Check for protected when excluding mounts (#13479)
* check for protected when excluding mounts * change flag name * added more mounts to systemd protected * link to issue comment
Emmanuel Vasilakis committed
Aug 4, 2022 at 17:37 UTC
43cf17af1d60f3bb198f72d444d8f840bc90a3a0
3 files changed
+34
-24
collectors/diskspace.plugin/plugin_diskspace.c
+3
-24
@@ -101,28 +101,6 @@ int mount_point_cleanup_cb(const char *name, void *entry, void *data) {
101
return mount_point_cleanup(name, (struct mount_point_metadata *)entry, 0);
102
}
103
104
-// for the full list of protected mount points look at
105
-// https://github.com/systemd/systemd/blob/1eb3ef78b4df28a9e9f464714208f2682f957e36/src/core/namespace.c#L142-L149
106
-// https://github.com/systemd/systemd/blob/1eb3ef78b4df28a9e9f464714208f2682f957e36/src/core/namespace.c#L180-L194
107
-static const char *systemd_protected_mount_points[] = {
108
- "/home",
109
- "/root",
110
- "/usr",
111
- "/boot",
112
- "/efi",
113
- "/etc",
114
- NULL
115
-};
116
-
117
-int mount_point_is_protected(char *mount_point)
118
-{
119
- for (size_t i = 0; systemd_protected_mount_points[i] != NULL; i++)
120
- if (!strcmp(mount_point, systemd_protected_mount_points[i]))
121
- return 1;
122
-
123
- return 0;
124
-}
125
-
104
// a copy of basic mountinfo fields
105
struct basic_mountinfo {
106
char *persistent_id;
@@ -452,7 +430,7 @@ static inline void do_disk_space_stats(struct mountinfo *mi, int update_every) {
430
431
if (unlikely(
432
mi->flags & MOUNTINFO_READONLY &&
455
- !mount_point_is_protected(mi->mount_point) &&
433
+ !(mi->flags & MOUNTINFO_IS_IN_SYSD_PROTECTED_LIST) &&
434
!m->collected &&
435
m->do_space != CONFIG_BOOLEAN_YES &&
436
m->do_inodes != CONFIG_BOOLEAN_YES))
@@ -687,7 +665,8 @@ void *diskspace_main(void *ptr) {
665
continue;
666
667
// exclude mounts made by ProtectHome and ProtectSystem systemd hardening options
690
- if(mi->flags & MOUNTINFO_READONLY && !strcmp(mi->root, mi->mount_point))
668
+ // https://github.com/netdata/netdata/issues/11498#issuecomment-950982878
669
+ if(mi->flags & MOUNTINFO_READONLY && mi->flags & MOUNTINFO_IS_IN_SYSD_PROTECTED_LIST && !strcmp(mi->root, mi->mount_point))
670
continue;
671
672
worker_is_busy(WORKER_JOB_MOUNTPOINT);
collectors/proc.plugin/proc_self_mountinfo.c
+30
@@ -182,6 +182,33 @@ static inline int is_read_only(const char *s) {
182
return 0;
183
}
184
185
+// for the full list of protected mount points look at
186
+// https://github.com/systemd/systemd/blob/1eb3ef78b4df28a9e9f464714208f2682f957e36/src/core/namespace.c#L142-L149
187
+// https://github.com/systemd/systemd/blob/1eb3ef78b4df28a9e9f464714208f2682f957e36/src/core/namespace.c#L180-L194
188
+static const char *systemd_protected_mount_points[] = {
189
+ "/home",
190
+ "/root",
191
+ "/usr",
192
+ "/boot",
193
+ "/efi",
194
+ "/etc",
195
+ "/run/user",
196
+ "/lib",
197
+ "/lib64",
198
+ "/bin",
199
+ "/sbin",
200
+ NULL
201
+};
202
+
203
+static inline int mount_point_is_protected(char *mount_point)
204
+{
205
+ for (size_t i = 0; systemd_protected_mount_points[i] != NULL; i++)
206
+ if (!strcmp(mount_point, systemd_protected_mount_points[i]))
207
+ return 1;
208
+
209
+ return 0;
210
+}
211
+
212
// read the whole mountinfo into a linked list
213
struct mountinfo *mountinfo_read(int do_statvfs) {
214
char filename[FILENAME_MAX + 1];
@@ -252,6 +279,9 @@ struct mountinfo *mountinfo_read(int do_statvfs) {
279
if(unlikely(is_read_only(mi->mount_options)))
280
mi->flags |= MOUNTINFO_READONLY;
281
282
+ if(unlikely(mount_point_is_protected(mi->mount_point)))
283
+ mi->flags |= MOUNTINFO_IS_IN_SYSD_PROTECTED_LIST;
284
+
285
// count the optional fields
286
/*
287
unsigned long wo = w;
collectors/proc.plugin/proc_self_mountinfo.h
+1
@@ -10,6 +10,7 @@
10
#define MOUNTINFO_NO_STAT 0x00000010
11
#define MOUNTINFO_NO_SIZE 0x00000020
12
#define MOUNTINFO_READONLY 0x00000040
13
+#define MOUNTINFO_IS_IN_SYSD_PROTECTED_LIST 0x00000080
14
15
struct mountinfo {
16
long id; // mount ID: unique identifier of the mount (may be reused after umount(2)).