Fixed handling of permissions for some plugins. (#10490)
* Removed pointless capabilities in our RPM spec file. * Shifted slabinfo and perf plugins to use proper capabilties instead of being SUID root.
Austin S. Hemmelgarn committed
Mar 12, 2021 at 09:23 UTC
6fb4f28fbe23803fcf347c66090e06f625b24c9d
4 files changed
+13
-11
contrib/debian/netdata.postinst
+2
-2
@@ -54,9 +54,9 @@ case "$1" in
54
chown -R root:netdata /usr/libexec/netdata/plugins.d
55
chown -R root:netdata /var/lib/netdata/www
56
setcap cap_dac_read_search,cap_sys_ptrace+ep /usr/libexec/netdata/plugins.d/apps.plugin
57
+ setcap cap_dac_read_search+ep /usr/libexec/netdata/plugins.d/slabinfo.plugin
58
+ setcap cap_perfmon+ep /usr/libexec/netdata/plugins.d/perf.plugin
59
58
- chmod 4750 /usr/libexec/netdata/plugins.d/perf.plugin
59
- chmod 4750 /usr/libexec/netdata/plugins.d/slabinfo.plugin
60
chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network
61
chmod 4750 /usr/libexec/netdata/plugins.d/nfacct.plugin
62
contrib/debian/rules
+3
-3
@@ -103,9 +103,9 @@ override_dh_fixperms:
103
# apps.plugin should only be runnable by the netdata user. It will be
104
# given extra capabilities in the postinst script.
105
#
106
- chmod 0754 $(TOP)/usr/libexec/netdata/plugins.d/apps.plugin
107
- chmod 0754 $(TOP)/usr/libexec/netdata/plugins.d/perf.plugin
108
- chmod 0754 $(TOP)/usr/libexec/netdata/plugins.d/slabinfo.plugin
106
+ chmod 0750 $(TOP)/usr/libexec/netdata/plugins.d/apps.plugin
107
+ chmod 0750 $(TOP)/usr/libexec/netdata/plugins.d/perf.plugin
108
+ chmod 0750 $(TOP)/usr/libexec/netdata/plugins.d/slabinfo.plugin
109
chmod 0750 $(TOP)/usr/libexec/netdata/plugins.d/go.d.plugin
110
111
# CUPS plugin package
netdata-installer.sh
+4
-2
@@ -1313,12 +1313,14 @@ if [ "${UID}" -eq 0 ]; then
1313
1314
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/perf.plugin" ]; then
1315
run chown root:${NETDATA_GROUP} "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/perf.plugin"
1316
- run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/perf.plugin"
1316
+ run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/perf.plugin"
1317
+ run setcap cap_perfmon+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/perf.plugin"
1318
fi
1319
1320
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/slabinfo.plugin" ]; then
1321
run chown root:${NETDATA_GROUP} "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/slabinfo.plugin"
1321
- run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/slabinfo.plugin"
1322
+ run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/slabinfo.plugin"
1323
+ run setcap cap_dac_read_search+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/slabinfo.plugin"
1324
fi
1325
1326
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/ioping" ]; then
netdata.spec.in
+4
-4
@@ -474,18 +474,18 @@ rm -rf "${RPM_BUILD_ROOT}"
474
# cgroup-network detects the network interfaces of CGROUPs
475
# it must be able to use setns() and run cgroup-network-helper.sh as root
476
# the helper script reads /proc/PID/fdinfo/* files, runs virsh, etc.
477
-%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network
477
+%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network
478
%attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network-helper.sh
479
%endif
480
481
# perf plugin
482
-%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/perf.plugin
482
+%caps(cap_perfmon=ep) %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/perf.plugin
483
484
# perf plugin
485
-%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin
485
+%caps(cap_dac_read_search=ep) %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin
486
487
# freeipmi files
488
-%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
488
+%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
489
490
# Enforce 0644 for files and 0755 for directories
491
# for the netdata web directory