Add proper SUID fallback for DEB plugin packages. (#15803)
* Add proper SUID fallback for DEB plugin packages. * Update contrib/debian/netdata-plugin-perf.postinst --------- Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Austin S. Hemmelgarn committed
Aug 14, 2023 at 10:15 UTC
0aedcbef6be5deb561b5e6d5292e40b33dd01f87
6 files changed
+28
-5
contrib/debian/netdata-plugin-apps.postinst
+4
-1
@@ -5,7 +5,10 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/apps.plugin
8
- setcap "cap_dac_read_search=eip cap_sys_ptrace=eip" /usr/libexec/netdata/plugins.d/apps.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/apps.plugin
9
+ if ! setcap "cap_dac_read_search=eip cap_sys_ptrace=eip" /usr/libexec/netdata/plugins.d/apps.plugin; then
10
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/apps.plugin
11
+ fi
12
;;
13
esac
14
contrib/debian/netdata-plugin-debugfs.postinst
+4
-1
@@ -5,7 +5,10 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/debugfs.plugin
8
- setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/debugfs.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/debugfs.plugin
9
+ if ! setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/debugfs.plugin; then
10
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/debugfs.plugin
11
+ fi
12
;;
13
esac
14
contrib/debian/netdata-plugin-go.postinst
+4
-1
@@ -5,7 +5,10 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/go.d.plugin
8
- setcap "cap_net_admin=eip cap_net_raw=eip" /usr/libexec/netdata/plugins.d/go.d.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/go.d.plugin
9
+ if ! setcap "cap_net_admin=eip cap_net_raw=eip" /usr/libexec/netdata/plugins.d/go.d.plugin; then
10
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/go.d.plugin
11
+ fi
12
;;
13
esac
14
contrib/debian/netdata-plugin-perf.postinst
+8
@@ -5,10 +5,18 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/perf.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/perf.plugin
9
+
10
if capsh --supports=cap_perfmon 2>/dev/null; then
11
setcap cap_perfmon+ep /usr/libexec/netdata/plugins.d/perf.plugin
12
+ ret="$?"
13
else
14
setcap cap_sys_admin+ep /usr/libexec/netdata/plugins.d/perf.plugin
15
+ ret="$?"
16
+ fi
17
+
18
+ if [ "${ret}" -ne 0 ]; then
19
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/perf.plugin
20
fi
21
;;
22
esac
contrib/debian/netdata-plugin-slabinfo.postinst
+4
-1
@@ -5,7 +5,10 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/slabinfo.plugin
8
- setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/slabinfo.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/slabinfo.plugin
9
+ if ! setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/slabinfo.plugin; then
10
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/slabinfo.plugin
11
+ fi
12
;;
13
esac
14
contrib/debian/netdata-plugin-systemd-journal.postinst
+4
-1
@@ -5,7 +5,10 @@ set -e
5
case "$1" in
6
configure|reconfigure)
7
chown root:netdata /usr/libexec/netdata/plugins.d/systemd-journal.plugin
8
- setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/systemd-journal.plugin
8
+ chmod 0750 /usr/libexec/netdata/plugins.d/systemd-journal.plugin
9
+ if ! setcap "cap_dac_read_search=eip" /usr/libexec/netdata/plugins.d/systemd-journal.plugin; then
10
+ chmod -f 4750 /usr/libexec/netdata/plugins.d/systemd-journal.plugin
11
+ fi
12
;;
13
esac
14