charts.d/libreswan: fix sudo check (#8569)
If libreswan_sudo parameter is set (which is default) netdata executes ipsec with sudo without checking if it has permissions to do it. As a result a user receives security notices on daily bases: user NOT in sudoers ; TTY=unknown ; PWD=/etc/netdata ; USER=root ; COMMAND=/usr/sbin/ipsec whack --trafficstatus This PR adds the check.
Ilya Mashchenko committed
Apr 6, 2020 at 10:05 UTC
fe2273567a56d22a551c0becd3fef16696e87e8c
1 file changed
+15
collectors/charts.d.plugin/libreswan/libreswan.chart.sh
+15
@@ -37,6 +37,16 @@ declare -A libreswan_established_add_time=()
37
# we need this to avoid converting tunnel names to chart IDs on every iteration
38
declare -A libreswan_tunnel_charts=()
39
40
+is_able_sudo_ipsec() {
41
+ if ! sudo -n -l "${IPSEC_CMD}" whack --status > /dev/null 2>&1; then
42
+ return 1
43
+ fi
44
+ if ! sudo -n -l "${IPSEC_CMD}" whack --trafficstatus > /dev/null 2>&1; then
45
+ return 1
46
+ fi
47
+ return 0
48
+}
49
+
50
# run the ipsec command
51
libreswan_ipsec() {
52
if [ ${libreswan_sudo} -ne 0 ]; then
@@ -92,6 +102,11 @@ libreswan_check() {
102
return 1
103
fi
104
105
+ if [ ${libreswan_sudo} -ne 0 ] && ! is_able_sudo_ipsec; then
106
+ error "not enough permissions to execute ipsec with sudo. Disabling Libreswan plugin."
107
+ return 1
108
+ fi
109
+
110
# check that we can collect data
111
libreswan_get || return 1
112