Remove owner check from webserver (#12339)
thiagoftsm committed
Mar 14, 2022 at 15:41 UTC
bd7bc8b3f14b935731823cc101e1e5ed49c8b5fa
12 files changed
+8
-120
build_external/scenarios/aclk-testing/agent_netdata.conf
-2
@@ -60,8 +60,6 @@
60
# listen backlog = 4096
61
# default port = 19999
62
# bind to = *
63
- # web files owner = netdata
64
- # web files group = netdata
63
# disconnect idle clients after seconds = 60
64
# timeout for first request = 60
65
# accept a streaming request every seconds = 0
contrib/debian/netdata.postinst
-2
@@ -50,9 +50,7 @@ case "$1" in
50
51
dpkg-statoverride --force --update --add root netdata 0775 /var/lib/netdata/registry > /dev/null 2>&1
52
53
- chown -R root:netdata /usr/share/netdata
53
chown -R root:netdata /usr/libexec/netdata/plugins.d
55
- chown -R root:netdata /var/lib/netdata/www
54
setcap cap_dac_read_search,cap_sys_ptrace+ep /usr/libexec/netdata/plugins.d/apps.plugin
55
setcap cap_dac_read_search+ep /usr/libexec/netdata/plugins.d/slabinfo.plugin
56
capsh --supports=cap_perfmon 2>/dev/null && setcap cap_perfmon+ep /usr/libexec/netdata/plugins.d/perf.plugin || setcap cap_sys_admin+ep /usr/libexec/netdata/plugins.d/perf.plugin
daemon/main.c
-5
@@ -1212,11 +1212,6 @@ int main(int argc, char **argv) {
1212
1213
info("netdata started on pid %d.", getpid());
1214
1215
- // IMPORTANT: these have to run once, while single threaded
1216
- // but after we have switched user
1217
- web_files_uid();
1218
- web_files_gid();
1219
-
1215
netdata_threads_init_after_fork((size_t)config_get_number(CONFIG_SECTION_GLOBAL, "pthread stack size", (long)default_stacksize));
1216
1217
// initialize internal registry
netdata-installer.sh
-12
@@ -1298,15 +1298,6 @@ NETDATA_GROUP="$(id -g -n "${NETDATA_USER}")"
1298
[ -z "${NETDATA_GROUP}" ] && NETDATA_GROUP="${NETDATA_USER}"
1299
echo >&2 "Netdata user and group is finally set to: ${NETDATA_USER}/${NETDATA_GROUP}"
1300
1301
-# the owners of the web files
1302
-NETDATA_WEB_USER="$(config_option "web" "web files owner" "${NETDATA_USER}")"
1303
-NETDATA_WEB_GROUP="${NETDATA_GROUP}"
1304
-if [ "$(id -u)" = "0" ] && [ "${NETDATA_USER}" != "${NETDATA_WEB_USER}" ]; then
1305
- NETDATA_WEB_GROUP="$(id -g -n "${NETDATA_WEB_USER}")"
1306
- [ -z "${NETDATA_WEB_GROUP}" ] && NETDATA_WEB_GROUP="${NETDATA_WEB_USER}"
1307
-fi
1308
-NETDATA_WEB_GROUP="$(config_option "web" "web files group" "${NETDATA_WEB_GROUP}")"
1309
-
1301
# port
1302
defport=19999
1303
NETDATA_PORT="$(config_option "web" "default port" ${defport})"
@@ -1326,8 +1317,6 @@ cat << OPTIONSEOF
1317
Permissions
1318
- netdata user : ${NETDATA_USER}
1319
- netdata group : ${NETDATA_GROUP}
1329
- - web files user : ${NETDATA_WEB_USER}
1330
- - web files group : ${NETDATA_WEB_GROUP}
1320
- root user : ${ROOT_USER}
1321
1322
Directories
@@ -1372,7 +1361,6 @@ if [ ! -d "${NETDATA_WEB_DIR}" ]; then
1361
echo >&2 "Creating directory '${NETDATA_WEB_DIR}'"
1362
run mkdir -p "${NETDATA_WEB_DIR}" || exit 1
1363
fi
1375
-run chown -R "${NETDATA_WEB_USER}:${NETDATA_WEB_GROUP}" "${NETDATA_WEB_DIR}"
1364
run find "${NETDATA_WEB_DIR}" -type f -exec chmod 0664 {} \;
1365
run find "${NETDATA_WEB_DIR}" -type d -exec chmod 0775 {} \;
1366
netdata.spec.in
+1
-1
@@ -517,7 +517,7 @@ rm -rf "${RPM_BUILD_ROOT}"
517
518
# Enforce 0644 for files and 0755 for directories
519
# for the netdata web directory
520
-%defattr(0644,root,netdata,0755)
520
+%defattr(0644,root,root,0755)
521
%{_datadir}/%{name}/web
522
523
# Enforce 0660 for files and 0770 for directories
packaging/installer/README.md
+7
-12
@@ -188,26 +188,21 @@ visit the Agent dashboard at `http://NODE:19999`, you need to update Netdata's p
188
system.
189
190
Run `ls -la /usr/share/netdata/web/index.html` to find the file's permissions. You may need to change this path based on
191
-the error you're seeing in your browser. In the below example, the file is owned by the user `netdata` and the group
192
-`netdata`.
191
+the error you're seeing in your browser. In the below example, the file is owned by the user `root` and the group
192
+`root`.
193
194
```bash
195
ls -la /usr/share/netdata/web/index.html
196
--rw-r--r--. 1 netdata netdata 89377 May 5 06:30 /usr/share/netdata/web/index.html
196
+-rw-r--r--. 1 root root 89377 May 5 06:30 /usr/share/netdata/web/index.html
197
```
198
199
-Open your `netdata.conf` file and find the `[web]` section, plus the `web files owner`/`web files group` settings. Edit
200
-the lines to match the output from `ls -la` above and uncomment them if necessary.
199
+These files need to have the same user and group used to install your netdata. Suppose you installed netdata with user
200
+`netdata` and group `netdata`, in this scenario you will need to run the following command to fix the error:
201
202
-```conf
203
-[web]
204
- web files owner = netdata
205
- web files group = netdata
202
+```bash
203
+# chown -R netdata.netdata /usr/share/netdata/web
204
```
205
208
-Save the file, restart Netdata using `sudo systemctl restart netdata`, or the [appropriate
209
-method](/docs/configure/start-stop-restart.md) for your system, and try accessing the dashboard again.
210
-
206
### Multiple versions of OpenSSL
207
208
We've received reports from the community about issues with running the `kickstart.sh` script on systems that have both
system/netdata.conf
-3
@@ -20,6 +20,3 @@
20
process scheduling policy = idle
21
OOM score = 1000
22
23
-[web]
24
- web files owner = root
25
- web files group = netdata
tests/alarm_repetition/netdata.conf_with_repetition
-2
@@ -22,8 +22,6 @@
22
# listen backlog = 4096
23
default port = 19999
24
#bind to = *=dashboard|registry|streaming|netdata.conf|badges|management *:20000=dashboard|registry|streaming|netdata.conf|badges|management^SSL=optional *:20001=dashboard|registry|streaming|netdata.conf|badges|management^SSL=force unix:/tmp/netdata/netdata.sock
25
- # web files owner = netdata
26
- # web files group = netdata
25
#accept a streaming request every seconds = 2
26
27
[plugins]
tests/alarm_repetition/netdata.conf_without_repetition
-2
@@ -22,8 +22,6 @@
22
# listen backlog = 4096
23
default port = 19999
24
#bind to = *=dashboard|registry|streaming|netdata.conf|badges|management *:20000=dashboard|registry|streaming|netdata.conf|badges|management^SSL=optional *:20001=dashboard|registry|streaming|netdata.conf|badges|management^SSL=force unix:/tmp/netdata/netdata.sock
25
- # web files owner = netdata
26
- # web files group = netdata
25
#accept a streaming request every seconds = 2
26
27
[plugins]
web/server/README.md
-2
@@ -221,8 +221,6 @@ present that may match DNS FQDNs.
221
|ses max window|`15`|See [single exponential smoothing](/web/api/queries/des/README.md)|
222
|des max window|`15`|See [double exponential smoothing](/web/api/queries/des/README.md)|
223
|listen backlog|`4096`|The port backlog. Check `man 2 listen`.|
224
-|web files owner|`netdata`|The user that owns the web static files. Netdata will refuse to serve a file that is not owned by this user, even if it has read access to that file. If the user given is not found, Netdata will only serve files owned by user given in `run as user`.|
225
-|web files group|`netdata`|If this is set, Netdata will check if the file is owned by this group and refuse to serve the file if it's not.|
224
|disconnect idle clients after seconds|`60`|The time in seconds to disconnect web clients after being totally idle.|
225
|timeout for first request|`60`|How long to wait for a client to send a request before closing the socket. Prevents slow request attacks.|
226
|accept a streaming request every seconds|`0`|Can be used to set a limit on how often a parent node will accept streaming requests from child nodes in a [streaming and replication setup](/streaming/README.md)|
web/server/web_client.c
-74
@@ -204,68 +204,6 @@ void web_client_request_done(struct web_client *w) {
204
#endif // NETDATA_WITH_ZLIB
205
}
206
207
-uid_t web_files_uid(void) {
208
- static char *web_owner = NULL;
209
- static uid_t owner_uid = 0;
210
-
211
- if(unlikely(!web_owner)) {
212
- // getpwuid() is not thread safe,
213
- // but we have called this function once
214
- // while single threaded
215
- struct passwd *pw = getpwuid(geteuid());
216
- web_owner = config_get(CONFIG_SECTION_WEB, "web files owner", (pw)?(pw->pw_name?pw->pw_name:""):"");
217
- if(!web_owner || !*web_owner)
218
- owner_uid = geteuid();
219
- else {
220
- // getpwnam() is not thread safe,
221
- // but we have called this function once
222
- // while single threaded
223
- pw = getpwnam(web_owner);
224
- if(!pw) {
225
- error("User '%s' is not present. Ignoring option.", web_owner);
226
- owner_uid = geteuid();
227
- }
228
- else {
229
- debug(D_WEB_CLIENT, "Web files owner set to %s.", web_owner);
230
- owner_uid = pw->pw_uid;
231
- }
232
- }
233
- }
234
-
235
- return(owner_uid);
236
-}
237
-
238
-gid_t web_files_gid(void) {
239
- static char *web_group = NULL;
240
- static gid_t owner_gid = 0;
241
-
242
- if(unlikely(!web_group)) {
243
- // getgrgid() is not thread safe,
244
- // but we have called this function once
245
- // while single threaded
246
- struct group *gr = getgrgid(getegid());
247
- web_group = config_get(CONFIG_SECTION_WEB, "web files group", (gr)?(gr->gr_name?gr->gr_name:""):"");
248
- if(!web_group || !*web_group)
249
- owner_gid = getegid();
250
- else {
251
- // getgrnam() is not thread safe,
252
- // but we have called this function once
253
- // while single threaded
254
- gr = getgrnam(web_group);
255
- if(!gr) {
256
- error("Group '%s' is not present. Ignoring option.", web_group);
257
- owner_gid = getegid();
258
- }
259
- else {
260
- debug(D_WEB_CLIENT, "Web files group set to %s.", web_group);
261
- owner_gid = gr->gr_gid;
262
- }
263
- }
264
- }
265
-
266
- return(owner_gid);
267
-}
268
-
207
static struct {
208
const char *extension;
209
uint32_t hash;
@@ -399,18 +337,6 @@ int mysendfile(struct web_client *w, char *filename) {
337
return access_to_file_is_not_permitted(w, webfilename);
338
}
339
402
- // check if the file is owned by expected user
403
- if (statbuf.st_uid != web_files_uid()) {
404
- error("%llu: File '%s' is owned by user %u (expected user %u). Access Denied.", w->id, webfilename, statbuf.st_uid, web_files_uid());
405
- return access_to_file_is_not_permitted(w, webfilename);
406
- }
407
-
408
- // check if the file is owned by expected group
409
- if (statbuf.st_gid != web_files_gid()) {
410
- error("%llu: File '%s' is owned by group %u (expected group %u). Access Denied.", w->id, webfilename, statbuf.st_gid, web_files_gid());
411
- return access_to_file_is_not_permitted(w, webfilename);
412
- }
413
-
340
done = 1;
341
}
342
web/server/web_client.h
-3
@@ -194,9 +194,6 @@ struct web_client {
194
#endif
195
};
196
197
-extern uid_t web_files_uid(void);
198
-extern uid_t web_files_gid(void);
199
-
197
extern int web_client_permission_denied(struct web_client *w);
198
199
extern ssize_t web_client_send(struct web_client *w);