detect if running inside a container to avoid using setcap for apps.plugin
Costa Tsaousis (ktsaou) committed
Dec 30, 2016 at 05:28 UTC
63f5193a4f85a3cafa7b2a54de3f4d07124d1002
1 file changed
+41
-3
netdata-installer.sh
+41
-3
@@ -657,6 +657,37 @@ portable_add_user_to_group() {
657
fi
658
}
659
660
+iscontainer() {
661
+ # man systemd-detect-virt
662
+ local cmd=$(which systemd-detect-virt 2>/dev/null || command -v systemd-detect-virt 2>/dev/null)
663
+ if [ ! -z "${cmd}" -a -x "${cmd}" ]
664
+ then
665
+ "${cmd}" --container >/dev/null 2>&1 && return 0
666
+ fi
667
+
668
+ # /proc/1/sched exposes the host's pid of our init !
669
+ # http://stackoverflow.com/a/37016302
670
+ local pid=$( cat /proc/1/sched | head -n 1 | { IFS='(),#:' read name pid th threads; echo $pid; } )
671
+ local p=$(( pid + 0 ))
672
+ [ ${pid} -ne 1 ] && return 0
673
+
674
+ # lxc sets environment variable 'container'
675
+ [ ! -z "${container}" ] && return 0
676
+
677
+ # docker creates /.dockerenv
678
+ # http://stackoverflow.com/a/25518345
679
+ [ -f "/.dockerenv" ] && return 0
680
+
681
+ # ubuntu and debian supply /bin/running-in-container
682
+ # https://www.apt-browse.org/browse/ubuntu/trusty/main/i386/upstart/1.12.1-0ubuntu4/file/bin/running-in-container
683
+ if [ -x "/bin/running-in-container" ]
684
+ then
685
+ "/bin/running-in-container" >/dev/null 2>&1 && return 0
686
+ fi
687
+
688
+ return 1
689
+}
690
+
691
run find ./system/ -type f -a \! -name \*.in -a \! -name Makefile\* -a \! -name \*.conf -a \! -name \*.service -a \! -name \*.logrotate -exec chmod 755 {} \;
692
693
NETDATA_ADDED_TO_DOCKER=0
@@ -790,27 +821,34 @@ do
821
#run find "${x}" -type d -exec chmod 0770 {} \;
822
done
823
793
-run chown "${NETDATA_USER}:root" "${NETDATA_LOG_DIR}"
824
run chmod 755 "${NETDATA_LOG_DIR}"
825
826
# --- plugins ----
827
828
if [ ${UID} -eq 0 ]
829
then
830
+ run chown "${NETDATA_USER}:root" "${NETDATA_LOG_DIR}"
831
run chown -R root "${NETDATA_PREFIX}/usr/libexec/netdata"
832
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type d -exec chmod 0755 {} \;
833
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -exec chmod 0644 {} \;
834
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -a -name \*.plugin -exec chmod 0755 {} \;
835
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -a -name \*.sh -exec chmod 0755 {} \;
836
806
- run setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
807
- if [ $? -ne 0 ]
837
+ setcap_ret=1
838
+ if ! iscontainer
839
+ then
840
+ run setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
841
+ setcap_ret=$?
842
+ fi
843
+
844
+ if [ ${setcap_ret} -ne 0 ]
845
then
846
# fix apps.plugin to be setuid to root
847
run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
848
run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin"
849
fi
850
else
851
+ run chown "${NETDATA_USER}:${NETDATA_USER}" "${NETDATA_LOG_DIR}"
852
run chown -R "${NETDATA_USER}:${NETDATA_USER}" "${NETDATA_PREFIX}/usr/libexec/netdata"
853
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -exec chmod 0755 {} \;
854
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type d -exec chmod 0755 {} \;