cleanup netdata.service - fixes #773; netdata now verifies it has to its required directories before starting
Costa Tsaousis committed
Aug 16, 2016 at 02:36 UTC
f78f32cd77f28a251d3a9a5f7423b2745ceaefa1
3 files changed
+39
-56
src/main.c
+37
-19
@@ -262,6 +262,17 @@ void remove_option(int opt_index, int *argc, char **argv) {
262
} while(argv[i][0] != '-' && opt_index >= *argc);
263
}
264
265
+static const char *verify_required_directory(const char *dir) {
266
+ if(chdir(dir) == -1)
267
+ fatal("Cannot cd to directory '%s'", dir);
268
+
269
+ DIR *d = opendir(dir);
270
+ if(!d)
271
+ fatal("Cannot examine the contents of directory '%s'", dir);
272
+ closedir(d);
273
+
274
+ return dir;
275
+}
276
277
int main(int argc, char **argv)
278
{
@@ -396,35 +407,42 @@ int main(int argc, char **argv)
407
}
408
}
409
399
- if(!config_loaded) load_config(NULL, 0);
410
+ if(!config_loaded)
411
+ load_config(NULL, 0);
412
401
- // prepare configuration environment variables for the plugins
402
- setenv("NETDATA_CONFIG_DIR" , config_get("global", "config directory" , CONFIG_DIR) , 1);
403
- setenv("NETDATA_PLUGINS_DIR", config_get("global", "plugins directory" , PLUGINS_DIR), 1);
404
- setenv("NETDATA_WEB_DIR" , config_get("global", "web files directory", WEB_DIR) , 1);
405
- setenv("NETDATA_CACHE_DIR" , config_get("global", "cache directory" , CACHE_DIR) , 1);
406
- setenv("NETDATA_LIB_DIR" , config_get("global", "lib directory" , VARLIB_DIR) , 1);
407
- setenv("NETDATA_LOG_DIR" , config_get("global", "log directory" , LOG_DIR) , 1);
408
- setenv("NETDATA_HOST_PREFIX", config_get("global", "host access prefix" , "") , 1);
409
- setenv("HOME" , config_get("global", "home directory" , CACHE_DIR) , 1);
413
+ {
414
+ char *config_dir = config_get("global", "config directory", CONFIG_DIR);
415
411
- // disable buffering for python plugins
412
- setenv("PYTHONUNBUFFERED", "1", 1);
416
+ // prepare configuration environment variables for the plugins
417
+ setenv("NETDATA_CONFIG_DIR" , verify_required_directory(config_dir) , 1);
418
+ setenv("NETDATA_PLUGINS_DIR", verify_required_directory(config_get("global", "plugins directory" , PLUGINS_DIR)), 1);
419
+ setenv("NETDATA_WEB_DIR" , verify_required_directory(config_get("global", "web files directory", WEB_DIR)) , 1);
420
+ setenv("NETDATA_CACHE_DIR" , verify_required_directory(config_get("global", "cache directory" , CACHE_DIR)) , 1);
421
+ setenv("NETDATA_LIB_DIR" , verify_required_directory(config_get("global", "lib directory" , VARLIB_DIR)) , 1);
422
+ setenv("NETDATA_LOG_DIR" , verify_required_directory(config_get("global", "log directory" , LOG_DIR)) , 1);
423
414
- // avoid flood calls to stat(/etc/localtime)
415
- // http://stackoverflow.com/questions/4554271/how-to-avoid-excessive-stat-etc-localtime-calls-in-strftime-on-linux
416
- setenv("TZ", ":/etc/localtime", 0);
424
+ setenv("NETDATA_HOST_PREFIX", config_get("global", "host access prefix" , "") , 1);
425
+ setenv("HOME" , config_get("global", "home directory" , CACHE_DIR) , 1);
426
+
427
+ // disable buffering for python plugins
428
+ setenv("PYTHONUNBUFFERED", "1", 1);
429
+
430
+ // avoid flood calls to stat(/etc/localtime)
431
+ // http://stackoverflow.com/questions/4554271/how-to-avoid-excessive-stat-etc-localtime-calls-in-strftime-on-linux
432
+ setenv("TZ", ":/etc/localtime", 0);
433
+
434
+ // work while we are cd into config_dir
435
+ // to allow the plugins refer to their config
436
+ // files using relative filenames
437
+ if(chdir(config_dir) == -1)
438
+ fatal("Cannot cd to '%s'", config_dir);
439
418
- {
440
char path[1024 + 1], *p = getenv("PATH");
441
if(!p) p = "/bin:/usr/bin";
442
snprintfz(path, 1024, "%s:%s", p, "/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
443
setenv("PATH", config_get("plugins", "PATH environment variable", path), 1);
444
}
445
425
- // cd to /tmp to avoid any plugins writing files at random places
426
- if(chdir("/tmp")) error("netdata: ERROR: Cannot cd to /tmp");
427
-
446
char *user = NULL;
447
{
448
char *flags = config_get("global", "debug flags", "0x00000000");
src/registry.c
+2
-8
@@ -1612,16 +1612,10 @@ int registry_init(void) {
1612
// registry enabled?
1613
registry.enabled = config_get_boolean("registry", "enabled", 0);
1614
1615
- if(mkdir(VARLIB_DIR, 0755) == -1 && errno != EEXIST)
1616
- error("Cannot create directory '" VARLIB_DIR "'");
1617
-
1615
// pathnames
1616
registry.pathname = config_get("registry", "registry db directory", VARLIB_DIR "/registry");
1620
- if(mkdir(registry.pathname, 0755) == -1 && errno != EEXIST) {
1621
- error("Cannot create directory '%s'. Registry disabled.", registry.pathname);
1622
- registry.enabled = 0;
1623
- return -1;
1624
- }
1617
+ if(mkdir(registry.pathname, 0770) == -1 && errno != EEXIST)
1618
+ fatal("Cannot create directory '%s'.", registry.pathname);
1619
1620
// filenames
1621
snprintfz(filename, FILENAME_MAX, "%s/netdata.public.unique.id", registry.pathname);
system/netdata.service.in
-29
@@ -4,41 +4,12 @@ After=network.target httpd.service squid.service nfs-server.service mysqld.servi
4
5
[Service]
6
Type=simple
7
-WorkingDirectory=/tmp
7
User=netdata
8
Group=netdata
10
-RuntimeDirectory=netdata
9
ExecStart=@sbindir_POST@/netdata -D
10
13
-# -----------------------------------------------------------------------------
14
-# Stopping netdata
15
-
16
-KillMode=mixed
17
-KillSignal=SIGTERM
18
-
11
# saving a big db on slow disks may need some time
12
TimeoutStopSec=60
13
22
-# and disable SIGKILL - if sent during save, we will loose the db
23
-SendSIGKILL=no
24
-
25
-# -----------------------------------------------------------------------------
26
-# Hardening netdata
27
-
28
-# These will apply these capabilities to the entire netdata process tree
29
-# We don't want this - only apps.plugin needs them
30
-# AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
31
-# CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
32
-
33
-PrivateTmp=true
34
-ProtectSystem=full
35
-ProtectHome=read-only
36
-
37
-# is implicitly set by the MemoryDenyWriteExecute=true
38
-# NoNewPrivileges=true
39
-
40
-# Do not enable - it makes node.js plugins to crash
41
-# MemoryDenyWriteExecute=true
42
-
14
[Install]
15
WantedBy=multi-user.target