diff options
| author | Austin S. Hemmelgarn <austin@netdata.cloud> | 2021-03-12 09:23:57 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-12 09:23:57 -0500 |
| commit | 6fb4f28fbe23803fcf347c66090e06f625b24c9d (patch) | |
| tree | c5e28e424905a3dca8226576ad4bfe2504fee183 /netdata.spec.in | |
| parent | fe0c96e1c392cf48d8ec51f49aaec659f1d2017d (diff) | |
Fixed handling of permissions for some plugins. (#10490)
* Removed pointless capabilities in our RPM spec file.
* Shifted slabinfo and perf plugins to use proper capabilties instead of
being SUID root.
Diffstat (limited to 'netdata.spec.in')
| -rw-r--r-- | netdata.spec.in | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/netdata.spec.in b/netdata.spec.in index f55dcfe3d4..a84390ff17 100644 --- a/netdata.spec.in +++ b/netdata.spec.in @@ -474,18 +474,18 @@ rm -rf "${RPM_BUILD_ROOT}" # cgroup-network detects the network interfaces of CGROUPs # it must be able to use setns() and run cgroup-network-helper.sh as root # the helper script reads /proc/PID/fdinfo/* files, runs virsh, etc. -%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network +%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/cgroup-network-helper.sh %endif # perf plugin -%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/perf.plugin +%caps(cap_perfmon=ep) %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/perf.plugin # perf plugin -%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin +%caps(cap_dac_read_search=ep) %attr(0750,root,netdata) %{_libexecdir}/%{name}/plugins.d/slabinfo.plugin # freeipmi files -%caps(cap_setuid=ep) %attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin +%attr(4750,root,netdata) %{_libexecdir}/%{name}/plugins.d/freeipmi.plugin # Enforce 0644 for files and 0755 for directories # for the netdata web directory |