diff options
| author | Ilya Mashchenko <ilya@netdata.cloud> | 2023-08-04 16:11:28 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-04 16:11:28 +0300 |
| commit | 4611cbbcb3d78e8f9ab19e91d0781faddf6a02c3 (patch) | |
| tree | 3e3c2ecbb2de83efadabee853e916d23b0b3636f /netdata-installer.sh | |
| parent | 326e3e4687b7412c787b7331293859c1998ef4ec (diff) | |
prefer cap over setuid for sysetmd-journal in installer (#15741)
Diffstat (limited to 'netdata-installer.sh')
| -rwxr-xr-x | netdata-installer.sh | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/netdata-installer.sh b/netdata-installer.sh index 414ce7cd51..e5fe2998bf 100755 --- a/netdata-installer.sh +++ b/netdata-installer.sh @@ -1239,6 +1239,21 @@ if [ "$(id -u)" -eq 0 ]; then fi fi + if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then + run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" + capabilities=0 + if ! iscontainer && command -v setcap 1> /dev/null 2>&1; then + run chmod 0750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" + if run setcap cap_dac_read_search+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin"; then + capabilities=1 + fi + fi + + if [ $capabilities -eq 0 ]; then + run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" + fi + fi + if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin" ]; then run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin" run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/freeipmi.plugin" @@ -1291,10 +1306,6 @@ if [ "$(id -u)" -eq 0 ]; then run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/local-listeners" fi - if [ -f "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then - run chown "root:${NETDATA_GROUP}" "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" - run chmod 4750 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/systemd-journal.plugin" - fi else # non-privileged user installation run chown "${NETDATA_USER}:${NETDATA_GROUP}" "${NETDATA_LOG_DIR}" |