth_file = tmp_path / "sub1" / "sub2" / "sub3" / "_salt_onedir_extras.pth"
+    pth_file.parent.mkdir(parents=True)
+    pth_file.write_text("")
+
+    expected = _default_extras_path(pth_file)
+
+    original_path = list(sys.path)
+    try:
+        extras_module.setup(str(pth_file))
+        assert sys.path[0] == expected
+    finally:
+        sys.path[:] = original_path
+
+
+def test_setup_honors_env_override(extras_module, monkeypatch, tmp_path):
+    """
+    When SALT_EXTRAS_DIR is set, it wins over the .pth-derived path.
+    This is the packaging hardened-layout path (issue #70198).
+    """
+    override = "/var/lib/salt/minion/extras-3.11"
+    monkeypatch.setenv("SALT_EXTRAS_DIR", override)
+    pth_file = tmp_path / "sub1" / "sub2" / "sub3" / "_salt_onedir_extras.pth"
+    pth_file.parent.mkdir(parents=True)
+    pth_file.write_text("")
+
+    original_path = list(sys.path)
+    try:
+        extras_module.setup(str(pth_file))
+        assert sys.path[0] == override
+    finally:
+        sys.path[:] = original_path
+
+
+def test_setup_promotes_existing_path_entry(extras_module, monkeypatch, tmp_path):
+    """
+    If the extras path is already on sys.path but not at index 0, setup
+    moves it to the front.
+    """
+    override = "/var/lib/salt/master/extras-3.11"
+    monkeypatch.setenv("SALT_EXTRAS_DIR", override)
+    pth_file = tmp_path / "_salt_onedir_extras.pth"
+    pth_file.write_text("")
+
+    original_path = list(sys.path)
+    try:
+        sys.path.append(override)
+        extras_module.setup(str(pth_file))
+        assert sys.path[0] == override
+        # And is not duplicated.
+        assert sys.path.count(override) == 1
+    finally:
+        sys.path[:] = original_path
diff --git a/tests/pytests/unit/test_scripts.py b/tests/pytests/unit/test_scripts.py
index b95ab6296a72..63abcc895390 100644
--- a/tests/pytests/unit/test_scripts.py
+++ b/tests/pytests/unit/test_scripts.py
@@ -1,4 +1,5 @@
 import multiprocessing
+import pathlib
 import subprocess
 import sys
 import textwrap
@@ -6,7 +7,7 @@
 import pytest
 
 import salt.scripts
-from salt.scripts import _pip_args, _pip_environment
+from salt.scripts import _pip_args, _pip_environment, _resolve_extras_dir
 from tests.support.mock import MagicMock, patch
 
 
@@ -87,6 +88,51 @@ def test_pip_args_installing_with_target():
     assert pargs == ["install", "--target=/tmp/bartest"]
 
 
+# ---------------------------------------------------------------------------
+# SALT_EXTRAS_DIR honoring (issue #70198)
+#
+# When the packaging scriptlets relocate the extras tree outside the
+# onedir under SALT_ONEDIR_HARDEN=1, they export SALT_EXTRAS_DIR pointing
+# at /var/lib/salt/<daemon>/extras-<py>. ``salt-pip`` and the onedir .pth
+# helper both need to honor that so packages installed via ``salt-pip``
+# land where the daemon's Python actually imports from.
+# ---------------------------------------------------------------------------
+
+
+def test_resolve_extras_dir_falls_back_to_relenv_extras(monkeypatch):
+    """
+    Without SALT_EXTRAS_DIR set, the extras dir is the historical
+    <relenv_root>/extras-<py-major>.<py-minor> path.
+    """
+    monkeypatch.delenv("SALT_EXTRAS_DIR", raising=False)
+    relenv_root = pathlib.Path("/opt/saltstack/salt")
+    resolved = _resolve_extras_dir(relenv_root)
+    assert resolved == str(relenv_root / "extras-{}.{}".format(*sys.version_info))
+
+
+def test_resolve_extras_dir_honors_env_override(monkeypatch):
+    """
+    When SALT_EXTRAS_DIR is set (packaging hardened layout), the extras
+    dir override wins over the relenv-derived path.
+    """
+    monkeypatch.setenv("SALT_EXTRAS_DIR", "/var/lib/salt/minion/extras-3.11")
+    relenv_root = pathlib.Path("/opt/saltstack/salt")
+    resolved = _resolve_extras_dir(relenv_root)
+    assert resolved == "/var/lib/salt/minion/extras-3.11"
+
+
+def test_resolve_extras_dir_empty_env_falls_back(monkeypatch):
+    """
+    Empty-string SALT_EXTRAS_DIR is treated as unset (avoid targeting
+    "/", which would happen if the packaging layer wrote an empty
+    variable).
+    """
+    monkeypatch.setenv("SALT_EXTRAS_DIR", "")
+    relenv_root = pathlib.Path("/opt/saltstack/salt")
+    resolved = _resolve_extras_dir(relenv_root)
+    assert resolved == str(relenv_root / "extras-{}.{}".format(*sys.version_info))
+
+
 # ---------------------------------------------------------------------------
 # multiprocessing start-method pin (Python 3.14+ on Linux)
 #

From dfcaa47bf74baef08c589951bdd540c77c4e7230 Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <daniel.wozniak@broadcom.com>
Date: Mon, 31 Aug 2026 22:13:06 -0700
Subject: [PATCH 2/3] Parametrize onedir-harden tests across all 5 daemons

Adds per-daemon fanout for the writable-dir existence/ownership
checks (previously only master was covered), belt-and-braces asserts
for /opt/saltstack/salt files staying root-owned, an explicit
unset-vs-1 gate check, and multi-role isolation verification that
each daemon's /var/lib/salt/<daemon>/ is a distinct directory with
no cross-daemon file visibility. Collection grows from 3 to 20 tests.

Refs #70198.
---
 .../pkg/integration/test_onedir_harden.py     | 247 +++++++++++++++---
 1 file changed, 211 insertions(+), 36 deletions(-)

diff --git a/tests/pytests/pkg/integration/test_onedir_harden.py b/tests/pytests/pkg/integration/test_onedir_harden.py
index e98819446a0b..790fcc74d77e 100644
--- a/tests/pytests/pkg/integration/test_onedir_harden.py
+++ b/tests/pytests/pkg/integration/test_onedir_harden.py
@@ -1,15 +1,26 @@
 """
 Coverage for the SALT_ONEDIR_HARDEN packaging default (issue #70198).
 
-3009.0 flips ``SALT_ONEDIR_HARDEN=1`` on by default so the salt daemon's
-writable state lives under per-daemon ``/var/lib/salt/<daemon>/``
-directories and ``/opt/saltstack/salt`` stays root:root 0755. The tests
-below verify that layout on a freshly-installed package, plus the
+3009.0 flips ``SALT_ONEDIR_HARDEN=1`` on by default so each salt
+daemon's writable state lives under per-daemon
+``/var/lib/salt/<daemon>/`` directories and ``/opt/saltstack/salt``
+stays root:root 0755. The tests below verify that layout on a
+freshly-installed package (all 5 daemons parametrized), plus the
 runtime contract that ``salt-pip`` and the daemon's Python honor the
 ``SALT_EXTRAS_DIR`` env var so the relocated tree stays importable.
 
-These are Linux-package-only tests -- Windows uses a different packaging
-model entirely.
+These tests use the session-scoped ``install_salt`` fixture from the
+parent conftest, which installs every salt daemon package. That means
+each parametrized daemon assertion runs against the same real install
+-- the multi-role host isolation test below is what verifies the
+per-daemon paths don't collide.
+
+For destructive-cycle coverage (SALT_ONEDIR_HARDEN=0 escape hatch,
+explicit SALT_HOME/SALT_EXTRAS_DIR override precedence, and upgrade
+migration), see ``tests/pytests/pkg/integration/config_overrides/``
+which owns the fresh-install/uninstall fixture stack.
+
+Linux-package-only -- Windows uses a different packaging model.
 """
 
 import os
@@ -24,6 +35,24 @@
 ]
 
 
+# All 5 daemons in the ``SALT_ONEDIR_HARDEN`` matrix. The session-scoped
+# ``install_salt`` fixture installs every one of them, so parametrizing
+# a test across the list gives per-daemon fanout without any extra
+# install lifecycle.
+DAEMONS = ("minion", "master", "syndic", "api", "cloud")
+
+
+def _hardened_mode_selected():
+    """
+    Return True when the current test session is running against a
+    package installed with SALT_ONEDIR_HARDEN=1 (the default). The
+    packaging default flips on 3009.0, so if the env var is unset we
+    treat it as hardened. If the operator explicitly opted out with
+    SALT_ONEDIR_HARDEN=0, the layout assertions below can't apply.
+    """
+    return os.environ.get("SALT_ONEDIR_HARDEN", "1") != "0"
+
+
 @pytest.fixture
 def py_ver():
     """Onedir Python major.minor, e.g. ``3.11``."""
@@ -51,14 +80,19 @@ def _skip_pre_3009(install_salt):
         pytest.skip("SALT_ONEDIR_HARDEN=1 default lands on 3009.0")
 
 
-def test_onedir_tree_is_root_owned(install_salt, salt_master):
+# ---------------------------------------------------------------------------
+# Priority 1 -- explicit gate coverage
+# ---------------------------------------------------------------------------
+
+
+def test_onedir_tree_is_root_owned_when_hardened(install_salt, salt_master):
     """
     Under the hardened default, /opt/saltstack/salt stays owned by
     root:root at 0755 -- the postinst/posttrans no longer chowns the
     onedir tree to the salt user.
     """
     _skip_pre_3009(install_salt)
-    if os.environ.get("SALT_ONEDIR_HARDEN") == "0":
+    if not _hardened_mode_selected():
         pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
 
     tree = pathlib.Path("/opt/saltstack/salt")
@@ -71,42 +105,183 @@ def test_onedir_tree_is_root_owned(install_salt, salt_master):
     ), f"/opt/saltstack/salt group is {tree.group()!r}, expected root"
 
 
-def test_per_daemon_writable_dirs_owned_by_salt(install_salt, salt_master, py_ver):
+def test_onedir_tree_files_are_root_when_hardened(install_salt, salt_master):
     """
-    Under the hardened default, each daemon's writable state lives at
-    /var/lib/salt/<daemon>/{home,extras-<py>} and those dirs are owned
-    by the salt user, not root.
+    Belt-and-braces: not just the top-level dir but a sampling of files
+    *under* /opt/saltstack/salt/ stay root-owned in the hardened case.
+    Spot-checks bin/python3, bin/salt-pip, and lib/ so a partial or
+    accidental deep chown gets caught.
     """
     _skip_pre_3009(install_salt)
-    if os.environ.get("SALT_ONEDIR_HARDEN") == "0":
+    if not _hardened_mode_selected():
         pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
 
-    # salt-master is definitely installed in the pkg test fixture; assert
-    # its per-daemon dir. Other daemons are checked only if their base
-    # dir exists (multi-role hosts get more coverage; single-role hosts
-    # get the daemon they've installed).
+    for rel in ("bin/python3", "bin/salt-pip", "lib"):
+        target = pathlib.Path("/opt/saltstack/salt") / rel
+        if not target.exists():
+            continue
+        assert (
+            target.owner() == "root"
+        ), f"{target} owner is {target.owner()!r}, expected root"
+
+
+def test_hardening_unset_matches_hardened_default(install_salt, salt_master):
+    """
+    SALT_ONEDIR_HARDEN unset must behave identically to
+    SALT_ONEDIR_HARDEN=1 on 3009.0+. Belt-and-braces to catch a future
+    accidental default flip.
+    """
+    _skip_pre_3009(install_salt)
+    if os.environ.get("SALT_ONEDIR_HARDEN") not in (None, "", "1"):
+        pytest.skip("Explicit SALT_ONEDIR_HARDEN override selected")
+
+    # Both assertions from the hardened-mode tests above.
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.owner() == "root"
+
     master_dir = pathlib.Path("/var/lib/salt/master")
-    assert (
-        master_dir.exists()
-    ), "expected /var/lib/salt/master to exist under SALT_ONEDIR_HARDEN=1"
+    assert master_dir.exists()
     assert master_dir.owner() == "salt"
 
-    home = master_dir / "home"
-    if home.exists():
-        assert home.owner() == "salt"
-
-    extras = master_dir / f"extras-{py_ver}"
-    if extras.exists():
-        assert extras.owner() == "salt"
-
-    # Spot-check any other daemon that's also installed.
-    for daemon in ("minion", "syndic", "api", "cloud"):
-        daemon_dir = pathlib.Path(f"/var/lib/salt/{daemon}")
-        if daemon_dir.exists():
-            assert daemon_dir.owner() == "salt", (
-                f"/var/lib/salt/{daemon} owner is {daemon_dir.owner()!r},"
-                " expected salt"
-            )
+
+# ---------------------------------------------------------------------------
+# Priority 2 -- per-daemon fanout
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("daemon", DAEMONS)
+def test_per_daemon_writable_dir_exists_and_owned_by_salt(
+    install_salt, salt_master, daemon
+):
+    """
+    Under the hardened default, each of the 5 daemons gets its own
+    /var/lib/salt/<daemon>/ writable dir, owned by the salt user.
+    Verified per-daemon so a regression in, say, the salt-syndic
+    postinst doesn't hide behind a still-working salt-master postinst.
+    """
+    _skip_pre_3009(install_salt)
+    if not _hardened_mode_selected():
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    daemon_dir = pathlib.Path(f"/var/lib/salt/{daemon}")
+    assert (
+        daemon_dir.exists()
+    ), f"expected /var/lib/salt/{daemon} to exist under SALT_ONEDIR_HARDEN=1"
+    assert daemon_dir.owner() == "salt", (
+        f"/var/lib/salt/{daemon} owner is {daemon_dir.owner()!r}," " expected salt"
+    )
+
+
+@pytest.mark.parametrize("daemon", DAEMONS)
+def test_per_daemon_home_owned_by_salt(install_salt, salt_master, daemon):
+    """
+    Each daemon's per-daemon home dir is chowned to the salt user so
+    the daemon process can actually write there.
+    """
+    _skip_pre_3009(install_salt)
+    if not _hardened_mode_selected():
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    home = pathlib.Path(f"/var/lib/salt/{daemon}/home")
+    if not home.exists():
+        # Not every daemon's postinst creates the home subdir eagerly
+        # (e.g. cloud is a client, not a daemon). If it wasn't created
+        # the parent dir still counts -- covered by the test above.
+        pytest.skip(
+            f"/var/lib/salt/{daemon}/home not created by this daemon's postinst"
+        )
+    assert home.owner() == "salt"
+
+
+@pytest.mark.parametrize("daemon", DAEMONS)
+def test_per_daemon_extras_owned_by_salt(install_salt, salt_master, py_ver, daemon):
+    """
+    Each daemon's per-daemon extras dir is chowned to the salt user so
+    salt-pip installs land in a writable location.
+    """
+    _skip_pre_3009(install_salt)
+    if not _hardened_mode_selected():
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    extras = pathlib.Path(f"/var/lib/salt/{daemon}/extras-{py_ver}")
+    if not extras.exists():
+        pytest.skip(
+            f"/var/lib/salt/{daemon}/extras-{py_ver} not created by this "
+            "daemon's postinst"
+        )
+    assert extras.owner() == "salt"
+
+
+# ---------------------------------------------------------------------------
+# Priority 5 -- multi-role host isolation
+#
+# The session install_salt fixture installs all 5 daemons on the same
+# host. The hardened layout's core guarantee is that each daemon's
+# writable state is *isolated* from the others -- a write to
+# /var/lib/salt/minion/extras/ must not appear under
+# /var/lib/salt/master/extras/.
+#
+# Fixture note: full multi-role coverage (different SALT_USER per
+# daemon, cross-daemon file visibility with real running daemons)
+# would require test scaffolding that runs each daemon under a
+# different account. That's a fixture-plumbing extension deferred to
+# a follow-up test PR; this test verifies the packaging-level
+# separation, which is the load-bearing guarantee.
+# ---------------------------------------------------------------------------
+
+
+def test_per_daemon_dirs_are_distinct(install_salt, salt_master, py_ver):
+    """
+    Multi-role isolation: every per-daemon dir exists as an independent
+    directory (not symlinks, not shared inodes). A file written to one
+    daemon's tree must not appear under another daemon's tree.
+    """
+    _skip_pre_3009(install_salt)
+    if not _hardened_mode_selected():
+        pytest.skip("SALT_ONEDIR_HARDEN=0 opt-out selected")
+
+    present = [d for d in DAEMONS if pathlib.Path(f"/var/lib/salt/{d}").exists()]
+    assert len(present) >= 2, (
+        "Multi-role isolation test needs at least 2 daemons installed; "
+        f"found {present!r}. Session install_salt should install all 5."
+    )
+
+    # Distinct inodes -- no bind-mount / hardlink collapse.
+    inodes = {}
+    for daemon in present:
+        st = pathlib.Path(f"/var/lib/salt/{daemon}").stat()
+        assert (
+            st.st_dev,
+            st.st_ino,
+        ) not in inodes.values(), (
+            f"/var/lib/salt/{daemon} shares inode with an earlier daemon dir"
+        )
+        inodes[daemon] = (st.st_dev, st.st_ino)
+
+    # Cross-daemon file-visibility check. Drop a marker under each
+    # daemon's dir, then assert it's ONLY visible under that daemon.
+    markers = {}
+    try:
+        for daemon in present:
+            marker = pathlib.Path(f"/var/lib/salt/{daemon}/.isolation-marker")
+            marker.write_text(daemon, encoding="utf-8")
+            markers[daemon] = marker
+        for daemon in present:
+            for other in present:
+                other_marker = pathlib.Path(f"/var/lib/salt/{other}/.isolation-marker")
+                content = other_marker.read_text(encoding="utf-8")
+                assert content == other, (
+                    f"marker under /var/lib/salt/{other} reads {content!r} "
+                    f"(cross-daemon leak from {daemon}?)"
+                )
+    finally:
+        for marker in markers.values():
+            marker.unlink(missing_ok=True)
+
+
+# ---------------------------------------------------------------------------
+# Runtime salt-pip contract
+# ---------------------------------------------------------------------------
 
 
 def test_salt_pip_honors_salt_extras_dir(install_salt, tmp_path, py_ver):

From 9baa152eeba653f6a6d820c3a57c1c35394e804b Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <daniel.wozniak@broadcom.com>
Date: Mon, 31 Aug 2026 22:16:12 -0700
Subject: [PATCH 3/3] Add SALT_ONEDIR_HARDEN destructive-cycle pkg tests

New sibling directory tests/pytests/pkg/integration/onedir_harden_lifecycle/
covers what the session-scoped install_salt fixture can't:

- SALT_ONEDIR_HARDEN=0 opt-out: legacy /opt/saltstack/salt chown,
  deprecation warning surfaces via journalctl / syslog, per-daemon
  /var/lib/salt/<daemon>/ dirs absent
- SALT_ONEDIR_HARDEN unset == hardened default
- Explicit SALT_HOME and SALT_EXTRAS_DIR overrides win over the
  HARDEN=1 default (per-daemon dirs replaced by operator-chosen paths)
- Upgrade migration: pre-populates /opt/saltstack/salt/extras-<py>/
  with a marker under HARDEN=0, then reinstalls with HARDEN=1 and
  asserts marker moved into /var/lib/salt/<daemon>/extras-<py>/
- Idempotency: dpkg-reconfigure / dnf reinstall doesn't resurrect the
  legacy dir or duplicate the marker

Mirrors the config_overrides/ destructive-fixture pattern
(collection-skip on upgrade/downgrade/no-install passes, per-test
apt/rpm purge, force-purge on postinst failure). 8 new tests.

Refs #70198.
---
 .../onedir_harden_lifecycle/__init__.py       |   0
 .../onedir_harden_lifecycle/conftest.py       | 413 ++++++++++++++++++
 .../onedir_harden_lifecycle/test_lifecycle.py | 340 ++++++++++++++
 3 files changed, 753 insertions(+)
 create mode 100644 tests/pytests/pkg/integration/onedir_harden_lifecycle/__init__.py
 create mode 100644 tests/pytests/pkg/integration/onedir_harden_lifecycle/conftest.py
 create mode 100644 tests/pytests/pkg/integration/onedir_harden_lifecycle/test_lifecycle.py

diff --git a/tests/pytests/pkg/integration/onedir_harden_lifecycle/__init__.py b/tests/pytests/pkg/integration/onedir_harden_lifecycle/__init__.py
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/tests/pytests/pkg/integration/onedir_harden_lifecycle/conftest.py b/tests/pytests/pkg/integration/onedir_harden_lifecycle/conftest.py
new file mode 100644
index 000000000000..8896d0629fec
--- /dev/null
+++ b/tests/pytests/pkg/integration/onedir_harden_lifecycle/conftest.py
@@ -0,0 +1,413 @@
+"""
+Destructive-cycle fixtures for the SALT_ONEDIR_HARDEN packaging tests
+(issue #70198).
+
+These tests need a fresh install/uninstall cycle per case so they can
+exercise:
+
+- SALT_ONEDIR_HARDEN=0 opt-out (legacy chown layout + deprecation
+  warning surfaces)
+- explicit SALT_HOME / SALT_EXTRAS_DIR overrides winning over the
+  hardening default
+- upgrade migration from a pre-populated legacy /opt/saltstack/salt/
+  extras-<py>/ tree into per-daemon /var/lib/salt/<daemon>/extras-<py>/
+- upgrade idempotency (re-running postinst is a no-op)
+
+The fixture stack mirrors ``tests/pytests/pkg/integration/config_overrides/``
+which pioneered the pattern: skip the whole subtree during
+--upgrade/--downgrade/--no-install passes (we manage our own install
+lifecycle), spin up a function-scoped SaltPkgInstall, force-purge on
+failure so a bad postinst doesn't cascade into the session-scoped
+install_salt fixture.
+
+Linux-package-only.
+"""
+
+import contextlib
+import logging
+import os
+import pathlib
+import shutil
+import subprocess
+
+import pytest
+from pytestskipmarkers.utils import platform
+
+from tests.support.pkg import SaltPkgInstall
+
+log = logging.getLogger(__name__)
+
+
+# Standard override-file locations. Same as the config_overrides suite.
+DEB_OVERRIDE_FILE = pathlib.Path("/etc/default/salt-setup")
+RPM_OVERRIDE_FILE = pathlib.Path("/etc/sysconfig/salt-minion-setup")
+
+# Custom SALT_HOME / SALT_EXTRAS_DIR paths used to prove explicit
+# overrides win over the SALT_ONEDIR_HARDEN=1 default's per-daemon
+# /var/lib/salt/<daemon>/{home,extras-<py>} paths.
+CUSTOM_HOME = "/opt/custom-salt-home"
+CUSTOM_EXTRAS = "/opt/custom-salt-extras"
+
+# Marker written into /opt/saltstack/salt/extras-<py>/ before an
+# upgrade so the migration test can verify contents moved.
+LEGACY_EXTRAS_MARKER_NAME = ".onedir-harden-migration-marker"
+LEGACY_EXTRAS_MARKER_CONTENT = "pre-upgrade payload"
+
+
+SALT_PACKAGES = [
+    "salt-api",
+    "salt-cloud",
+    "salt-common",
+    "salt-dbg",
+    "salt-debuginfo",
+    "salt-master",
+    "salt-minion",
+    "salt-ssh",
+    "salt-syndic",
+    "salt",
+]
+
+
+def pytest_collection_modifyitems(config, items):
+    """
+    Skip destructive-cycle tests during pkg sessions that expect the
+    session-scoped install_salt fixture to stay stable. Same rationale
+    as config_overrides/conftest.py.
+    """
+    if not (
+        config.getoption("--upgrade")
+        or config.getoption("--downgrade")
+        or config.getoption("--no-install")
+    ):
+        return
+    conftest_dir = pathlib.Path(__file__).resolve().parent
+    skip_marker = pytest.mark.skip(
+        reason=(
+            "onedir-harden lifecycle tests perform destructive install "
+            "cycles; they only run during fresh-install passes."
+        )
+    )
+    for item in items:
+        try:
+            item_path = pathlib.Path(str(item.fspath)).resolve()
+        except (OSError, ValueError):
+            continue
+        if conftest_dir in item_path.parents:
+            item.add_marker(skip_marker)
+
+
+def _purge_salt_packages():
+    """Force-purge every salt package. Idempotent."""
+    if shutil.which("apt-get") is not None:
+        subprocess.run(
+            ["dpkg", "--purge", "--force-all", *SALT_PACKAGES],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        env = os.environ.copy()
+        env["DEBIAN_FRONTEND"] = "noninteractive"
+        subprocess.run(
+            ["apt-get", "purge", "-y", *SALT_PACKAGES],
+            check=False,
+            env=env,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        subprocess.run(
+            ["apt-get", "autoremove", "-y"],
+            check=False,
+            env=env,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+    elif shutil.which("dnf") is not None:
+        subprocess.run(
+            ["dnf", "remove", "-y", *SALT_PACKAGES],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+    elif shutil.which("yum") is not None:
+        subprocess.run(
+            ["yum", "remove", "-y", *SALT_PACKAGES],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+
+
+def _cleanup_filesystem_state():
+    """Wipe override files, custom paths, and per-daemon dirs."""
+    for path in (DEB_OVERRIDE_FILE, RPM_OVERRIDE_FILE):
+        if path.exists():
+            with contextlib.suppress(OSError):
+                path.unlink()
+    _purge_salt_packages()
+    subprocess.run(
+        ["userdel", "-f", "salt"],
+        check=False,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    subprocess.run(
+        ["groupdel", "salt"],
+        check=False,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    # Tear down every per-daemon dir + custom override targets so the
+    # next case starts clean.
+    for target in (
+        CUSTOM_HOME,
+        CUSTOM_EXTRAS,
+        "/var/lib/salt",
+    ):
+        if os.path.isdir(target):
+            shutil.rmtree(target, ignore_errors=True)
+    # Wipe debconf db so a fresh install re-prompts.
+    if shutil.which("debconf-communicate") is not None:
+        for key in (
+            "salt-master/user",
+            "salt-minion/user",
+            "salt-api/user",
+            "salt-syndic/user",
+        ):
+            try:
+                subprocess.run(
+                    ["debconf-communicate"],
+                    input=f"PURGE {key}\n",
+                    text=True,
+                    check=False,
+                    timeout=5,
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL,
+                )
+            except (subprocess.SubprocessError, OSError):
+                pass
+
+
+@pytest.fixture
+def cleanup_harden_state():
+    """Clean-up envelope around a destructive install cycle."""
+    _cleanup_filesystem_state()
+    try:
+        yield
+    finally:
+        _cleanup_filesystem_state()
+
+
+def _install_with(env, request, salt_factories_root_dir):
+    """
+    Shared helper: perform a fresh install with the given install_env,
+    force-purging on any preinst/postinst failure so subsequent tests
+    inherit a clean dpkg/rpm state.
+    """
+    if platform.is_windows():
+        conf_dir = "c:/salt/etc/salt"
+    else:
+        conf_dir = salt_factories_root_dir / "etc" / "salt"
+    installer = SaltPkgInstall(
+        conf_dir=conf_dir,
+        pkg_system_service=request.config.getoption("--pkg-system-service"),
+        upgrade=False,
+        downgrade=False,
+        no_uninstall=False,
+        no_install=False,
+        prev_version=request.config.getoption("prev_version"),
+        use_prev_version=request.config.getoption("use_prev_version"),
+        install_env=env,
+    )
+    try:
+        with contextlib.ExitStack() as stack:
+            try:
+                stack.enter_context(installer)
+            except BaseException:
+                _purge_salt_packages()
+                raise
+            installer.no_uninstall = False
+            yield installer
+    finally:
+        _purge_salt_packages()
+
+
+@pytest.fixture
+def install_harden_off(cleanup_harden_state, request, salt_factories_root_dir):
+    """
+    Fresh install with SALT_ONEDIR_HARDEN=0 in the DEB override file
+    and exported to the RPM package-manager env (RPM scriptlets don't
+    inherit env from yum, so the file channel is what actually reaches
+    the RPM %pre / %posttrans). Verifies the legacy chown path still
+    works and surfaces the deprecation warning.
+    """
+    DEB_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    DEB_OVERRIDE_FILE.write_text("SALT_ONEDIR_HARDEN=0\n", encoding="utf-8")
+    RPM_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    RPM_OVERRIDE_FILE.write_text("SALT_ONEDIR_HARDEN=0\n", encoding="utf-8")
+    yield from _install_with(
+        {"SALT_ONEDIR_HARDEN": "0"}, request, salt_factories_root_dir
+    )
+
+
+@pytest.fixture
+def install_harden_default(cleanup_harden_state, request, salt_factories_root_dir):
+    """
+    Fresh install with SALT_ONEDIR_HARDEN completely unset. Verifies
+    the built-in default (=1 on 3009.0+) is what actually applies. No
+    override file is created and no env var is exported.
+    """
+    yield from _install_with({}, request, salt_factories_root_dir)
+
+
+@pytest.fixture
+def install_harden_custom_home(cleanup_harden_state, request, salt_factories_root_dir):
+    """
+    Fresh install with SALT_ONEDIR_HARDEN=1 (default) AND an explicit
+    SALT_HOME override. Proves the explicit override wins over the
+    hardening default's per-daemon /var/lib/salt/<daemon>/home path.
+    """
+    DEB_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    DEB_OVERRIDE_FILE.write_text(f"SALT_HOME={CUSTOM_HOME}\n", encoding="utf-8")
+    RPM_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    RPM_OVERRIDE_FILE.write_text(f"SALT_HOME={CUSTOM_HOME}\n", encoding="utf-8")
+    yield from _install_with(
+        {"SALT_HOME": CUSTOM_HOME}, request, salt_factories_root_dir
+    )
+
+
+@pytest.fixture
+def install_harden_custom_extras(
+    cleanup_harden_state, request, salt_factories_root_dir
+):
+    """
+    Fresh install with SALT_ONEDIR_HARDEN=1 (default) AND an explicit
+    SALT_EXTRAS_DIR override. Proves the explicit override wins over
+    the hardening default's per-daemon
+    /var/lib/salt/<daemon>/extras-<py> path.
+    """
+    DEB_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    DEB_OVERRIDE_FILE.write_text(f"SALT_EXTRAS_DIR={CUSTOM_EXTRAS}\n", encoding="utf-8")
+    RPM_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    RPM_OVERRIDE_FILE.write_text(f"SALT_EXTRAS_DIR={CUSTOM_EXTRAS}\n", encoding="utf-8")
+    yield from _install_with(
+        {"SALT_EXTRAS_DIR": CUSTOM_EXTRAS}, request, salt_factories_root_dir
+    )
+
+
+def _populate_legacy_extras(py_ver, marker_content=LEGACY_EXTRAS_MARKER_CONTENT):
+    """
+    Pre-populate /opt/saltstack/salt/extras-<py>/ with a marker file so
+    the upgrade-migration test can verify contents moved into the
+    per-daemon location. Called after the first (legacy) install and
+    before the SALT_ONEDIR_HARDEN=1 postinst re-run.
+
+    The extras-<py> directory has to be world-writable-then-chowned
+    before the marker is written because /opt/saltstack/salt is
+    root-owned in hardened installs. We're operating between installs
+    so we own the whole tree.
+    """
+    extras_dir = pathlib.Path(f"/opt/saltstack/salt/extras-{py_ver}")
+    extras_dir.mkdir(parents=True, exist_ok=True)
+    marker = extras_dir / LEGACY_EXTRAS_MARKER_NAME
+    marker.write_text(marker_content, encoding="utf-8")
+    return marker
+
+
+@pytest.fixture
+def install_harden_upgrade_migration(
+    cleanup_harden_state, request, salt_factories_root_dir
+):
+    """
+    Simulate the legacy-to-hardened upgrade path:
+
+    1. Install with SALT_ONEDIR_HARDEN=0 (legacy layout).
+    2. Drop a marker file into /opt/saltstack/salt/extras-<py>/.
+    3. Uninstall + reinstall with SALT_ONEDIR_HARDEN=1.
+    4. Yield the installer so the test can assert the marker moved to
+       /var/lib/salt/<daemon>/extras-<py>/ and the legacy dir was
+       cleaned up.
+
+    Debian's ``apt purge`` and RPM's ``yum remove`` both delete
+    /opt/saltstack/salt on uninstall, so between steps 1 and 3 we
+    manually preserve the extras dir + marker via a tmp copy and
+    replay it back before the hardened install runs its posttrans /
+    postinst migration.
+    """
+    if platform.is_windows():
+        conf_dir = "c:/salt/etc/salt"
+    else:
+        conf_dir = salt_factories_root_dir / "etc" / "salt"
+
+    # Step 1: legacy install.
+    DEB_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    DEB_OVERRIDE_FILE.write_text("SALT_ONEDIR_HARDEN=0\n", encoding="utf-8")
+    RPM_OVERRIDE_FILE.parent.mkdir(parents=True, exist_ok=True)
+    RPM_OVERRIDE_FILE.write_text("SALT_ONEDIR_HARDEN=0\n", encoding="utf-8")
+    legacy_installer = SaltPkgInstall(
+        conf_dir=conf_dir,
+        pkg_system_service=request.config.getoption("--pkg-system-service"),
+        upgrade=False,
+        downgrade=False,
+        no_uninstall=True,
+        no_install=False,
+        prev_version=request.config.getoption("prev_version"),
+        use_prev_version=request.config.getoption("use_prev_version"),
+        install_env={"SALT_ONEDIR_HARDEN": "0"},
+    )
+    try:
+        with legacy_installer:
+            py_ver = legacy_installer.package_python_version()
+            # Step 2: populate the legacy extras dir with a marker.
+            marker = _populate_legacy_extras(py_ver)
+            assert marker.exists()
+            # Preserve the marker across the uninstall (apt purge wipes
+            # /opt/saltstack/salt). Copy it to a scratch location.
+            scratch = pathlib.Path("/root/.onedir-harden-migration-scratch")
+            scratch.mkdir(exist_ok=True)
+            preserved = scratch / f"extras-{py_ver}"
+            preserved.mkdir(exist_ok=True)
+            shutil.copy2(marker, preserved / LEGACY_EXTRAS_MARKER_NAME)
+    except BaseException:
+        _purge_salt_packages()
+        raise
+
+    # Step 3: uninstall, then reinstall with hardening on. Legacy
+    # extras tree gets re-created between installs via the preserved
+    # copy so the hardened postinst has something to migrate.
+    _purge_salt_packages()
+    for path in (DEB_OVERRIDE_FILE, RPM_OVERRIDE_FILE):
+        with contextlib.suppress(OSError):
+            path.unlink()
+
+    # Recreate the legacy extras dir so the hardened install's
+    # migration block finds work to do.
+    extras_dir = pathlib.Path(f"/opt/saltstack/salt/extras-{py_ver}")
+    extras_dir.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(
+        preserved / LEGACY_EXTRAS_MARKER_NAME,
+        extras_dir / LEGACY_EXTRAS_MARKER_NAME,
+    )
+
+    hardened_installer = SaltPkgInstall(
+        conf_dir=conf_dir,
+        pkg_system_service=request.config.getoption("--pkg-system-service"),
+        upgrade=False,
+        downgrade=False,
+        no_uninstall=False,
+        no_install=False,
+        prev_version=request.config.getoption("prev_version"),
+        use_prev_version=request.config.getoption("use_prev_version"),
+        install_env={},  # HARDEN unset -> default is 1
+    )
+    try:
+        with contextlib.ExitStack() as stack:
+            try:
+                stack.enter_context(hardened_installer)
+            except BaseException:
+                _purge_salt_packages()
+                raise
+            hardened_installer.no_uninstall = False
+            yield hardened_installer, py_ver
+    finally:
+        shutil.rmtree(scratch, ignore_errors=True)
+        _purge_salt_packages()
diff --git a/tests/pytests/pkg/integration/onedir_harden_lifecycle/test_lifecycle.py b/tests/pytests/pkg/integration/onedir_harden_lifecycle/test_lifecycle.py
new file mode 100644
index 000000000000..4340175269e1
--- /dev/null
+++ b/tests/pytests/pkg/integration/onedir_harden_lifecycle/test_lifecycle.py
@@ -0,0 +1,340 @@
+"""
+Destructive-cycle package tests for the SALT_ONEDIR_HARDEN packaging
+default (issue #70198).
+
+These tests perform real install/uninstall lifecycles so they can
+exercise the packaging behavior that a static fixture install can't:
+
+- SALT_ONEDIR_HARDEN=0 escape hatch (legacy chown layout, deprecation
+  warning surfaces)
+- explicit SALT_HOME / SALT_EXTRAS_DIR overrides winning over the
+  hardening default
+- upgrade migration from a pre-populated legacy
+  /opt/saltstack/salt/extras-<py>/ tree into
+  /var/lib/salt/<daemon>/extras-<py>/
+- upgrade idempotency (second postinst run is a no-op)
+
+The fixtures live in ``conftest.py`` and mirror the destructive-cycle
+pattern established by ``tests/pytests/pkg/integration/config_overrides/``.
+
+Linux-package-only.
+"""
+
+import logging
+import os
+import pathlib
+import subprocess
+
+import pytest
+
+from tests.pytests.pkg.integration.onedir_harden_lifecycle.conftest import (
+    CUSTOM_EXTRAS,
+    CUSTOM_HOME,
+    LEGACY_EXTRAS_MARKER_CONTENT,
+    LEGACY_EXTRAS_MARKER_NAME,
+)
+
+log = logging.getLogger(__name__)
+
+pytestmark = [
+    pytest.mark.skip_unless_on_linux(reason="Linux DEB/RPM packaging only"),
+    pytest.mark.destructive_test,
+]
+
+
+DAEMONS = ("minion", "master", "syndic", "api", "cloud")
+
+
+# ---------------------------------------------------------------------------
+# Priority 1 -- SALT_ONEDIR_HARDEN=0 escape hatch
+# ---------------------------------------------------------------------------
+
+
+def test_harden_off_uses_legacy_chown_layout(install_harden_off):
+    """
+    With SALT_ONEDIR_HARDEN=0, /opt/saltstack/salt is chowned to the
+    salt user (legacy behavior). Under the hardened default this dir
+    would stay root:root; here we verify the opt-out actually reaches
+    the packaging scriptlets.
+    """
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.exists()
+    assert tree.owner() == "salt", (
+        f"Under SALT_ONEDIR_HARDEN=0, /opt/saltstack/salt should be "
+        f"salt-owned (legacy layout); got {tree.owner()!r}"
+    )
+
+
+def test_harden_off_deprecation_warning_surfaces(install_harden_off):
+    """
+    The postinst scriptlets emit a ``logger -t salt-<daemon>`` message
+    when SALT_ONEDIR_HARDEN=0 is selected. Verify at least one such
+    entry landed in the system log so operators actually see the
+    deprecation notice.
+
+    We check both the systemd journal (RPM + modern DEB) and
+    /var/log/syslog / /var/log/messages (older DEB + non-systemd RPM)
+    so this passes across the distro matrix.
+    """
+    needle = "SALT_ONEDIR_HARDEN=0"
+    found = False
+
+    # Try journalctl first (present on any systemd system).
+    try:
+        proc = subprocess.run(
+            [
+                "journalctl",
+                "--no-pager",
+                "-t",
+                "salt-minion",
+                "-t",
+                "salt-master",
+                "-t",
+                "salt-syndic",
+                "-t",
+                "salt-api",
+                "-t",
+                "salt-cloud",
+                "--since",
+                "10 minutes ago",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+        if needle in proc.stdout:
+            found = True
+    except (FileNotFoundError, subprocess.SubprocessError):
+        pass
+
+    # Fall back to /var/log/{syslog,messages} for systemd-less hosts.
+    if not found:
+        for log_path in ("/var/log/syslog", "/var/log/messages"):
+            path = pathlib.Path(log_path)
+            if not path.exists() or not os.access(path, os.R_OK):
+                continue
+            try:
+                content = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            if needle in content:
+                found = True
+                break
+
+    assert found, (
+        "Expected a SALT_ONEDIR_HARDEN=0 deprecation notice from at "
+        "least one salt-<daemon> postinst in journalctl / syslog / "
+        "messages, but none was recorded."
+    )
+
+
+def test_harden_off_leaves_per_daemon_dirs_absent(install_harden_off):
+    """
+    Under the legacy layout, /var/lib/salt/<daemon>/ should NOT be
+    created by any daemon's postinst -- that's the whole point of
+    ``SALT_ONEDIR_HARDEN=0`` preserving the historical layout.
+
+    /var/lib/salt itself is packaged via salt-common.dirs so its
+    existence is not a signal; we assert on the per-daemon subdirs.
+    """
+    for daemon in DAEMONS:
+        subdir = pathlib.Path(f"/var/lib/salt/{daemon}")
+        assert not subdir.exists(), (
+            f"Under SALT_ONEDIR_HARDEN=0 the per-daemon dir "
+            f"/var/lib/salt/{daemon} should not exist, but it does"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Priority 1 -- SALT_ONEDIR_HARDEN unset behaves as =1 on 3009.0+
+# ---------------------------------------------------------------------------
+
+
+def test_harden_default_produces_hardened_layout(install_harden_default):
+    """
+    With SALT_ONEDIR_HARDEN completely unset (no env var, no override
+    file), the packaging default on 3009.0 must produce the hardened
+    layout. This is the "unset == 1" gate assertion.
+    """
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.exists()
+    assert (
+        tree.owner() == "root"
+    ), f"With HARDEN unset, /opt/saltstack/salt should be root; got {tree.owner()!r}"
+
+    master_dir = pathlib.Path("/var/lib/salt/master")
+    assert master_dir.exists(), (
+        "With HARDEN unset, /var/lib/salt/master should exist " "(default=1 on 3009.0)"
+    )
+    assert master_dir.owner() == "salt"
+
+
+# ---------------------------------------------------------------------------
+# Priority 4 -- explicit SALT_HOME / SALT_EXTRAS_DIR override precedence
+# ---------------------------------------------------------------------------
+
+
+def test_explicit_salt_home_wins_over_harden_default(install_harden_custom_home):
+    """
+    Explicit SALT_HOME in /etc/default/salt-setup wins over the
+    HARDEN=1 default's per-daemon /var/lib/salt/<daemon>/home path.
+    The custom SALT_HOME must exist and be owned by the salt user;
+    /opt/saltstack/salt must still be root:root (hardening still on).
+    """
+    custom = pathlib.Path(CUSTOM_HOME)
+    assert custom.exists(), (
+        f"Explicit SALT_HOME={CUSTOM_HOME} should have been created "
+        "by salt-common preinst"
+    )
+    assert custom.owner() == "salt"
+
+    # /opt/saltstack/salt still root-owned because HARDEN=1 still
+    # in effect (explicit SALT_HOME doesn't turn off hardening).
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.owner() == "root"
+
+
+def test_explicit_salt_extras_dir_wins_over_harden_default(
+    install_harden_custom_extras,
+):
+    """
+    Explicit SALT_EXTRAS_DIR wins over the HARDEN=1 default's
+    per-daemon /var/lib/salt/<daemon>/extras-<py> path. The custom
+    dir must exist and be owned by the salt user.
+    """
+    custom = pathlib.Path(CUSTOM_EXTRAS)
+    assert custom.exists(), (
+        f"Explicit SALT_EXTRAS_DIR={CUSTOM_EXTRAS} should have been "
+        "created by a daemon postinst"
+    )
+    assert custom.owner() == "salt"
+
+    # /opt/saltstack/salt still root-owned.
+    tree = pathlib.Path("/opt/saltstack/salt")
+    assert tree.owner() == "root"
+
+
+# ---------------------------------------------------------------------------
+# Priority 3 -- upgrade migration + idempotency
+# ---------------------------------------------------------------------------
+
+
+def test_upgrade_migration_moves_legacy_extras(install_harden_upgrade_migration):
+    """
+    Simulated legacy-to-hardened upgrade path:
+
+    - Install with SALT_ONEDIR_HARDEN=0 first (legacy chown; extras
+      at /opt/saltstack/salt/extras-<py>/).
+    - Drop a marker file into the legacy extras dir.
+    - Reinstall with SALT_ONEDIR_HARDEN=1.
+    - Assert the marker migrated into
+      /var/lib/salt/<daemon>/extras-<py>/, the legacy dir was
+      removed, and the new per-daemon extras dir is salt-owned.
+
+    The migration is per-daemon; any single daemon's postinst that
+    finds populated legacy extras AND an empty per-daemon extras will
+    do the move. At least one daemon-side move must have happened for
+    this test to pass.
+    """
+    installer, py_ver = install_harden_upgrade_migration
+
+    # Marker should NOT be at the legacy location any more.
+    legacy_marker = pathlib.Path(
+        f"/opt/saltstack/salt/extras-{py_ver}/{LEGACY_EXTRAS_MARKER_NAME}"
+    )
+    assert not legacy_marker.exists(), (
+        f"Legacy marker at {legacy_marker} should have been migrated "
+        "away by the hardened postinst"
+    )
+
+    # It should be at one of the per-daemon extras dirs.
+    per_daemon_locations = [
+        pathlib.Path(f"/var/lib/salt/{d}/extras-{py_ver}/{LEGACY_EXTRAS_MARKER_NAME}")
+        for d in DAEMONS
+    ]
+    migrated = [p for p in per_daemon_locations if p.exists()]
+    assert migrated, (
+        f"Expected {LEGACY_EXTRAS_MARKER_NAME} to be migrated into at "
+        f"least one /var/lib/salt/<daemon>/extras-{py_ver}/ location; "
+        f"none found. Checked: {[str(p) for p in per_daemon_locations]}"
+    )
+
+    # Marker content preserved verbatim.
+    for marker_path in migrated:
+        assert (
+            marker_path.read_text(encoding="utf-8") == LEGACY_EXTRAS_MARKER_CONTENT
+        ), f"Migrated marker at {marker_path} has wrong content"
+        # And owned by the salt user, not root.
+        assert marker_path.parent.owner() == "salt", (
+            f"Migrated extras dir {marker_path.parent} should be "
+            f"salt-owned; got {marker_path.parent.owner()!r}"
+        )
+
+
+def test_upgrade_migration_is_idempotent(install_harden_upgrade_migration):
+    """
+    Re-running the migration path is a no-op: the second time through,
+    the legacy extras dir is either gone or empty, so nothing moves
+    and nothing errors. We invoke the postinst-equivalent behavior by
+    calling ``dpkg-reconfigure`` / ``rpm -q --scripts`` re-run and
+    verifying idempotency at the filesystem level.
+
+    Simpler and more robust approach: assert that after the first
+    migration (which the fixture already performed), the per-daemon
+    location still contains the marker AND the legacy dir does not
+    contain a stale copy. If the migration ran twice we'd see the
+    marker in the legacy dir get re-created + re-moved with mv
+    complaining about existing dest.
+    """
+    installer, py_ver = install_harden_upgrade_migration
+
+    # First migration ran in the fixture. Now simulate a second
+    # postinst pass by triggering apt reinstall / yum reinstall on
+    # the daemon whose extras dir received the marker.
+    per_daemon_locations = [
+        pathlib.Path(f"/var/lib/salt/{d}/extras-{py_ver}/{LEGACY_EXTRAS_MARKER_NAME}")
+        for d in DAEMONS
+    ]
+    original_migrated = [p for p in per_daemon_locations if p.exists()]
+    assert original_migrated, (
+        "Migration fixture didn't produce a migrated marker; the "
+        "upstream test_upgrade_migration_moves_legacy_extras case "
+        "should fail first."
+    )
+
+    # Force a re-run of the postinst equivalent by reconfiguring or
+    # reinstalling salt-common.
+    if pathlib.Path("/usr/bin/apt-get").exists():
+        env = os.environ.copy()
+        env["DEBIAN_FRONTEND"] = "noninteractive"
+        subprocess.run(
+            ["dpkg-reconfigure", "salt-common", "salt-master"],
+            check=False,
+            env=env,
+            capture_output=True,
+            timeout=180,
+        )
+    elif pathlib.Path("/usr/bin/dnf").exists():
+        subprocess.run(
+            ["dnf", "reinstall", "-y", "salt-master"],
+            check=False,
+            capture_output=True,
+            timeout=180,
+        )
+
+    # Marker still at migrated location.
+    still_migrated = [p for p in per_daemon_locations if p.exists()]
+    assert still_migrated == original_migrated, (
+        f"Idempotency broken: marker set changed from "
+        f"{[str(p) for p in original_migrated]} to "
+        f"{[str(p) for p in still_migrated]} after re-run"
+    )
+
+    # And the legacy dir did not get resurrected with a stale marker.
+    legacy_marker = pathlib.Path(
+        f"/opt/saltstack/salt/extras-{py_ver}/{LEGACY_EXTRAS_MARKER_NAME}"
+    )
+    assert not legacy_marker.exists(), (
+        f"Legacy marker at {legacy_marker} reappeared after " "idempotent re-run"
+    )