@cryptotaxi247 / netdata-1 / commits / 3f1133942

Update our user/group account handling to use sysusers.d when possible. (#21162)

* Add systemd-sysusers config. This allows for better integration with modern systemd systems, as well as enabling more consistent user creation behavior on systems that support it. All systemd-based platforms we currently support support sysusers based configuration of user accounts. * Convert RPM specfile to use sysusers for Netdata user creation. This also splits the user account handling to a dedicated package, which both simplifies the dependency tree, and also eliminates most of our preinstall hooks (almost all of them were just creating the accounts if they didn’t exist). On RPM 4.19 and newer, simply packaging the sysusers file results in the resultant RPM auto-generating the user information without any need for us to supply an install script to generate the accounts. On older RPM versions, we still ship and install the file, but we also include a postinstall script that then uses it to create the users (or falls back to useradd/groupadd). Use of the RPM integration is keyed off of the presence of the `add_sysuser` macro that RPM versions with this support provide, instead of keying off of specific distros and releases, which should avoid the need for us to update this as new releases of distros we support come out that use a new enough RPM version. * Update DEB packages to use sysusers for account creation. Like with the RPMs, this splits the user account handling to it’s own package, which simplifies both our set of maintainer scripts and our overall dependency tree. Unlike RPM, dpkg does not currently have support for automatic user account handling (though there is a draft proposal in the works to add this), so we need to always have appropriate maintainer scripts to create the users. * Switch static builds and local builds to use sysusers when available. Also, centralize the user account handling code between the local and static builds. The updated code will directly install the sysusers.d file if the system appears to support sysusers.d user generation, and will then use systemd-sysusers for account creation. In the event that this is not supported, it falls back to the old behavior. * Trim list of supplementary groups for new installs. Almost all of the supplementary groups we currently add the Netdata user to were used by the older log-based collectors written in Python. On modern installs where data collection is done by the Go plugin out of the box, we don’t need these group memberships due to the use of file capabilities, so we shouldn’t be adding the Netdata user to them. * Fix left-over conditionals in RPM spec file. * Fix RPM user account handling, again. * Also handle OL8. * Remove DEB dashboard postinst/postrm hooks. They haven’t actually been included in the package since we switched to using a separate package, and nothing broke, so we obviously don’t actually need them. What they were doing was questionable anyway (dpkg-statoverride is supposed to be for the administrator to adjust things, not for individual packages to fix their supposedly broken permissions). * Drop duplicate conditional in RPM spec file. * Explicitly handle NETDATA_ADDED_TO_GROUPS being unset. * Drop `nobody` group from sysusers config. * Further fixes for RPMs. * Fix deps for legacy RPM distros. * Clean up conditional in RPM spec file. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Revert unintentionally included change. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Austin S. Hemmelgarn committed Nov 11, 2025 at 08:45 UTC 3f1133942468730c3a5a151fc5076fe131c80e82
32 files changed +243 -503
CMakeLists.txt
+9
@@ -3474,12 +3474,21 @@ install(FILES
3474 COMPONENT netdata
3475 DESTINATION usr/lib/netdata/system/systemd)
3476
3477 +configure_file(system/systemd/sysusers.conf.in system/systemd/sysusers/netdata.conf @ONLY)
3478 +install(FILES
3479 + ${CMAKE_BINARY_DIR}/system/systemd/sysusers/netdata.conf
3480 + COMPONENT netdata
3481 + DESTINATION usr/lib/netdata/system/systemd/sysusers)
3482
3483 if(BUILD_FOR_PACKAGING)
3484 install(FILES
3485 ${CMAKE_BINARY_DIR}/system/systemd/netdata.service
3486 COMPONENT netdata
3487 DESTINATION lib/systemd/system)
3488 + install(FILES
3489 + ${CMAKE_BINARY_DIR}/system/systemd/sysusers/netdata.conf
3490 + COMPONENT user
3491 + DESTINATION usr/lib/sysusers.d)
3492 install(DIRECTORY
3493 COMPONENT netdata
3494 DESTINATION usr/lib/systemd/journald@netdata.conf.d)
netdata-installer.sh
+1 -17
@@ -680,25 +680,9 @@ fi
680 # -----------------------------------------------------------------------------
681 progress "Creating standard user and groups for netdata"
682
683 -NETDATA_WANTED_GROUPS="docker nginx varnish haproxy adm nsd proxy squid ceph nobody"
683 NETDATA_ADDED_TO_GROUPS=""
684 if [ "$(id -u)" -eq 0 ]; then
686 - progress "Adding group 'netdata'"
687 - portable_add_group netdata || :
688 -
689 - progress "Adding user 'netdata'"
690 - portable_add_user netdata "${NETDATA_PREFIX}/var/lib/netdata" || :
691 -
692 - progress "Assign user 'netdata' to required groups"
693 - for g in ${NETDATA_WANTED_GROUPS}; do
694 - # shellcheck disable=SC2086
695 - portable_add_user_to_group ${g} netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} ${g}"
696 - done
697 - # Netdata must be able to read /etc/pve/qemu-server/* and /etc/pve/lxc/*
698 - # for reading VMs/containers names, CPU and memory limits on Proxmox.
699 - if [ -d "/etc/pve" ]; then
700 - portable_add_user_to_group "www-data" netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} www-data"
701 - fi
685 + create_netdata_accounts
686 else
687 run_failed "The installer does not run as root. Nothing to do for user and groups"
688 fi
netdata.spec.in
+137 -144
@@ -40,6 +40,22 @@ AutoReqProv: yes
40 %global __cmake_builddir %{__builddir}
41 %endif
42
43 +# Determine requirements for account handling.
44 +# openSUSE and RHEL/OEL 8 need Provides for user/group accounts explicitly
45 +# spelled out, other platforms do not.
46 +%if 0%{?suse_version}
47 +%global _have_sysuser 1
48 +%global _need_explicit_user_provides 1
49 +%else
50 +%if 0%{?centos_ver} >= 10 || 0%{?oraclelinux} >= 10 || 0%{?fedora} >= 43
51 +%global _have_sysuser 1
52 +%global _need_explicit_user_provides 0
53 +%else
54 +%global _have_sysuser 0
55 +%global _need_explicit_user_provides 0
56 +%endif
57 +%endif
58 +
59 # Disable eBPF for architectures other than x86
60 %ifarch x86_64 i386
61 %global _have_ebpf 1
@@ -56,9 +72,8 @@ AutoReqProv: yes
72 %define _libexecdir /usr/libexec
73 %define _libdir /usr/lib
74
59 -%{!?_systemd_util_dir:%global _systemd_util_dir /usr/lib/systemd}
60 -
61 -# Fedora doesn’t define this, but other distros do
75 +%{!?_sysusersdir:%global _sysusersdir %{_libdir}/sysusers.d}
76 +%{!?_systemd_util_dir:%global _systemd_util_dir %{_libdir}/systemd}
77 %{!?_presetdir:%global _presetdir %{_libdir}/systemd/system-preset}
78
79 # Redefine centos_ver to standardize on a single macro
@@ -215,15 +230,6 @@ BuildRequires: systemd-rpm-macros
230 BuildRequires: systemd
231 %endif
232
218 -# Core requirements for the install to succeed
219 -Requires(pre): /usr/sbin/groupadd
220 -Requires(pre): /usr/sbin/useradd
221 -
222 -%if 0%{?suse_version} || 0%{?fedora}
223 -Provides: user(netdata)
224 -Provides: group(netdata)
225 -%endif
226 -
233 # #####################################################################
234 # External plugin package dependencies
235 # #####################################################################
@@ -231,6 +237,9 @@ Provides: group(netdata)
237 # to support weak dependencies. Explicitly requiring our default plugins
238 # makes it impossible to properly test the packages prior to upload,
239 # so we just skip depending on them on CentOS 7.
240 +%if ! %{_have_sysuser}
241 +Requires(pre): %{name}-user >= %{version}
242 +%endif
243 Requires: %{name}-dashboard
244 %if 0%{?_have_ebpf}
245 Requires: %{name}-plugin-ebpf = %{version}
@@ -513,23 +522,8 @@ install -m 755 -d "${RPM_BUILD_ROOT}%{_presetdir}"
522 install -m 644 -p "system/systemd/50-%{name}.preset" "${RPM_BUILD_ROOT}%{_presetdir}/50-%{name}.preset"
523 install -m 755 -d "${RPM_BUILD_ROOT}%{_systemd_util_dir}/journald@%{name}.conf.d"
524 install -m 644 -p "system/systemd/journald@%{name}.conf" "${RPM_BUILD_ROOT}%{_systemd_util_dir}/journald@%{name}.conf.d/%{name}.conf"
516 -
517 -%pre
518 -
519 -if ! getent group %{name} > /dev/null; then
520 - groupadd --system %{name}
521 -fi
522 -
523 -if ! getent passwd %{name} > /dev/null; then
524 - useradd --system -g %{name} --home %{contentdir} --no-create-home -s /sbin/nologin -c "Netdata pseudo user" %{name}
525 -fi
526 -
527 -# I am not sure that the corresponding group names are exactly the same as in Debian, but we should start somewhere, shouldn't we?
528 -for item in docker nginx varnish haproxy adm nsd proxy squid ceph nobody I2C; do
529 - if getent group $item > /dev/null 2>&1; then
530 - usermod -a -G ${item} %{name}
531 - fi
532 -done
525 +install -m 755 -d "${RPM_BUILD_ROOT}%{_sysusersdir}"
526 +install -m 644 -p "%{__cmake_builddir}/system/systemd/sysusers/%{name}.conf" "${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf"
527
528 %post
529 %if 0%{?suse_version}
@@ -705,6 +699,8 @@ rm -rf "${RPM_BUILD_ROOT}"
699 # Network viewer belongs to a different sub-package
700 %exclude %{_libexecdir}/%{name}/plugins.d/network-viewer.plugin
701
702 +%exclude %{_sysusersdir}/%{name}.conf
703 +
704 # CUPS belongs to a different sub package
705 %if %{_have_cups}
706 %exclude %{_libexecdir}/%{name}/plugins.d/cups.plugin
@@ -713,16 +709,13 @@ rm -rf "${RPM_BUILD_ROOT}"
709 Summary: The CUPS metrics collection plugin for the Netdata Agent
710 Group: Applications/System
711 Requires: %{name} = %{version}
712 +%if ! %{_have_sysuser}
713 +Requires(pre): %{name}-user >= %{version}
714 +%endif
715
716 %description plugin-cups
717 This plugin allows the Netdata Agent to collect metrics from the Common UNIX Printing System.
718
720 -%pre plugin-cups
721 -
722 -if ! getent group %{name} > /dev/null; then
723 - groupadd --system %{name}
724 -fi
725 -
719 %files plugin-cups
720 %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cups.plugin
721 %endif
@@ -733,16 +726,13 @@ Summary: The FreeIPMI metrics collection plugin for the Netdata Agent
726 Group: Applications/System
727 Requires: freeipmi
728 Requires: %{name} = %{version}
729 +%if ! %{_have_sysuser}
730 +Requires(pre): %{name}-user >= %{version}
731 +%endif
732
733 %description plugin-freeipmi
734 This plugin allows the Netdata Agent to collect metrics from hardware using FreeIPMI.
735
740 -%pre plugin-freeipmi
741 -
742 -if ! getent group %{name} > /dev/null; then
743 - groupadd --system %{name}
744 -fi
745 -
736 %files plugin-freeipmi
737 %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
738 %endif
@@ -753,16 +743,13 @@ Summary: The NFACCT metrics collection plugin for the Netdata Agent
743 Group: Applications/System
744 Requires: %{name} = %{version}
745 Conflicts: %{name} < %{version}
746 +%if ! %{_have_sysuser}
747 +Requires(pre): %{name}-user >= %{version}
748 +%endif
749
750 %description plugin-nfacct
751 This plugin allows the Netdata Agent to collect metrics from the firewall using NFACCT objects.
752
760 -%pre plugin-nfacct
761 -
762 -if ! getent group %{name} > /dev/null; then
763 - groupadd --system %{name}
764 -fi
765 -
753 %files plugin-nfacct
754 %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/nfacct.plugin
755 %endif
@@ -778,17 +765,14 @@ Suggests: apcupsd
765 Suggests: iw
766 Suggests: sudo
767 %endif
768 +%if ! %{_have_sysuser}
769 +Requires(pre): %{name}-user >= %{version}
770 +%endif
771
772 %description plugin-chartsd
773 This plugin adds a selection of additional collectors written in shell script to the Netdata Agent.
774 It includes collectors for APCUPSD, LibreSWAN, OpenSIPS, and Wireless access point statistics.
775
786 -%pre plugin-chartsd
787 -
788 -if ! getent group %{name} > /dev/null; then
789 - groupadd --system %{name}
790 -fi
791 -
776 %files plugin-chartsd
777 %defattr(0750,root,netdata,0750)
778 %{_libexecdir}/%{name}/plugins.d/charts.d.plugin
@@ -811,16 +795,13 @@ Recommends: %{name}-ebpf-legacy-code >= %{version}
795 Requires: %{name}-plugin-apps = %{version}
796 Requires: %{name}-ebpf-legacy-code >= %{version}
797 %endif
798 +%if ! %{_have_sysuser}
799 +Requires(pre): %{name}-user >= %{version}
800 +%endif
801
802 %description plugin-ebpf
803 This plugin allows the Netdata Agent to use eBPF code to collect more detailed kernel-level metrics for the system.
804
818 -%pre plugin-ebpf
819 -
820 -if ! getent group %{name} > /dev/null; then
821 - groupadd --system %{name}
822 -fi
823 -
805 %files plugin-ebpf
806 %defattr(4750,root,netdata,4750)
807 %{_libexecdir}/%{name}/plugins.d/ebpf.plugin
@@ -833,17 +814,14 @@ Summary: Compiled eBPF legacy code for the Netdata eBPF plugin
814 Group: Applications/System
815 Requires: %{name}-plugin-ebpf = %{version}
816 Conflicts: %{name} < %{version}
817 +%if ! %{_have_sysuser}
818 +Requires(pre): %{name}-user >= %{version}
819 +%endif
820
821 %description ebpf-legacy-code
822 This package provides the pre-compiled eBPF legacy code for use by the Netdata eBPF plugin.
823 This code is only needed when using the eBPF plugin with kernel versions before 5.10.
824
841 -%pre ebpf-legacy-code
842 -
843 -if ! getent group %{name} > /dev/null; then
844 - groupadd --system %{name}
845 -fi
846 -
825 %files ebpf-legacy-code
826 %defattr(0640,root,netdata,0640)
827 %{_libexecdir}/%{name}/plugins.d/ebpf.d/*.o
@@ -863,18 +841,15 @@ Requires: python3
841 %if 0%{?centos_ver} != 7
842 Suggests: sudo
843 %endif
844 +%if ! %{_have_sysuser}
845 +Requires(pre): %{name}-user >= %{version}
846 +%endif
847
848 %description plugin-pythond
849 This plugin adds a selection of additional collectors written in Python to the Netdata Agent.
850 Many of the collectors provided by this package are also available in netdata-plugin-go. In msot cases, you probably
851 want to use those versions instead of the Python versions.
852
872 -%pre plugin-pythond
873 -
874 -if ! getent group %{name} > /dev/null; then
875 - groupadd --system %{name}
876 -fi
877 -
853 %files plugin-pythond
854 %defattr(0750,root,netdata,0750)
855 %{_libexecdir}/%{name}/plugins.d/python.d.plugin
@@ -892,18 +867,15 @@ Conflicts: %{name} < %{version}
867 Suggests: nvme-cli
868 Suggests: sudo
869 %endif
870 +%if ! %{_have_sysuser}
871 +Requires(pre): %{name}-user >= %{version}
872 +%endif
873
874 %description plugin-go
875 This plugin adds a selection of additional collectors written in Go to the Netdata Agent
876 A significant percentage of the application specific collectors provided by Netdata are part of this plugin,
877 so most users will want it installed.
878
901 -%pre plugin-go
902 -
903 -if ! getent group %{name} > /dev/null; then
904 - groupadd --system %{name}
905 -fi
906 -
879 %files plugin-go
880 %defattr(0750,root,netdata,0750)
881 # CAP_NET_ADMIN needed for WireGuard collector
@@ -921,18 +893,18 @@ Requires: %{name} = %{version}
893 Requires: %{name}-plugin-ibm-libs = %{version}
894 Requires: unixODBC
895 Conflicts: %{name} < %{version}
896 +%if ! %{_have_sysuser}
897 +Requires(pre): %{name}-user >= %{version}
898 +%else
899 +Requires(pre): user(%{name})
900 +Requires(pre): group(%{name})
901 +%endif
902 AutoReqProv: no
903
904 %description plugin-ibm
905 This plugin adds IBM ecosystem collectors (AS/400, DB2, MQ, WebSphere) to the Netdata Agent.
906 Database collectors (AS/400, DB2) use unixODBC exclusively and require appropriate ODBC drivers.
907
930 -%pre plugin-ibm
931 -
932 -if ! getent group %{name} > /dev/null; then
933 - groupadd --system %{name}
934 -fi
935 -
908 %files plugin-ibm
909 %defattr(0750,root,netdata,0750)
910 %{_libexecdir}/%{name}/plugins.d/ibm.d.plugin
@@ -945,18 +917,20 @@ Summary: IBM MQ client libraries for the Netdata IBM ecosystem metrics collectio
917 Group: Applications/System
918 Requires: %{name} = %{version}
919 Conflicts: %{name} < %{version}
920 +%if ! %{_have_sysuser}
921 +%if ! %{_have_sysuser}
922 +Requires(pre): %{name}-user >= %{version}
923 +%endif
924 +%else
925 +Requires(pre): user(%{name})
926 +Requires(pre): group(%{name})
927 +%endif
928 AutoReqProv: no
929
930 %description plugin-ibm-libs
931 This package provides the IBM MQ client libraries needed by Netdata IBM
932 ecosystem metrics collection plugin.
933
954 -%pre plugin-ibm-libs
955 -
956 -if ! getent group %{name} > /dev/null; then
957 - groupadd --system %{name}
958 -fi
959 -
934 %files plugin-ibm-libs
935 %defattr(0750,root,netdata,0750)
936 %{_libdir}/%{name}/ibm-mqclient/bin/amqcgskv32
@@ -3057,16 +3031,13 @@ Summary: The per-application metrics collection plugin for the Netdata Agent
3031 Group: Applications/System
3032 Requires: %{name} = %{version}
3033 Conflicts: %{name} < %{version}
3034 +%if ! %{_have_sysuser}
3035 +Requires(pre): %{name}-user >= %{version}
3036 +%endif
3037
3038 %description plugin-apps
3039 This plugin allows the Netdata Agent to collect per-application and per-user metrics without using cgroups.
3040
3064 -%pre plugin-apps
3065 -
3066 -if ! getent group %{name} > /dev/null; then
3067 - groupadd --system %{name}
3068 -fi
3069 -
3041 %files plugin-apps
3042 %defattr(0750,root,netdata,0750)
3043 # CAP_DAC_READ_SEARCH and CAP_SYS_PTRACE needed for data collection by the plugin.
@@ -3079,16 +3050,13 @@ Summary: The slabinfo metrics collector for the Netdata Agent
3050 Group: Applications/System
3051 Requires: %{name} = %{version}
3052 Conflicts: %{name} < %{version}
3053 +%if ! %{_have_sysuser}
3054 +Requires(pre): %{name}-user >= %{version}
3055 +%endif
3056
3057 %description plugin-slabinfo
3058 This plugin allows the Netdata Agent to collect perfromance and utilization metrics for the Linux kernel’s SLAB allocator.
3059
3086 -%pre plugin-slabinfo
3087 -
3088 -if ! getent group %{name} > /dev/null; then
3089 - groupadd --system %{name}
3090 -fi
3091 -
3060 %files plugin-slabinfo
3061 %defattr(0750,root,netdata,0750)
3062 # CAP_DAC_READ_SEARCH needed to access the files the plugin reads to collect data.
@@ -3099,16 +3067,13 @@ Summary: The perf metrics collector for the Netdata Agent
3067 Group: Applications/System
3068 Requires: %{name} = %{version}
3069 Conflicts: %{name} < %{version}
3070 +%if ! %{_have_sysuser}
3071 +Requires(pre): %{name}-user >= %{version}
3072 +%endif
3073
3074 %description plugin-perf
3075 This plugin allows the Netdata to collect metrics from the Linux perf subsystem.
3076
3106 -%pre plugin-perf
3107 -
3108 -if ! getent group %{name} > /dev/null; then
3109 - groupadd --system %{name}
3110 -fi
3111 -
3077 %files plugin-perf
3078 %defattr(0750,root,netdata,0750)
3079 # Either CAP_SYS_ADMIN or CAP_PERFMON needed for data collection
@@ -3124,16 +3089,13 @@ Summary: The debugfs metrics collector for the Netdata Agent
3089 Group: Applications/System
3090 Requires: %{name} = %{version}
3091 Conflicts: %{name} < %{version}
3092 +%if ! %{_have_sysuser}
3093 +Requires(pre): %{name}-user >= %{version}
3094 +%endif
3095
3096 %description plugin-debugfs
3097 This plugin allows the Netdata Agent to collect Linux kernel metrics exposed through debugfs.
3098
3131 -%pre plugin-debugfs
3132 -
3133 -if ! getent group %{name} > /dev/null; then
3134 - groupadd --system %{name}
3135 -fi
3136 -
3099 %files plugin-debugfs
3100 %defattr(0750,root,netdata,0750)
3101 # CAP_DAC_READ_SEARCH required for data collection.
@@ -3144,17 +3106,14 @@ Summary: The systemd-journal plugin for the Netdata Agent
3106 Group: Applications/System
3107 Requires: %{name} = %{version}
3108 Conflicts: %{name} < %{version}
3109 +%if ! %{_have_sysuser}
3110 +Requires(pre): %{name}-user >= %{version}
3111 +%endif
3112
3113 %description plugin-systemd-journal
3114 This plugin allows the Netdata Agent to present entries from the systemd
3115 journal on Netdata Cloud or the local Agent Dashboard.
3116
3152 -%pre plugin-systemd-journal
3153 -
3154 -if ! getent group %{name} > /dev/null; then
3155 - groupadd --system %{name}
3156 -fi
3157 -
3117 %files plugin-systemd-journal
3118 %defattr(0750,root,netdata,0750)
3119 # CAP_DAC_READ_SEARCH required for data collection.
@@ -3166,15 +3125,13 @@ Summary: The systemd units plugin for the Netdata Agent
3125 Group: Applications/System
3126 Requires: %{name} = %{version}
3127 Conflicts: %{name} < %{version}
3128 +%if ! %{_have_sysuser}
3129 +Requires(pre): %{name}-user >= %{version}
3130 +%endif
3131
3132 %description plugin-systemd-units
3133 This plugin allows Netdata to collect metrics about systemd units.
3134
3173 -%pre plugin-systemd-units
3174 -if ! getent group %{name} > /dev/null; then
3175 - groupadd --system %{name}
3176 -fi
3177 -
3135 %files plugin-systemd-units
3136 %defattr(0750,root,netdata,0750)
3137 %{_libexecdir}/%{name}/plugins.d/systemd-units.plugin
@@ -3186,15 +3143,13 @@ Summary: The xenstat plugin for the Netdata Agent
3143 Group: Applications/System
3144 Requires: %{name} = %{version}
3145 Conflicts: %{name} < %{version}
3146 +%if ! %{_have_sysuser}
3147 +Requires(pre): %{name}-user >= %{version}
3148 +%endif
3149
3150 %description plugin-xenstat
3151 This plugin allows Netdata to collect metrics from the Xen Hypervisor.
3152
3193 -%pre plugin-xenstat
3194 -if ! getent group %{name} > /dev/null; then
3195 - groupadd --system %{name}
3196 -fi
3197 -
3153 %files plugin-xenstat
3154 %defattr(0750,root,netdata,0750)
3155 # SUID needed for data collection
@@ -3213,16 +3168,14 @@ Recommends: %{name}-plugin-ebpf = %{version}
3168 Requires: %{name}-plugin-ebpf = %{version}
3169 %endif
3170 %endif
3171 +%if ! %{_have_sysuser}
3172 +Requires(pre): %{name}-user >= %{version}
3173 +%endif
3174
3175 %description plugin-network-viewer
3176 This plugin allows the Netdata Agent to provide network connection
3177 mapping functionality for use in netdata Cloud.
3178
3221 -%pre plugin-network-viewer
3222 -if ! getent group %{name} > /dev/null; then
3223 - groupadd --system %{name}
3224 -fi
3225 -
3179 %files plugin-network-viewer
3180 %defattr(0750,root,netdata,0750)
3181 # CAP_SYS_ADMIN, CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH needed for data collection.
@@ -3233,15 +3186,13 @@ Summary: The local dashboard for the Netdata Agent
3186 Group: Applications/System
3187 Requires: %{name} >= %{version}
3188 Conflicts: %{name} < %{version}
3189 +%if ! %{_have_sysuser}
3190 +Requires(pre): %{name}-user >= %{version}
3191 +%endif
3192
3193 %description dashboard
3194 This allows access to the dashboard on the local node without internet access.
3195
3240 -%pre dashboard
3241 -if ! getent group %{name} > /dev/null; then
3242 - groupadd --system %{name}
3243 -fi
3244 -
3196 %files dashboard
3197 %defattr(0644,root,root,0755)
3198 %{_datadir}/%{name}/web
@@ -3252,23 +3203,65 @@ Summary: The Open Telemetry plugin for the Netdata Agent
3203 Group: Applications/System
3204 Requires: %{name} >= %{version}
3205 Conflicts: %{name} < %{version}
3206 +%if ! %{_have_sysuser}
3207 +Requires(pre): %{name}-user >= %{version}
3208 +%endif
3209
3210 %description plugin-otel
3211 This plugin allows the Netdata Agent to collect metrics and logs via the
3212 OpenTelemetry gRPC protocol, providing integration with modern observability
3213 stacks.
3214
3261 -%pre plugin-otel
3262 -if ! getent group %{name} > /dev/null; then
3263 - groupadd --system %{name}
3264 -fi
3265 -
3215 %files plugin-otel
3216 %defattr(0750,root,netdata,0750)
3217 %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/otel-plugin
3218 %endif
3219
3220 +%package user
3221 +Summary: User and group accounts for the Netdata Agent
3222 +Group: Applications/System
3223 +%if ! %{_have_sysuser}
3224 +Requires: /usr/sbin/useradd
3225 +Requires: /usr/sbin/groupadd
3226 +%else
3227 +Requires: systemd
3228 +%endif
3229 +%if %{_need_explicit_user_provides}
3230 +Provides: user(netdata)
3231 +Provides: group(netdata)
3232 +%endif
3233 +
3234 +%description user
3235 + This package provides the netdata user and group that are used by the Netdata Agent.
3236 +
3237 +%post user
3238 +%if %{_need_explicit_user_provides} || ! %{_have_sysuser}
3239 +if command -v systemd-sysusers >/dev/null 2>&1; then
3240 + systemd-sysusers %{_sysusersdir}/%{name}.conf
3241 +else
3242 + if ! getent group %{name} > /dev/null; then
3243 + groupadd --system %{name}
3244 + fi
3245 +
3246 + if ! getent passwd %{name} > /dev/null; then
3247 + useradd --system -g %{name} --home %{contentdir} --no-create-home -s /sbin/nologin -c "Netdata pseudo user" %{name}
3248 + fi
3249 +fi
3250 +%endif
3251 +
3252 +for item in docker ceph I2C; do
3253 + if getent group $item > /dev/null 2>&1; then
3254 + usermod -a -G ${item} %{name}
3255 + fi
3256 +done
3257 +
3258 +%files user
3259 +%defattr(0644,root,root,0755)
3260 +%attr(0644,root,root) %{_sysusersdir}/%{name}.conf
3261 +
3262 %changelog
3263 +* Tue Nov 11 2025 Austin Hemmelgarn <austin@netdata.cloud> 0.0.0-37
3264 +- Update to use sysusers infrastructure when available.
3265 * Fri Oct 24 2025 Austin Hemmelgarn <austin@netdata.cloud> 0.0.0-36
3266 - Add proper cleanup of auto-update configuration on uninstall
3267 * Tue Sep 30 2025 Austin Hemmelgarn <austin@netdata.cloud> 0.0.0-35
packaging/cmake/Modules/Packaging.cmake
+35 -41
@@ -54,7 +54,7 @@ set(CPACK_COMPONENT_NETDATA_DESCRIPTION
54
55 set(CPACK_DEBIAN_NETDATA_PACKAGE_NAME "netdata")
56 set(CPACK_DEBIAN_NETDATA_PACKAGE_SECTION "net")
57 -set(CPACK_DEBIAN_NETDATA_PACKAGE_PREDEPENDS "adduser, libcap2-bin")
57 +set(CPACK_DEBIAN_NETDATA_PACKAGE_PREDEPENDS "netdata-user, libcap2-bin")
58 set(CPACK_DEBIAN_NETDATA_PACKAGE_SUGGESTS
59 "netdata-plugin-cups, netdata-plugin-freeipmi, netdata-plugin-ibm")
60 set(CPACK_DEBIAN_NETDATA_PACKAGE_RECOMMENDS
@@ -111,13 +111,29 @@ list(JOIN _main_deps ", " CPACK_DEBIAN_NETDATA_PACKAGE_DEPENDS)
111
112 set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
113 "${PKG_FILES_PATH}/deb/netdata/conffiles;"
114 - "${PKG_FILES_PATH}/deb/netdata/preinst"
114 "${PKG_FILES_PATH}/deb/netdata/postinst"
115 "${PKG_FILES_PATH}/deb/netdata/prerm"
116 "${PKG_FILES_PATH}/deb/netdata/postrm")
117
118 set(CPACK_DEBIAN_NETDATA_DEBUGINFO_PACKAGE Off)
119
120 +#
121 +# user
122 +#
123 +
124 +set(CPACK_COMPONENT_USER_DESCRIPTION
125 + "User and group accounts for the Netdata Agent")
126 +
127 +set(CPACK_DEBIAN_USER_PACKAGE_NAME "netdata-user")
128 +set(CPACK_DEBIAN_USER_PACKAGE_SECTION "net")
129 +set(CPACK_DEBIAN_USER_PACKAGE_CONFLICTS "netdata (<< ${CPACK_PACKAGE_VERSION})")
130 +set(CPACK_DEBIAN_USER_PACKAGE_DEPENDS "adduser | systemd")
131 +
132 +set(CPACK_DEBIAN_USER_PACKAGE_CONTROL_EXTRA
133 + "${PKG_FILES_PATH}/deb/user/postinst")
134 +
135 +set(CPACK_DEBIAN_USER_DEBUGINFO_PACKAGE Off)
136 +
137 #
138 # dashboard
139 #
@@ -130,12 +146,7 @@ set(CPACK_COMPONENT_DASHBOARD_DESCRIPTION
146 set(CPACK_DEBIAN_DASHBOARD_PACKAGE_NAME "netdata-dashboard")
147 set(CPACK_DEBIAN_DASHBOARD_PACKAGE_SECTION "net")
148 set(CPACK_DEBIAN_DASHBOARD_PACKAGE_CONFLICTS "netdata (<< ${CPACK_PACKAGE_VERSION})")
133 -set(CPACK_DEBIAN_DASHBOARD_PACKAGE_PREDEPENDS "adduser")
134 -
135 -set(CPACK_DEBIAN_DASHBOARD_PACKAGE_CONTROL_EXTRA
136 - "${PKG_FILES_PATH}/deb/plugin-apps/preinst"
137 - "${PKG_FILES_PATH}/deb/plugin-apps/postinst"
138 - "${PKG_FILES_PATH}/deb/plugin-apps/postrm")
149 +set(CPACK_DEBIAN_DASHBOARD_PACKAGE_PREDEPENDS "netdata-user")
150
151 set(CPACK_DEBIAN_DASHBOARD_DEBUGINFO_PACKAGE Off)
152
@@ -155,7 +166,6 @@ set(CPACK_DEBIAN_PLUGIN-APPS_PACKAGE_CONFLICTS "netdata (<< 1.40)")
166 set(CPACK_DEBIAN_PLUGIN-APPS_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
167
168 set(CPACK_DEBIAN_PLUGIN-APPS_PACKAGE_CONTROL_EXTRA
158 - "${PKG_FILES_PATH}/deb/plugin-apps/preinst;"
169 "${PKG_FILES_PATH}/deb/plugin-apps/postinst")
170
171 set(CPACK_DEBIAN_PLUGIN-APPS_DEBUGINFO_PACKAGE On)
@@ -174,13 +184,12 @@ set(CPACK_COMPONENT_PLUGIN-CHARTSD_DESCRIPTION
184 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_NAME "netdata-plugin-chartsd")
185 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_SECTION "net")
186 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_CONFLICTS "netdata (<< 1.40)")
177 -set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_PREDEPENDS "adduser")
187 +set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_PREDEPENDS "netdata-user")
188 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_DEPENDS "bash")
189 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_ARCHITECTURE "all")
190 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_SUGGESTS "apcupsd, iw, sudo")
191
192 set(CPACK_DEBIAN_PLUGIN-CHARTSD_PACKAGE_CONTROL_EXTRA
183 - "${PKG_FILES_PATH}/deb/plugin-chartsd/preinst;"
193 "${PKG_FILES_PATH}/deb/plugin-chartsd/postinst")
194
195 set(CPACK_DEBIAN_PLUGIN-CHARTSD_DEBUGINFO_PACKAGE Off)
@@ -196,9 +205,8 @@ set(CPACK_COMPONENT_PLUGIN-CUPS_DESCRIPTION
205
206 set(CPACK_DEBIAN_PLUGIN-CUPS_PACKAGE_NAME "netdata-plugin-cups")
207 set(CPACK_DEBIAN_PLUGIN-CUPS_PACKAGE_SECTION "net")
199 -set(CPACK_DEBIAN_PLUGIN-CUPS_PACKAGE_PREDEPENDS "adduser")
208 +set(CPACK_DEBIAN_PLUGIN-CUPS_PACKAGE_PREDEPENDS "netdata-user")
209 set(CPACK_DEBIAN_PLUGIN-CUPS_PACKAGE_CONTROL_EXTRA
201 - "${PKG_FILES_PATH}/deb/plugin-cups/preinst;"
210 "${PKG_FILES_PATH}/deb/plugin-cups/postinst")
211
212 set(CPACK_DEBIAN_PLUGIN-CUPS_DEBUGINFO_PACKAGE On)
@@ -218,7 +226,6 @@ set(CPACK_DEBIAN_PLUGIN-DEBUGFS_PACKAGE_SECTION "net")
226 set(CPACK_DEBIAN_PLUGIN-DEBUGFS_PACKAGE_CONFLICTS "netdata (<< 1.40)")
227 set(CPACK_DEBIAN_PLUGIN-DEBUGFS_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
228 set(CPACK_DEBIAN_PLUGIN-DEBUGFS_PACKAGE_CONTROL_EXTRA
221 - "${PKG_FILES_PATH}/deb/plugin-debugfs/preinst;"
229 "${PKG_FILES_PATH}/deb/plugin-debugfs/postinst")
230
231 set(CPACK_DEBIAN_PLUGIN-DEBUGFS_DEBUGINFO_PACKAGE On)
@@ -236,11 +243,10 @@ set(CPACK_COMPONENT_PLUGIN-EBPF_DESCRIPTION
243 set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_NAME "netdata-plugin-ebpf")
244 set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_SECTION "net")
245 set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_CONFLICTS "netdata (<< 1.40)")
239 -set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_PREDEPENDS "adduser")
246 +set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_PREDEPENDS "netdata-user")
247 set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_RECOMMENDS "netdata-plugin-apps (= ${CPACK_PACKAGE_VERSION}), netdata-ebpf-code-legacy (= ${CPACK_PACKAGE_VERSION})")
248
249 set(CPACK_DEBIAN_PLUGIN-EBPF_PACKAGE_CONTROL_EXTRA
243 - "${PKG_FILES_PATH}/deb/plugin-ebpf/preinst;"
250 "${PKG_FILES_PATH}/deb/plugin-ebpf/postinst")
251
252 set(CPACK_DEBIAN_PLUGIN-EBPF_DEBUGINFO_PACKAGE On)
@@ -260,11 +266,10 @@ set(CPACK_COMPONENT_EBPF-CODE-LEGACY_DESCRIPTION
266 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_NAME "netdata-ebpf-code-legacy")
267 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_SECTION "net")
268 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_CONFLICTS "netdata (<< 1.40)")
263 -set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_PREDEPENDS "adduser")
269 +set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_PREDEPENDS "netdata-user")
270 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_RECOMMENDS "netdata-plugin-ebpf (= ${CPACK_PACKAGE_VERSION})")
271
272 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_PACKAGE_CONTROL_EXTRA
267 - "${PKG_FILES_PATH}/deb/ebpf-code-legacy/preinst;"
273 "${PKG_FILES_PATH}/deb/ebpf-code-legacy/postinst")
274
275 set(CPACK_DEBIAN_EBPF-CODE-LEGACY_DEBUGINFO_PACKAGE Off)
@@ -281,10 +286,9 @@ set(CPACK_COMPONENT_PLUGIN-FREEIPMI_DESCRIPTION
286
287 set(CPACK_DEBIAN_PLUGIN-FREEIPMI_PACKAGE_NAME "netdata-plugin-freeipmi")
288 set(CPACK_DEBIAN_PLUGIN-FREEIPMI_PACKAGE_SECTION "net")
284 -set(CPACK_DEBIAN_PLUGIN-FREEIPMI_PACKAGE_PREDEPENDS "adduser")
289 +set(CPACK_DEBIAN_PLUGIN-FREEIPMI_PACKAGE_PREDEPENDS "netdata-user")
290
291 set(CPACK_DEBIAN_PLUGIN-FREEIPMI_PACKAGE_CONTROL_EXTRA
287 - "${PKG_FILES_PATH}/deb/plugin-freeipmi/preinst;"
292 "${PKG_FILES_PATH}/deb/plugin-freeipmi/postinst")
293
294 set(CPACK_DEBIAN_PLUGIN-FREEIPMI_DEBUGINFO_PACKAGE On)
@@ -308,7 +312,6 @@ set(CPACK_DEBIAN_PLUGIN-GO_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
312 set(CPACK_DEBIAN_PLUGIN-GO_PACKAGE_SUGGESTS "nvme-cli")
313
314 set(CPACK_DEBIAN_PLUGIN-GO_PACKAGE_CONTROL_EXTRA
311 - "${PKG_FILES_PATH}/deb/plugin-go/preinst;"
315 "${PKG_FILES_PATH}/deb/plugin-go/postinst")
316
317 set(CPACK_DEBIAN_PLUGIN-GO_DEBUGINFO_PACKAGE Off)
@@ -328,12 +331,11 @@ set(CPACK_COMPONENT_PLUGIN-IBM_DESCRIPTION
331 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_NAME "netdata-plugin-ibm")
332 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_SECTION "net")
333 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_CONFLICTS "netdata (<< 1.40)")
331 -set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_PREDEPENDS "adduser")
334 +set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_PREDEPENDS "netdata-user")
335 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_DEPENDS "unixodbc, netdata-plugin-ibm-libs (= ${CPACK_PACKAGE_VERSION})")
336 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_SUGGESTS "libxml2")
337
338 set(CPACK_DEBIAN_PLUGIN-IBM_PACKAGE_CONTROL_EXTRA
336 - "${PKG_FILES_PATH}/deb/plugin-ibm/preinst;"
339 "${PKG_FILES_PATH}/deb/plugin-ibm/postinst")
340
341 set(CPACK_DEBIAN_PLUGIN-IBM_DEBUGINFO_PACKAGE Off)
@@ -346,10 +348,7 @@ set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_DESCRIPTION
348 set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_NAME "netdata-plugin-ibm-libs")
349 set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_SECTION "net")
350 set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_CONFLICTS "netdata (<< 1.40)")
349 -set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_PREDEPENDS "adduser")
350 -
351 -set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_CONTROL_EXTRA
352 - "${PKG_FILES_PATH}/deb/plugin-ibm-libs/preinst")
351 +set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_PREDEPENDS "netdata-user")
352
353 set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_DEBUGINFO_PACKAGE Off)
354 set(CPACK_DEBIAN_PLUGIN-IBM-LIBS_PACKAGE_SHLIBDEPS Off)
@@ -370,7 +369,6 @@ set(CPACK_DEBIAN_PLUGIN-NETWORK-VIEWER_PACKAGE_PREDEPENDS "libcap2-bin, adduser"
369 set(CPACK_DEBIAN_PLUGIN-NETWORK-VIEWER_PACKAGE_RECOMMENDS "netdata-plugin-ebpf (= ${CPACK_PACKAGE_VERSION})")
370
371 set(CPACK_DEBIAN_PLUGIN-NETWORK-VIEWER_PACKAGE_CONTROL_EXTRA
373 - "${PKG_FILES_PATH}/deb/plugin-network-viewer/preinst;"
372 "${PKG_FILES_PATH}/deb/plugin-network-viewer/postinst")
373
374 set(CPACK_DEBIAN_PLUGIN-NETWORK-VIEWER_DEBUGINFO_PACKAGE On)
@@ -389,10 +387,9 @@ set(CPACK_COMPONENT_PLUGIN-OTEL_DESCRIPTION
387 set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_NAME "netdata-plugin-otel")
388 set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_SECTION "net")
389 set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_CONFLICTS "netdata (<< 1.40)")
392 -set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_PREDEPENDS "adduser")
390 +set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_PREDEPENDS "netdata-user")
391
392 set(CPACK_DEBIAN_PLUGIN-OTEL_PACKAGE_CONTROL_EXTRA
395 - "${PKG_FILES_PATH}/deb/plugin-otel/preinst;"
393 "${PKG_FILES_PATH}/deb/plugin-otel/postinst")
394
395 set(CPACK_DEBIAN_PLUGIN-OTEL_DEBUGINFO_PACKAGE Off)
@@ -410,10 +407,9 @@ set(CPACK_COMPONENT_PLUGIN-NFACCT_DESCRIPTION
407 set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_NAME "netdata-plugin-nfacct")
408 set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_SECTION "net")
409 set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_CONFLICTS "netdata (<< 1.40)")
413 -set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_PREDEPENDS "adduser")
410 +set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_PREDEPENDS "netdata-user")
411
412 set(CPACK_DEBIAN_PLUGIN-NFACCT_PACKAGE_CONTROL_EXTRA
416 - "${PKG_FILES_PATH}/deb/plugin-nfacct/preinst;"
413 "${PKG_FILES_PATH}/deb/plugin-nfacct/postinst")
414
415 set(CPACK_DEBIAN_PLUGIN-NFACCT_DEBUGINFO_PACKAGE On)
@@ -434,7 +430,6 @@ set(CPACK_DEBIAN_PLUGIN-PERF_PACKAGE_CONFLICTS "netdata (<< 1.40)")
430 set(CPACK_DEBIAN_PLUGIN-PERF_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
431
432 set(CPACK_DEBIAN_PLUGIN-PERF_PACKAGE_CONTROL_EXTRA
437 - "${PKG_FILES_PATH}/deb/plugin-perf/preinst;"
433 "${PKG_FILES_PATH}/deb/plugin-perf/postinst")
434
435 set(CPACK_DEBIAN_PLUGIN-PERF_DEBUGINFO_PACKAGE On)
@@ -453,13 +448,12 @@ set(CPACK_COMPONENT_PLUGIN-PYTHOND_DESCRIPTION
448 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_NAME "netdata-plugin-pythond")
449 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_SECTION "net")
450 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_CONFLICTS "netdata (<< 1.40)")
456 -set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_PREDEPENDS "adduser")
451 +set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_PREDEPENDS "netdata-user")
452 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_SUGGESTS "sudo")
453 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACHAGE_DEPENDS "python3")
454 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_ARCHITECTURE "all")
455
456 set(CPACK_DEBIAN_PLUGIN-PYTHOND_PACKAGE_CONTROL_EXTRA
462 - "${PKG_FILES_PATH}/deb/plugin-pythond/preinst;"
457 "${PKG_FILES_PATH}/deb/plugin-pythond/postinst")
458
459 set(CPACK_DEBIAN_PLUGIN-PYTHOND_DEBUGINFO_PACKAGE Off)
@@ -480,7 +474,6 @@ set(CPACK_DEBIAN_PLUGIN-SLABINFO_PACKAGE_CONFLICTS "netdata (<< 1.40)")
474 set(CPACK_DEBIAN_PLUGIN-SLABINFO_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
475
476 set(CPACK_DEBIAN_PLUGIN-SLABINFO_PACKAGE_CONTROL_EXTRA
483 - "${PKG_FILES_PATH}/deb/plugin-slabinfo/preinst;"
477 "${PKG_FILES_PATH}/deb/plugin-slabinfo/postinst")
478
479 set(CPACK_DEBIAN_PLUGIN-SLABINFO-DEBUGINFO_PACKAGE On)
@@ -500,7 +493,6 @@ set(CPACK_DEBIAN_PLUGIN-SYSTEMD-JOURNAL_PACKAGE_SECTION "net")
493 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-JOURNAL_PACKAGE_PREDEPENDS "libcap2-bin, adduser")
494
495 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-JOURNAL_PACKAGE_CONTROL_EXTRA
503 - "${PKG_FILES_PATH}/deb/plugin-systemd-journal/preinst;"
496 "${PKG_FILES_PATH}/deb/plugin-systemd-journal/postinst")
497
498 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-JOURNAL_DEBUGINFO_PACKAGE On)
@@ -516,10 +508,9 @@ set(CPACK_COMPONENT_PLUGIN-SYSTEMD-UNITS_DESCRIPTION
508
509 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-UNITS_PACKAGE_NAME "netdata-plugin-systemd-units")
510 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-UNITS_PACKAGE_SECTION "net")
519 -set(CPACK_DEBIAN_PLUGIN-SYSTEMD-UNITS_PACKAGE_PREDEPENDS "adduser")
511 +set(CPACK_DEBIAN_PLUGIN-SYSTEMD-UNITS_PACKAGE_PREDEPENDS "netdata-user")
512
513 set(CPACK_DEBIAN_PLUGIN-SYSTEMD-UNITS_PACKAGE_CONTROL_EXTRA
522 - "${PKG_FILES_PATH}/deb/plugin-systemd-units/preinst;"
514 "${PKG_FILES_PATH}/deb/plugin-systemd-units/postinst")
515
516 set(CPACK_DEBIAN_PLUGIN-SYSTEMD_UNITS_DEBUGINFO_PACKAGE On)
@@ -537,10 +528,9 @@ set(CPACK_COMPONENT_PLUGIN-XENSTAT_DESCRIPTION
528 set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_NAME "netdata-plugin-xenstat")
529 set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_SECTION "net")
530 set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_CONFLICTS "netdata (<< 1.40)")
540 -set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_PREDEPENDS "adduser")
531 +set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_PREDEPENDS "netdata-user")
532
533 set(CPACK_DEBIAN_PLUGIN-XENSTAT_PACKAGE_CONTROL_EXTRA
543 - "${PKG_FILES_PATH}/deb/plugin-xenstat/preinst;"
534 "${PKG_FILES_PATH}/deb/plugin-xenstat/postinst")
535
536 set(CPACK_DEBIAN_PLUGIN-XENSTAT_DEBUGINFO_PACKAGE On)
@@ -550,6 +540,7 @@ set(CPACK_DEBIAN_PLUGIN-XENSTAT_DEBUGINFO_PACKAGE On)
540 #
541
542 list(APPEND CPACK_COMPONENTS_ALL "netdata")
543 +list(APPEND CPACK_COMPONENTS_ALL "user")
544 if(ENABLE_DASHBOARD)
545 list(APPEND CPACK_COMPONENTS_ALL "dashboard")
546 endif()
@@ -599,6 +590,9 @@ endif()
590 if(ENABLE_PLUGIN_SYSTEMD_JOURNAL)
591 list(APPEND CPACK_COMPONENTS_ALL "plugin-systemd-journal")
592 endif()
593 +if(ENABLE_PLUGIN_SYSTEMD_UNITS)
594 + list(APPEND CPACK_COMPONENTS_ALL "plugin-systemd-units")
595 +endif()
596 if(ENABLE_PLUGIN_XENSTAT)
597 list(APPEND CPACK_COMPONENTS_ALL "plugin-xenstat")
598 endif()
packaging/cmake/pkg-files/deb/dashboard/postinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - configure|reconfigure)
7 - if ! dpkg-statoverride --list /usr/share/netdata/www > /dev/null 2>&1; then
8 - dpkg-statoverride --update --add root netdata 0755 /usr/share/netdata/www
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/dashboard/postrm deleted
-17
@@ -1,17 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - remove) ;;
7 -
8 - purge)
9 - if dpkg-statoverride --list | grep -qw /var/lib/netdata/www; then
10 - dpkg-statoverride --remove /var/lib/netdata/www
11 - fi
12 -
13 - if dpkg-statoverride --list | grep -qw /usr/share/netdata/www; then
14 - dpkg-statoverride --remove /usr/share/netdata/www
15 - fi
16 - ;;
17 -esac
packaging/cmake/pkg-files/deb/dashboard/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/ebpf-code-legacy/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/netdata/preinst deleted
-26
@@ -1,26 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 -
11 - if ! getent passwd netdata > /dev/null; then
12 - adduser --quiet --system --ingroup netdata --home /var/lib/netdata --no-create-home netdata
13 - fi
14 -
15 - for item in docker nginx varnish haproxy adm nsd proxy squid ceph nobody I2C; do
16 - if getent group $item > /dev/null 2>&1; then
17 - usermod -a -G $item netdata
18 - fi
19 - done
20 - # Netdata must be able to read /etc/pve/qemu-server/* and /etc/pve/lxc/*
21 - # for reading VMs/containers names, CPU and memory limits on Proxmox.
22 - if [ -d "/etc/pve" ] && getent group "www-data" > /dev/null 2>&1; then
23 - usermod -a -G www-data netdata
24 - fi
25 - ;;
26 -esac
packaging/cmake/pkg-files/deb/plugin-apps/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-chartsd/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-cups/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-debugfs/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-ebpf/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-freeipmi/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-go/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-ibm-libs/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
\ No newline at end of file
packaging/cmake/pkg-files/deb/plugin-ibm/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
\ No newline at end of file
packaging/cmake/pkg-files/deb/plugin-network-viewer/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-nfacct/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-otel/postinst
packaging/cmake/pkg-files/deb/plugin-otel/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-perf/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-pythond/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-slabinfo/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-systemd-journal/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-systemd-units/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/plugin-xenstat/preinst deleted
-11
@@ -1,11 +0,0 @@
1 -#!/bin/sh
2 -
3 -set -e
4 -
5 -case "$1" in
6 - install)
7 - if ! getent group netdata > /dev/null; then
8 - addgroup --quiet --system netdata
9 - fi
10 - ;;
11 -esac
packaging/cmake/pkg-files/deb/user/postinst new
+31
@@ -0,0 +1,31 @@
1 +#!/bin/sh
2 +
3 +set -e
4 +
5 +case "${1}" in
6 + configure|reconfigure)
7 + if command -v systemd-sysusers >/dev/null 2>&1; then
8 + systemd-sysusers /usr/lib/sysusers.d/netdata.conf
9 + else
10 + if ! getent group netdata > /dev/null; then
11 + addgroup --quiet --system netdata
12 + fi
13 +
14 + if ! getent passwd netdata > /dev/null; then
15 + adduser --quiet --system --ingroup netdata --home /var/lib/netdata --no-create-home netdata
16 + fi
17 + fi
18 +
19 + groups="docker ceph I2C"
20 +
21 + if [ -d "/etc/pve" ]; then
22 + groups="${groups} www-data"
23 + fi
24 +
25 + for item in ${groups}; do
26 + if getent group "${item}" > /dev/null 2>&1; then
27 + usermod -a -G "${item}" netdata
28 + fi
29 + done
30 + ;;
31 +esac
packaging/installer/functions.sh
+24
@@ -1036,6 +1036,30 @@ EOF
1036
1037 }
1038
1039 +# -----------------------------------------------------------------------------
1040 +# user handling functions
1041 +
1042 +create_netdata_accounts() {
1043 + NETDATA_WANTED_GROUPS="docker ceph I2C"
1044 +
1045 + if [ -d "/etc/pve" ]; then
1046 + NETDATA_WANTED_GROUPS="${NETDATA_WANTED_GROUPS} www-data"
1047 + fi
1048 +
1049 + if command -v systemd-sysusers >/dev/null 2>&1; then
1050 + install -m 644 -o root -g root "${NETDATA_PREFIX}/usr/lib/netdata/system/systemd/sysusers/netdata.conf" /usr/lib/sysusers.d/netdata.conf
1051 + systemd-sysusers /usr/lib/sysusers.d/netdata.conf
1052 + else
1053 + portable_add_group netdata || :
1054 + portable_add_user netdata "${NETDATA_PREFIX}/var/lib/netdata" || :
1055 + fi
1056 +
1057 + for g in ${NETDATA_WANTED_GROUPS}; do
1058 + # shellcheck disable=SC2086
1059 + portable_add_user_to_group ${g} netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS:-} ${g}"
1060 + done
1061 +}
1062 +
1063 portable_add_user() {
1064 username="${1}"
1065 homedir="${2}"
packaging/makeself/install-or-update.sh
+4 -27
@@ -94,33 +94,10 @@ progress "Attempt to create user/group netdata/netadata"
94 NETDATA_WANTED_GROUPS="docker nginx varnish haproxy adm nsd proxy squid ceph nobody I2C"
95 NETDATA_ADDED_TO_GROUPS=""
96 # Default user/group
97 -NETDATA_USER="root"
98 -NETDATA_GROUP="root"
99 -
100 -if portable_add_group netdata; then
101 - if portable_add_user netdata "/opt/netdata"; then
102 - progress "Add user netdata to required user groups"
103 - for g in ${NETDATA_WANTED_GROUPS}; do
104 - # shellcheck disable=SC2086
105 - if portable_add_user_to_group ${g} netdata; then
106 - NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} ${g}"
107 - else
108 - run_failed "Failed to add netdata user to secondary groups"
109 - fi
110 - done
111 - # Netdata must be able to read /etc/pve/qemu-server/* and /etc/pve/lxc/*
112 - # for reading VMs/containers names, CPU and memory limits on Proxmox.
113 - if [ -d "/etc/pve" ]; then
114 - portable_add_user_to_group "www-data" netdata && NETDATA_ADDED_TO_GROUPS="${NETDATA_ADDED_TO_GROUPS} www-data"
115 - fi
116 - NETDATA_USER="netdata"
117 - NETDATA_GROUP="netdata"
118 - else
119 - run_failed "I could not add user netdata, will be using root"
120 - fi
121 -else
122 - run_failed "I could not add group netdata, so no user netdata will be created as well. Netdata run as root:root"
123 -fi
97 +NETDATA_USER="netdata"
98 +NETDATA_GROUP="netdata"
99 +
100 +create_netdata_accounts
101
102 # -----------------------------------------------------------------------------
103 progress "Install logrotate configuration for netdata"
system/systemd/sysusers.conf.in new
+2
@@ -0,0 +1,2 @@
1 +u @NETDATA_USER@ - "Netdata Agent user" @VARLIB_DIR@ -
2 +g @NETDATA_USER@ -