Fix permissions for systemd-journal.plugin on offline installs (#21953)
* Fix permissions for systemd-journal.plugin on offline installs * Try setcap before suid * systemd-journal.plugin is optional * systemd-journal.plugin is optional for the fallback, too * Use customary order of cap flags
Ralph Meijer committed
Mar 17, 2026 at 18:23 UTC
aa77c3a51c92e6f70c952780516c075cb7cb7ff3
1 file changed
+9
-1
packaging/makeself/install-or-update.sh
+9
-1
@@ -180,7 +180,7 @@ fi
180
181
progress "changing plugins ownership and permissions"
182
183
-for x in ndsudo apps.plugin perf.plugin slabinfo.plugin debugfs.plugin freeipmi.plugin ioping cgroup-network local-listeners network-viewer.plugin ebpf.plugin nfacct.plugin xenstat.plugin python.d.plugin charts.d.plugin go.d.plugin ioping.plugin cgroup-network-helper.sh otel-plugin otel-signal-viewer-plugin; do
183
+for x in ndsudo apps.plugin perf.plugin slabinfo.plugin debugfs.plugin freeipmi.plugin ioping cgroup-network local-listeners network-viewer.plugin ebpf.plugin nfacct.plugin xenstat.plugin python.d.plugin charts.d.plugin go.d.plugin ioping.plugin cgroup-network-helper.sh otel-plugin otel-signal-viewer-plugin systemd-journal.plugin; do
184
f="usr/libexec/netdata/plugins.d/${x}"
185
if [ -f "${f}" ]; then
186
run chown root:${NETDATA_GROUP} "${f}"
@@ -214,6 +214,11 @@ if command -v setcap >/dev/null 2>&1; then
214
run chmod 4750 "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin"
215
fi
216
fi
217
+ if [ -f "usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then
218
+ if ! run setcap "cap_dac_read_search=eip" "usr/libexec/netdata/plugins.d/systemd-journal.plugin"; then
219
+ run chmod 4750 "usr/libexec/netdata/plugins.d/systemd-journal.plugin"
220
+ fi
221
+ fi
222
else
223
for x in apps.plugin perf.plugin slabinfo.plugin debugfs.plugin; do
224
f="usr/libexec/netdata/plugins.d/${x}"
@@ -222,6 +227,9 @@ else
227
if [ -f "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin" ]; then
228
run chmod 4750 "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin"
229
fi
230
+ if [ -f "usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then
231
+ run chmod 4750 "usr/libexec/netdata/plugins.d/systemd-journal.plugin"
232
+ fi
233
fi
234
235
for x in ndsudo freeipmi.plugin ioping cgroup-network local-listeners network-viewer.plugin ebpf.plugin nfacct.plugin xenstat.plugin; do