fix: use setuid as a fallback for static builds when setcap fails for plugins (#19215)
fix: use setuid as a fallback if setcap fails for plugins
Ilya Mashchenko committed
Dec 15, 2024 at 21:36 UTC
3d1eb723590297b5107ff3ef3ab2a7e3777efdf1
1 file changed
+19
-9
packaging/makeself/install-or-update.sh
+19
-9
@@ -207,17 +207,27 @@ for x in ndsudo apps.plugin perf.plugin slabinfo.plugin debugfs.plugin freeipmi.
207
done
208
209
if command -v setcap >/dev/null 2>&1; then
210
- run setcap "cap_dac_read_search,cap_sys_ptrace=ep" "usr/libexec/netdata/plugins.d/apps.plugin"
211
- run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/slabinfo.plugin"
212
- run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/debugfs.plugin"
210
+ if ! run setcap "cap_dac_read_search,cap_sys_ptrace=ep" "usr/libexec/netdata/plugins.d/apps.plugin"; then
211
+ run chmod 4750 "usr/libexec/netdata/plugins.d/apps.plugin"
212
+ fi
213
+ if ! run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/slabinfo.plugin"; then
214
+ run chmod 4750 "usr/libexec/netdata/plugins.d/slabinfo.plugin"
215
+ fi
216
+ if ! run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/debugfs.plugin"; then
217
+ run chmod 4750 "usr/libexec/netdata/plugins.d/debugfs.plugin"
218
+ fi
219
+ if ! run setcap "cap_dac_read_search+epi cap_net_admin+epi cap_net_raw=eip" "usr/libexec/netdata/plugins.d/go.d.plugin"; then
220
+ run chmod 4750 "usr/libexec/netdata/plugins.d/go.d.plugin"
221
+ fi
222
214
- if command -v capsh >/dev/null 2>&1 && capsh --supports=cap_perfmon 2>/dev/null ; then
215
- run setcap "cap_perfmon=ep" "usr/libexec/netdata/plugins.d/perf.plugin"
216
- else
217
- run setcap "cap_sys_admin=ep" "usr/libexec/netdata/plugins.d/perf.plugin"
218
- fi
223
+ perf_caps="cap_sys_admin=ep"
224
+ if command -v capsh >/dev/null 2>&1 && capsh --supports=cap_perfmon 2>/dev/null; then
225
+ perf_caps="cap_perfmon=ep"
226
+ fi
227
220
- run setcap "cap_dac_read_search+epi cap_net_admin+epi cap_net_raw=eip" "usr/libexec/netdata/plugins.d/go.d.plugin"
228
+ if ! run setcap "${perf_caps}" "usr/libexec/netdata/plugins.d/perf.plugin"; then
229
+ run chmod 4750 "usr/libexec/netdata/plugins.d/perf.plugin"
230
+ fi
231
else
232
for x in apps.plugin perf.plugin slabinfo.plugin debugfs.plugin; do
233
f="usr/libexec/netdata/plugins.d/${x}"