From 06c43af4d934e0ae890af83076f9fe56243bfdf9 Mon Sep 17 00:00:00 2001 From: Costa Tsaousis Date: Sat, 14 May 2016 00:10:38 +0300 Subject: [PATCH] apps.plugin now runs with linux capabilites instead of setuid to root --- CMakeLists.txt | 2 + netdata-installer.sh | 424 +++++++++++++++++++++++-------------------- src/Makefile.am | 9 +- 3 files changed, 235 insertions(+), 200 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 967df77e..76e0d8db 100755 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -57,6 +57,8 @@ set(NETDATA_SOURCE_FILES src/proc_stat.c src/proc_sys_kernel_random_entropy_avail.c src/proc_vmstat.c + src/registry.c + src/registry.h src/rrd2json.c src/rrd2json.h src/rrd.c diff --git a/netdata-installer.sh b/netdata-installer.sh index d8c073ae..3b094d44 100755 --- a/netdata-installer.sh +++ b/netdata-installer.sh @@ -30,48 +30,48 @@ NETDATA_PREFIX= ZLIB_IS_HERE=0 usage() { - cat < + ${ME} -Valid are: + Valid are: - --install /PATH/TO/INSTALL + --install /PATH/TO/INSTALL - If your give: --install /opt - netdata will be installed in /opt/netdata + If your give: --install /opt + netdata will be installed in /opt/netdata - --dont-start-it + --dont-start-it - Do not (re)start netdata. - Just install it. + Do not (re)start netdata. + Just install it. - --dont-wait + --dont-wait - Do not wait for the user to press ENTER. - Start immediately building it. + Do not wait for the user to press ENTER. + Start immediately building it. - --zlib-is-really-here + --zlib-is-really-here - If you get errors about missing zlib, - but you know it is available, - you have a broken pkg-config. - Use this option to allow it continue - without checking pkg-config. + If you get errors about missing zlib, + but you know it is available, + you have a broken pkg-config. + Use this option to allow it continue + without checking pkg-config. -Netdata will by default be compiled with gcc optimization -O3 -If you need to pass different CFLAGS, use something like this: + Netdata will by default be compiled with gcc optimization -O3 + If you need to pass different CFLAGS, use something like this: - CFLAGS="" $ME + CFLAGS="" ${ME} -For the installer to complete successfully, you will need -these packages installed: + For the installer to complete successfully, you will need + these packages installed: - gcc make autoconf automake pkg-config zlib1g-dev uuid-dev + gcc make autoconf automake pkg-config zlib1g-dev uuid-dev -For the plugins, you will at least need: + For the plugins, you will at least need: - curl node + curl nodejs USAGE } @@ -107,26 +107,26 @@ do fi done -cat <>netdata-installer.log "# " + printf >>netdata-installer.log "%q " "${@}" + printf >>netdata-installer.log " ... " + printf >&2 "\n" printf >&2 ":-----------------------------------------------------------------------------\n" printf >&2 "Running command:\n" printf >&2 "\n" printf >&2 "%q " "${@}" printf >&2 "\n" - printf >&2 "\n" "${@}" + + local ret=$? + if [ ${ret} -ne 0 ] + then + printf >>netdata-installer.log "FAILED!\n" + else + printf >>netdata-installer.log "OK\n" + fi + + return ${ret} } if [ ${ZLIB_IS_HERE} -eq 1 ] @@ -452,9 +465,15 @@ done if [ ${UID} -eq 0 ] then - # fix apps.plugin to be setuid to root run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" - run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" + run chmod 0755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" + run setcap cap_dac_read_search,cap_sys_ptrace+ep "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" + if [ $? -ne 0 ] + then + # fix apps.plugin to be setuid to root + run chown root "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" + run chmod 4755 "${NETDATA_PREFIX}/usr/libexec/netdata/plugins.d/apps.plugin" + fi fi # ----------------------------------------------------------------------------- @@ -487,6 +506,9 @@ isnetdata() { } +echo >&2 +echo >&2 "-------------------------------------------------------------------------------" +echo >&2 printf >&2 "Stopping a (possibly) running netdata..." ret=0 count=0 @@ -583,36 +605,36 @@ fi # Check for KSM ksm_is_available_but_disabled() { - cat </sys/kernel/mm/ksm/run -echo 1000 >/sys/kernel/mm/ksm/sleep_millisecs + echo 1 >/sys/kernel/mm/ksm/run + echo 1000 >/sys/kernel/mm/ksm/sleep_millisecs -If you enable it, you will save 40-60% of netdata memory. + If you enable it, you will save 40-60% of netdata memory. KSM1 } ksm_is_not_available() { - cat <netdata-uninstaller.sh <netdata-uninstaller.sh <<-UNINSTALL + #!/bin/bash -# this script will uninstall netdata + # this script will uninstall netdata -if [ "\$1" != "--force" ] - then - echo >&2 "This script will REMOVE netdata from your system." - echo >&2 "Run it again with --force to do it." - exit 1 -fi + if [ "\$1" != "--force" ] + then + echo >&2 "This script will REMOVE netdata from your system." + echo >&2 "Run it again with --force to do it." + exit 1 + fi + + echo >&2 "Stopping a possibly running netdata..." + killall netdata + sleep 2 -echo >&2 "Stopping a possibly running netdata..." -killall netdata -sleep 2 + deletedir() { + if [ ! -z "\$1" -a -d "\$1" ] + then + echo + echo "Deleting directory '\$1' ..." + rm -I -R "\$1" + fi + } -deletedir() { - if [ ! -z "\$1" -a -d "\$1" ] + if [ ! -z "${NETDATA_PREFIX}" -a -d "${NETDATA_PREFIX}" ] then - echo - echo "Deleting directory '\$1' ..." - rm -I -R "\$1" - fi -} + # installation prefix was given -if [ ! -z "${NETDATA_PREFIX}" -a -d "${NETDATA_PREFIX}" ] - then - # installation prefix was given + deletedir "${NETDATA_PREFIX}" - deletedir "${NETDATA_PREFIX}" + else + # installation prefix was NOT given -else - # installation prefix was NOT given + if [ -f "${NETDATA_PREFIX}/usr/sbin/netdata" ] + then + echo "Deleting ${NETDATA_PREFIX}/usr/sbin/netdata ..." + rm -i "${NETDATA_PREFIX}/usr/sbin/netdata" + fi - if [ -f "${NETDATA_PREFIX}/usr/sbin/netdata" ] - then - echo "Deleting ${NETDATA_PREFIX}/usr/sbin/netdata ..." - rm -i "${NETDATA_PREFIX}/usr/sbin/netdata" + deletedir "${NETDATA_PREFIX}/etc/netdata" + deletedir "${NETDATA_PREFIX}/usr/share/netdata" + deletedir "${NETDATA_PREFIX}/usr/libexec/netdata" + deletedir "${NETDATA_PREFIX}/var/lib/netdata" + deletedir "${NETDATA_PREFIX}/var/cache/netdata" + deletedir "${NETDATA_PREFIX}/var/log/netdata" fi - deletedir "${NETDATA_PREFIX}/etc/netdata" - deletedir "${NETDATA_PREFIX}/usr/share/netdata" - deletedir "${NETDATA_PREFIX}/usr/libexec/netdata" - deletedir "${NETDATA_PREFIX}/var/lib/netdata" - deletedir "${NETDATA_PREFIX}/var/cache/netdata" - deletedir "${NETDATA_PREFIX}/var/log/netdata" -fi - -getent passwd netdata > /dev/null -if [ $? -eq 0 ] - then - echo - echo "You may also want to remove the user netdata" - echo "by running:" - echo " userdel netdata" -fi + getent passwd netdata > /dev/null + if [ $? -eq 0 ] + then + echo + echo "You may also want to remove the user netdata" + echo "by running:" + echo " userdel netdata" + fi -getent group netdata > /dev/null -if [ $? -eq 0 ] - then - echo - echo "You may also want to remove the group netdata" - echo "by running:" - echo " groupdel netdata" -fi + getent group netdata > /dev/null + if [ $? -eq 0 ] + then + echo + echo "You may also want to remove the group netdata" + echo "by running:" + echo " groupdel netdata" + fi -getent group docker > /dev/null -if [ $? -eq 0 -a "${NETDATA_ADDED_TO_DOCKER}" = "1" ] - then - echo - echo "You may also want to remove the netdata user from the docker group" - echo "by running:" - echo " gpasswd -d netdata docker" -fi + getent group docker > /dev/null + if [ $? -eq 0 -a "${NETDATA_ADDED_TO_DOCKER}" = "1" ] + then + echo + echo "You may also want to remove the netdata user from the docker group" + echo "by running:" + echo " gpasswd -d netdata docker" + fi UNINSTALL chmod 750 netdata-uninstaller.sh @@ -764,32 +794,32 @@ else access="${NETDATA_BIND}" fi -cat <