samba: properly check if it is allowed to run smbstatus with su… (#7655)
* samba: use `sudo -n -l COMMAND` instead of `sudo -v` to check whether we allowed to run the COMMAND * ExecutableService: log executable command
Ilya Mashchenko committed
Jan 3, 2020 at 20:51 UTC
ffec4da201f034b0f5e6bd12038c13a5c6588e62
2 files changed
+20
-12
collectors/python.d.plugin/python_modules/bases/FrameworkServices/ExecutableService.py
+5
-3
@@ -22,12 +22,14 @@ class ExecutableService(SimpleService):
22
Get raw data from executed command
23
:return: <list>
24
"""
25
+ command = command or self.command
26
+ self.debug("Executing command '{0}'".format(' '.join(command)))
27
try:
26
- p = Popen(command if command else self.command, stdout=PIPE, stderr=PIPE)
28
+ p = Popen(command, stdout=PIPE, stderr=PIPE)
29
except Exception as error:
28
- self.error('Executing command {command} resulted in error: {error}'.format(command=command or self.command,
29
- error=error))
30
+ self.error('Executing command {0} resulted in error: {1}'.format(command, error))
31
return None
32
+
33
data = list()
34
std = p.stderr if stderr else p.stdout
35
for line in std:
collectors/python.d.plugin/samba/samba.chart.py
+15
-9
@@ -21,7 +21,6 @@ import re
21
from bases.collection import find_binary
22
from bases.FrameworkServices.ExecutableService import ExecutableService
23
24
-
24
disabled_by_default = True
25
26
update_every = 5
@@ -96,6 +95,9 @@ CHARTS = {
95
}
96
}
97
98
+SUDO = 'sudo'
99
+SMBSTATUS = 'smbstatus'
100
+
101
102
class Service(ExecutableService):
103
def __init__(self, configuration=None, name=None):
@@ -105,20 +107,24 @@ class Service(ExecutableService):
107
self.rgx_smb2 = re.compile(r'(smb2_[^:]+|syscall_.*file_bytes):\s+(\d+)')
108
109
def check(self):
108
- sudo_binary, smbstatus_binary = find_binary('sudo'), find_binary('smbstatus')
110
+ sudo_binary = find_binary(SUDO)
111
+ if not sudo_binary:
112
+ self.error("can't locate '{0}' binary".format(SUDO))
113
+ return False
114
110
- if not (sudo_binary and smbstatus_binary):
111
- self.error("Can\'t locate 'sudo' or 'smbstatus' binary")
115
+ smbstatus_binary = find_binary(SMBSTATUS)
116
+ if not smbstatus_binary:
117
+ self.error("can't locate '{0}' binary".format(SMBSTATUS))
118
return False
119
114
- self.command = [sudo_binary, '-v']
115
- err = self._get_raw_data(stderr=True)
116
- if err:
117
- self.error(''.join(err))
120
+ command = [sudo_binary, '-n', '-l', smbstatus_binary, '-P']
121
+ smbstatus = '{0} -P'.format(smbstatus_binary)
122
+ allowed = self._get_raw_data(command=command)
123
+ if not (allowed and allowed[0].strip() == smbstatus):
124
+ self.error("not allowed to run sudo for command '{0}'".format(smbstatus))
125
return False
126
127
self.command = ' '.join([sudo_binary, '-n', smbstatus_binary, '-P'])
121
-
128
return ExecutableService.check(self)
129
130
def _get_data(self):