@cryptotaxi247 / netdata-1 / commits / fe2273567

charts.d/libreswan: fix sudo check (#8569)

If libreswan_sudo parameter is set (which is default) netdata executes ipsec with sudo without checking if it has permissions to do it. As a result a user receives security notices on daily bases: user NOT in sudoers ; TTY=unknown ; PWD=/etc/netdata ; USER=root ; COMMAND=/usr/sbin/ipsec whack --trafficstatus This PR adds the check.

Ilya Mashchenko committed Apr 6, 2020 at 10:05 UTC fe2273567a56d22a551c0becd3fef16696e87e8c
1 file changed +15
collectors/charts.d.plugin/libreswan/libreswan.chart.sh
+15
@@ -37,6 +37,16 @@ declare -A libreswan_established_add_time=()
37 # we need this to avoid converting tunnel names to chart IDs on every iteration
38 declare -A libreswan_tunnel_charts=()
39
40 +is_able_sudo_ipsec() {
41 + if ! sudo -n -l "${IPSEC_CMD}" whack --status > /dev/null 2>&1; then
42 + return 1
43 + fi
44 + if ! sudo -n -l "${IPSEC_CMD}" whack --trafficstatus > /dev/null 2>&1; then
45 + return 1
46 + fi
47 + return 0
48 +}
49 +
50 # run the ipsec command
51 libreswan_ipsec() {
52 if [ ${libreswan_sudo} -ne 0 ]; then
@@ -92,6 +102,11 @@ libreswan_check() {
102 return 1
103 fi
104
105 + if [ ${libreswan_sudo} -ne 0 ] && ! is_able_sudo_ipsec; then
106 + error "not enough permissions to execute ipsec with sudo. Disabling Libreswan plugin."
107 + return 1
108 + fi
109 +
110 # check that we can collect data
111 libreswan_get || return 1
112