prefer cap over setuid for sysetmd-journal in installer (#15741)
Ilya Mashchenko committed
Aug 4, 2023 at 16:11 UTC
4611cbbcb3d78e8f9ab19e91d0781faddf6a02c3
1 file changed
+15
-4
netdata-installer.sh
+15
-4
@@ -1239,6 +1239,21 @@ if [ "$(id -u)" -eq 0 ]; then
1239
fi
1240
fi
1241
1242
+ if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then
1243
+ run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1244
+ capabilities=0
1245
+ if ! iscontainer && command -v setcap 1> /dev/null 2>&1; then
1246
+ run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1247
+ if run setcap cap_dac_read_search+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"; then
1248
+ capabilities=1
1249
+ fi
1250
+ fi
1251
+
1252
+ if [ $capabilities -eq 0 ]; then
1253
+ run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1254
+ fi
1255
+ fi
1256
+
1257
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin" ]; then
1258
run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin"
1259
run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin"
@@ -1291,10 +1306,6 @@ if [ "$(id -u)" -eq 0 ]; then
1306
run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/local-listeners"
1307
fi
1308
1294
- if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then
1295
- run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1296
- run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"
1297
- fi
1309
else
1310
# non-privileged user installation
1311
run chown "${NETDATA_USER}:${NETDATA_GROUP}" "${NETDATA_LOG_DIR}"