Fix install permissions (#7632)
* Fix ownership and permissions in RPM packages. This restructures things so that we're relying as much as possible on the `make install` command, which gets the ownership and permissions right in most cases. It does not change any of the capabilities afforded to various commands, those need further investigation to be set correctly. * Use correct perms and owners in installer script. This corrects the permissions and ownership of files as installed through the regular installer script (used for kickstart.sh installs).
Austin S. Hemmelgarn committed
Jan 24, 2020 at 07:19 UTC
de9a08df6cc8f8a9ec381564599ad0c8d3f4e352
2 files changed
+23
-30
netdata-installer.sh
+3
-6
@@ -681,9 +681,6 @@ for link in "orig" "${helplink}"; do
681
run ln -s "${NETDATA_STOCK_CONFIG_DIR}" "${NETDATA_USER_CONFIG_DIR}/${link}"
682
fi
683
done
684
-run chown -R "${ROOT_USER}:${NETDATA_GROUP}" "${NETDATA_STOCK_CONFIG_DIR}"
685
-run find "${NETDATA_STOCK_CONFIG_DIR}" -type f -exec chmod 0640 {} \;
686
-run find "${NETDATA_STOCK_CONFIG_DIR}" -type d -exec chmod 0755 {} \;
684
685
# --- web dir ----
686
@@ -729,7 +726,7 @@ if [ "${UID}" -eq 0 ]; then
726
test -z "${admin_group}" && admin_group="${NETDATA_GROUP}"
727
728
run chown "${NETDATA_USER}:${admin_group}" "${NETDATA_LOG_DIR}"
732
- run chown -R "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata"
729
+ run chown -R "root:${admin_group}" "${NETDATA_PREFIX}/usr/libexec/netdata"
730
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type d -exec chmod 0755 {} \;
731
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -exec chmod 0644 {} \;
732
run find "${NETDATA_PREFIX}/usr/libexec/netdata" -type f -a -name \*.plugin -exec chmod 0750 {} \;
@@ -789,7 +786,7 @@ if [ "${UID}" -eq 0 ]; then
786
787
if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/cgroup-network-helper.sh" ]; then
788
run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/cgroup-network-helper.sh"
792
- run chmod 0550 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/cgroup-network-helper.sh"
789
+ run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/cgroup-network-helper.sh"
790
fi
791
792
else
@@ -871,7 +868,7 @@ install_go() {
868
run rm -rf "${NETDATA_STOCK_CONFIG_DIR}/go.d"
869
run rm -rf "${NETDATA_STOCK_CONFIG_DIR}/go.d.conf"
870
run tar -xf "${tmp}/config.tar.gz" -C "${NETDATA_STOCK_CONFIG_DIR}/"
874
- run chown -R "${ROOT_USER}:${NETDATA_GROUP}" "${NETDATA_STOCK_CONFIG_DIR}"
871
+ run chown -R "${ROOT_USER}:${ROOT_GROUP}" "${NETDATA_STOCK_CONFIG_DIR}"
872
873
run tar xf "${tmp}/${GO_PACKAGE_BASENAME}"
874
run mv "${GO_PACKAGE_BASENAME/\.tar\.gz/}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/go.d.plugin"
netdata.spec.in
+20
-24
@@ -394,7 +394,7 @@ install_go() {
394
return 0
395
}
396
install_go
397
-install -m 0640 -p go.d.plugin "${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/plugins.d/go.d.plugin"
397
+install -m 0750 -p go.d.plugin "${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/plugins.d/go.d.plugin"
398
399
%pre
400
@@ -421,22 +421,22 @@ rm -rf "${RPM_BUILD_ROOT}"
421
%doc README.md
422
%{_sysconfdir}/%{name}
423
%config(noreplace) %{_sysconfdir}/%{name}/netdata.conf
424
-
425
-%defattr(-,root,netdata)
426
-%dir %{_libdir}/%{name}
427
-
424
%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
429
-
425
+%dir %{_libdir}/%{name}
426
+%dir %{_datadir}/%{name}
427
%{_libdir}/%{name}
431
-
432
-%defattr(0755,netdata,netdata,0755)
428
+%{_libdir}/%{name}/conf.d/
429
%{_libexecdir}/%{name}
430
%{_sbindir}/%{name}
435
-
436
-%defattr(0755,root,root,0755)
431
%{_sbindir}/netdatacli
432
%{_sbindir}/netdata-claim.sh
433
434
+%if %{with systemd}
435
+%{_unitdir}/netdata.service
436
+%else
437
+%{_sysconfdir}/rc.d/init.d/netdata
438
+%endif
439
+
440
%defattr(4750,root,netdata,0750)
441
442
%dir %{_libexecdir}/%{name}/python.d
@@ -444,34 +444,28 @@ rm -rf "${RPM_BUILD_ROOT}"
444
%dir %{_libexecdir}/%{name}/plugins.d
445
%dir %{_libexecdir}/%{name}/node.d
446
447
-%caps(cap_dac_read_search,cap_sys_ptrace=ep) %attr(0550,root,netdata) %{_libexecdir}/%{name}/plugins.d/apps.plugin
447
+%{_libexecdir}/%{name}/python.d
448
+%{_libexecdir}/%{name}/plugins.d
449
+%{_libexecdir}/%{name}/node.d
450
+
451
+%caps(cap_dac_read_search,cap_sys_ptrace=ep) %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/apps.plugin
452
453
%if %{with netns}
454
# cgroup-network detects the network interfaces of CGROUPs
455
# it must be able to use setns() and run cgroup-network-helper.sh as root
456
# the helper script reads /proc/PID/fdinfo/* files, runs virsh, etc.
453
-%caps(cap_setuid=ep) %attr(4550,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network
454
-%attr(0550,root,root) %{_libexecdir}/%{name}/plugins.d/cgroup-network-helper.sh
457
+%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network
458
+%attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network-helper.sh
459
%endif
460
461
# perf plugin
462
%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/perf.plugin
463
464
# perf plugin
461
-%caps(cap_setuid=ep) %attr(4550,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin
465
+%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin
466
467
# freeipmi files
468
%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
465
-%dir %{_datadir}/%{name}
466
-
467
-%defattr(0750,netdata,netdata,0755)
468
-%{_libdir}/%{name}/conf.d/
469
-
470
-%if %{with systemd}
471
-%{_unitdir}/netdata.service
472
-%else
473
-%{_sysconfdir}/rc.d/init.d/netdata
474
-%endif
469
470
# Enforce 0644 for files and 0755 for directories
471
# for the netdata web directory
@@ -522,6 +516,8 @@ are sensor monitoring, system event monitoring, power control, and serial-over-L
516
%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin
517
518
%changelog
519
+* Thu Dec 19 2019 Austin Hemmelgarn <austin@netdata.cloud> 0.0.0-11
520
+- Fix remaining ownership and permissions issues.
521
* Mon Nov 04 2019 Konstantinos Natsakis <konstantinos.natsakis@gmail.com> 0.0.0-10
522
- Fix /etc/netdata permissions
523
* Mon Sep 23 2019 Konstantinos Natsakis <konstantinos.natsakis@gmail.com> 0.0.0-9