File /etc/updatedb.conf default mode is 0644. But you define it 0444. So the system will redefint as 0644. Then puppet reconfig this file as 0444.