fix(packaging): add CAP_NET_ADMIN for go.d.plugin (#13507)
Ilya Mashchenko committed
Aug 11, 2022 at 18:57 UTC
80e9a6992f315deb196c9726ed6303aefeac9ebd
4 files changed
+14
contrib/debian/netdata.postinst
+4
@@ -63,6 +63,10 @@ case "$1" in
63
setcap cap_sys_admin+ep /usr/libexec/netdata/plugins.d/perf.plugin
64
fi
65
66
+ if [ -f "/usr/libexec/netdata/plugins.d/go.d.plugin" ]; then
67
+ setcap cap_net_admin+epi /usr/libexec/netdata/plugins.d/go.d.plugin
68
+ fi
69
+
70
chmod 4750 /usr/libexec/netdata/plugins.d/cgroup-network
71
chmod 4750 /usr/libexec/netdata/plugins.d/nfacct.plugin
72
netdata-installer.sh
+3
@@ -1443,6 +1443,9 @@ install_go() {
1443
run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/go.d.plugin"
1444
fi
1445
run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/go.d.plugin"
1446
+ if command -v setcap 1>/dev/null 2>&1; then
1447
+ run setcap cap_net_admin+epi "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/go.d.plugin"
1448
+ fi
1449
rm -rf "${tmp}"
1450
1451
[ -n "${GITHUB_ACTIONS}" ] && echo "::endgroup::"
netdata.spec.in
+3
@@ -515,6 +515,9 @@ rm -rf "${RPM_BUILD_ROOT}"
515
# freeipmi files
516
%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
517
518
+# go.d.plugin (the capability required for wireguard module)
519
+%caps(cap_net_admin=epi) %{_libexecdir}/%{name}/plugins.d/go.d.plugin
520
+
521
# Enforce 0644 for files and 0755 for directories
522
# for the netdata web directory
523
%defattr(0644,root,root,0755)
packaging/makeself/install-or-update.sh
+4
@@ -214,6 +214,10 @@ for x in apps.plugin freeipmi.plugin ioping cgroup-network ebpf.plugin perf.plug
214
fi
215
done
216
217
+if [ -f "usr/libexec/netdata/plugins.d/go.d.plugin" ] && command -v setcap 1>/dev/null 2>&1; then
218
+ run setcap cap_net_admin+epi "usr/libexec/netdata/plugins.d/go.d.plugin"
219
+fi
220
+
221
# fix the fping binary
222
if [ -f bin/fping ]; then
223
run chown root:${NETDATA_GROUP} bin/fping