Set file capabilities correctly on static installs. (#15018)
Instead of just making all the files SUID 0, set capabilities when we know which ones are needed and `setcap` is installed. If setcap is not available, we still fall back properly to SUID on plugins that truly need it.
Austin S. Hemmelgarn committed
May 5, 2023 at 12:48 UTC
3f9449bb2641a52788376cb5520a7f5eef9e64cc
1 file changed
+21
-6
packaging/makeself/install-or-update.sh
+21
-6
@@ -208,9 +208,28 @@ run chown -R ${NETDATA_USER}:${NETDATA_GROUP} /opt/netdata
208
209
# -----------------------------------------------------------------------------
210
211
-progress "changing plugins ownership and setting setuid"
211
+progress "changing plugins ownership and permissions"
212
213
-for x in apps.plugin freeipmi.plugin ioping cgroup-network ebpf.plugin perf.plugin slabinfo.plugin nfacct.plugin xenstat.plugin; do
213
+if command -v setcap >/dev/null 2>&1; then
214
+ run setcap "cap_dac_read_search,cap_sys_ptrace=ep" "usr/libexec/netdata/plugins.d/apps.plugin"
215
+ run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/slabinfo.plugin"
216
+
217
+ if command -v capsh >/dev/null 2>&1 && capsh --supports=cap_perfmon 2>/dev/null ; then
218
+ run setcap "cap_perfmon=ep" "usr/libexec/netdata/perf.plugin"
219
+ else
220
+ run setcap "cap_sys_admin=ep" "usr/libexec/netdata/perf.plugin"
221
+ fi
222
+
223
+ run setcap "cap_net_admin,cap_net_raw=eip" "usr/libexec/netdata/plugins.d/go.d.plugin"
224
+else
225
+ for x in apps.plugin perf.plugin slabinfo.plugin; do
226
+ f="usr/libexec/netdata/plugins.d/${x}"
227
+ run chown root:${NETDATA_GROUP} "${f}"
228
+ run chmod 4750 "${f}"
229
+ done
230
+fi
231
+
232
+for x in freeipmi.plugin ioping cgroup-network ebpf.plugin nfacct.plugin xenstat.plugin; do
233
f="usr/libexec/netdata/plugins.d/${x}"
234
235
if [ -f "${f}" ]; then
@@ -219,10 +238,6 @@ for x in apps.plugin freeipmi.plugin ioping cgroup-network ebpf.plugin perf.plug
238
fi
239
done
240
222
-if [ -f "usr/libexec/netdata/plugins.d/go.d.plugin" ] && command -v setcap 1>/dev/null 2>&1; then
223
- run setcap "cap_net_admin+epi cap_net_raw=eip" "usr/libexec/netdata/plugins.d/go.d.plugin"
224
-fi
225
-
241
# -----------------------------------------------------------------------------
242
243
echo "Configure TLS certificate paths"