cleanup netdata.service - fixes #773; netdata now verifies it has to its required...

diff --git a/src/main.c b/src/main.c
index 55742ad3cb1cd51da9381db7f191c70c5b2124aa..9e4fdb43fcaa298db4dd5f9153459ed5ae84c221 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -262,6 +262,17 @@ void remove_option(int opt_index, int *argc, char **argv) {
     } while(argv[i][0] != '-' && opt_index >= *argc);
 }
 
+static const char *verify_required_directory(const char *dir) {
+    if(chdir(dir) == -1)
+        fatal("Cannot cd to directory '%s'", dir);
+
+    DIR *d = opendir(dir);
+    if(!d)
+        fatal("Cannot examine the contents of directory '%s'", dir);
+    closedir(d);
+
+    return dir;
+}
 
 int main(int argc, char **argv)
 {
@@ -396,35 +407,42 @@ int main(int argc, char **argv)
         }
     }
 
-    if(!config_loaded) load_config(NULL, 0);
+    if(!config_loaded)
+        load_config(NULL, 0);
 
-    // prepare configuration environment variables for the plugins
-    setenv("NETDATA_CONFIG_DIR" , config_get("global", "config directory"   , CONFIG_DIR) , 1);
-    setenv("NETDATA_PLUGINS_DIR", config_get("global", "plugins directory"  , PLUGINS_DIR), 1);
-    setenv("NETDATA_WEB_DIR"    , config_get("global", "web files directory", WEB_DIR)    , 1);
-    setenv("NETDATA_CACHE_DIR"  , config_get("global", "cache directory"    , CACHE_DIR)  , 1);
-    setenv("NETDATA_LIB_DIR"    , config_get("global", "lib directory"      , VARLIB_DIR) , 1);
-    setenv("NETDATA_LOG_DIR"    , config_get("global", "log directory"      , LOG_DIR)    , 1);
-    setenv("NETDATA_HOST_PREFIX", config_get("global", "host access prefix" , "")         , 1);
-    setenv("HOME"               , config_get("global", "home directory"     , CACHE_DIR)  , 1);
+    {
+        char *config_dir = config_get("global", "config directory", CONFIG_DIR);
 
-    // disable buffering for python plugins
-    setenv("PYTHONUNBUFFERED", "1", 1);
+        // prepare configuration environment variables for the plugins
+        setenv("NETDATA_CONFIG_DIR" , verify_required_directory(config_dir) , 1);
+        setenv("NETDATA_PLUGINS_DIR", verify_required_directory(config_get("global", "plugins directory"  , PLUGINS_DIR)), 1);
+        setenv("NETDATA_WEB_DIR"    , verify_required_directory(config_get("global", "web files directory", WEB_DIR))    , 1);
+        setenv("NETDATA_CACHE_DIR"  , verify_required_directory(config_get("global", "cache directory"    , CACHE_DIR))  , 1);
+        setenv("NETDATA_LIB_DIR"    , verify_required_directory(config_get("global", "lib directory"      , VARLIB_DIR)) , 1);
+        setenv("NETDATA_LOG_DIR"    , verify_required_directory(config_get("global", "log directory"      , LOG_DIR))    , 1);
 
-    // avoid flood calls to stat(/etc/localtime)
-    // http://stackoverflow.com/questions/4554271/how-to-avoid-excessive-stat-etc-localtime-calls-in-strftime-on-linux
-    setenv("TZ", ":/etc/localtime", 0);
+        setenv("NETDATA_HOST_PREFIX", config_get("global", "host access prefix" , "")         , 1);
+        setenv("HOME"               , config_get("global", "home directory"     , CACHE_DIR)  , 1);
+
+        // disable buffering for python plugins
+        setenv("PYTHONUNBUFFERED", "1", 1);
+
+        // avoid flood calls to stat(/etc/localtime)
+        // http://stackoverflow.com/questions/4554271/how-to-avoid-excessive-stat-etc-localtime-calls-in-strftime-on-linux
+        setenv("TZ", ":/etc/localtime", 0);
+
+        // work while we are cd into config_dir
+        // to allow the plugins refer to their config
+        // files using relative filenames
+        if(chdir(config_dir) == -1)
+            fatal("Cannot cd to '%s'", config_dir);
 
-    {
         char path[1024 + 1], *p = getenv("PATH");
         if(!p) p = "/bin:/usr/bin";
         snprintfz(path, 1024, "%s:%s", p, "/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
         setenv("PATH", config_get("plugins", "PATH environment variable", path), 1);
     }
 
-    // cd to /tmp to avoid any plugins writing files at random places
-    if(chdir("/tmp")) error("netdata: ERROR: Cannot cd to /tmp");
-
     char *user = NULL;
     {
         char *flags = config_get("global", "debug flags",  "0x00000000");

diff --git a/src/registry.c b/src/registry.c
index e43c16b1b759fea61f0c679810d07fd31aeb2a1e..41e88905b5632735fd42b555125a9ac0c3cc81a4 100644 (file)
--- a/src/registry.c
+++ b/src/registry.c
@@ -1612,16 +1612,10 @@ int registry_init(void) {
     // registry enabled?
     registry.enabled = config_get_boolean("registry", "enabled", 0);
 
-    if(mkdir(VARLIB_DIR, 0755) == -1 && errno != EEXIST)
-        error("Cannot create directory '" VARLIB_DIR "'");
-
     // pathnames
     registry.pathname = config_get("registry", "registry db directory", VARLIB_DIR "/registry");
-    if(mkdir(registry.pathname, 0755) == -1 && errno != EEXIST) {
-        error("Cannot create directory '%s'. Registry disabled.", registry.pathname);
-        registry.enabled = 0;
-        return -1;
-    }
+    if(mkdir(registry.pathname, 0770) == -1 && errno != EEXIST)
+        fatal("Cannot create directory '%s'.", registry.pathname);
 
     // filenames
     snprintfz(filename, FILENAME_MAX, "%s/netdata.public.unique.id", registry.pathname);

diff --git a/system/netdata.service.in b/system/netdata.service.in
index f537cfae04aa9139f5bcd85a7b38663ee9693637..e260e2738038e7396df07bcb601a26772e86d815 100644 (file)
--- a/system/netdata.service.in
+++ b/system/netdata.service.in
@@ -4,41 +4,12 @@ After=network.target httpd.service squid.service nfs-server.service mysqld.servi
 
 [Service]
 Type=simple
-WorkingDirectory=/tmp
 User=netdata
 Group=netdata
-RuntimeDirectory=netdata
 ExecStart=@sbindir_POST@/netdata -D
 
-# -----------------------------------------------------------------------------
-# Stopping netdata
-
-KillMode=mixed
-KillSignal=SIGTERM
-
 # saving a big db on slow disks may need some time
 TimeoutStopSec=60
 
-# and disable SIGKILL - if sent during save, we will loose the db
-SendSIGKILL=no
-
-# -----------------------------------------------------------------------------
-# Hardening netdata
-
-# These will apply these capabilities to the entire netdata process tree
-# We don't want this - only apps.plugin needs them
-# AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
-# CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_PTRACE
-
-PrivateTmp=true
-ProtectSystem=full
-ProtectHome=read-only
-
-# is implicitly set by the MemoryDenyWriteExecute=true
-# NoNewPrivileges=true
-
-# Do not enable - it makes node.js plugins to crash
-# MemoryDenyWriteExecute=true
-
 [Install]
 WantedBy=multi-user.target