Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@Ferroin
Copy link
Member

@Ferroin Ferroin commented Feb 17, 2025

Summary

This provides support in CMake for:

  • Differentiating between package build types, allowing different handling for different types.
  • Handling of file capabilities, SUID, and basic permissions on install. The version in this PR currently only handles manual builds, but it provides sufficient infrastructure to expand this to cover all install types eventually.

Exact behavior for the permissions handling varies by platform:

  • For all UNIX-like systems, the Netdata user and group will be created by the CMake install process if they do not exist on the target system unless the user explicitly disables this behavior, as this is required for permissions handling to work correctly.
  • For all UNIX-like systems, any executable we install which is not designated for supplementary permissions will now be owned by the root user and group. This differs from our current behavior, but is a net security improvement because it makes it just a bit harder for a compromised install of Netdata to install arbitrary code on the system.
  • For all UNIX-like systems, any binary designated for supplementary permissions will have it’s owner and group updated to root and the Netdata user group respectively, and it’s permissions updated to disallow access by other users.
  • For any UNIX-like system other than Linux, any binary designated for supplementary permissions beyond simply being restricted to only the Netdata user will be marked SUID.
  • For Linux, this will try to use file capabilities unless the user requests not to use them. If using file capabilities fails (or they are explicitly disabled), behavior will match other UNIX-like systems.
  • For Windows, nothing will be done, as the concepts do not exist there in a way that we can really work with.
  • For Docker builds, SUID and filecaps will be ignored, but ownership and permissions will be updated, as those are the only things we can actually work with.
Test Plan

Testing of this PR beyond verifying that the build process still works correctly at a basic level will require manual testing to confirm that the installed files have the right permissions.

Additional Information

This is functionally the working parts of #18010 split out as their own PR, because most of the working parts are needed to progress on migrating our RPM builds to CPack. The rest of the things from that PR (DEB package and static build support in the filecaps handling code) will be handled as separate PRs.

@github-actions github-actions bot added area/packaging Packaging and operating systems support area/build Build system (autotools and cmake). labels Feb 17, 2025
@Ferroin Ferroin marked this pull request as ready for review February 17, 2025 16:44
@Ferroin Ferroin requested review from a team and vkalintiris as code owners February 17, 2025 16:44
@Ferroin Ferroin requested a review from a team February 17, 2025 16:44
@thiagoftsm
Copy link
Contributor

Compiling directly on Slackware, I can observe some changes in the permission:

Master branch:

-rwxr-x--- 1 root netdata 2.4M Feb 19 15:21 /usr/libexec/netdata/plugins.d/apps.plugin
-rwxr-x--- 1 root netdata  22K Feb 19 15:08 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-x--- 1 root netdata 1.5M Feb 19 15:21 /usr/libexec/netdata/plugins.d/cups.plugin
-rwxr-x--- 1 root netdata 2.0M Feb 19 15:21 /usr/libexec/netdata/plugins.d/debugfs.plugin
-rwsr-x--- 1 root netdata 5.9M Feb 19 15:22 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwsr-x--- 1 root netdata 2.9M May 17  2024 /usr/libexec/netdata/plugins.d/freeipmi.plugin
-rwxr-x--- 1 root netdata  67M Apr  2  2024 /usr/libexec/netdata/plugins.d/go.d.plugin
-rwxr-x--- 1 root netdata 6.4K Feb 19 15:08 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x--- 1 root netdata  11M Jul 17  2024 /usr/libexec/netdata/plugins.d/logs-management.plugin
-rwsr-x--- 1 root netdata 2.2M Feb 19 15:22 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwsr-x--- 1 root netdata 2.0M Apr 10  2024 /usr/libexec/netdata/plugins.d/nfacct.plugin
-rwxr-x--- 1 root netdata 707K Feb 19 15:21 /usr/libexec/netdata/plugins.d/perf.plugin
-rwxr-x--- 1 root netdata  28K Feb 19 15:08 /usr/libexec/netdata/plugins.d/python.d.plugin
-rwxr-x--- 1 root netdata 655K Feb 19 15:21 /usr/libexec/netdata/plugins.d/slabinfo.plugin

This Branch:

-rwxr-xr-x 1 root root    2.4M Feb 19 17:46 /usr/libexec/netdata/plugins.d/apps.plugin
-rwxr-xr-x 1 root root     22K Feb 19 17:32 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-xr-x 1 root root    1.5M Feb 19 17:46 /usr/libexec/netdata/plugins.d/cups.plugin
-rwxr-xr-x 1 root root    1.9M Feb 19 17:46 /usr/libexec/netdata/plugins.d/debugfs.plugin
-rwxr-xr-x 1 root root    5.9M Feb 19 17:46 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwsr-x--- 1 root netdata 2.9M May 17  2024 /usr/libexec/netdata/plugins.d/freeipmi.plugin
-rwxr-x--- 1 root netdata  67M Apr  2  2024 /usr/libexec/netdata/plugins.d/go.d.plugin
-rwxr-xr-x 1 root root    6.4K Feb 19 17:32 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x--- 1 root netdata  11M Jul 17  2024 /usr/libexec/netdata/plugins.d/logs-management.plugin
-rwxr-xr-x 1 root root    2.2M Feb 19 17:46 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwsr-x--- 1 root netdata 2.0M Apr 10  2024 /usr/libexec/netdata/plugins.d/nfacct.plugin
-rwxr-xr-x 1 root root    700K Feb 19 17:46 /usr/libexec/netdata/plugins.d/perf.plugin
-rwxr-xr-x 1 root root     28K Feb 19 17:32 /usr/libexec/netdata/plugins.d/python.d.plugin
-rwxr-xr-x 1 root root    647K Feb 19 17:46 /usr/libexec/netdata/plugins.d/slabinfo.plugin

Now, on capabilities:

Current Master:

bash-5.2# for i in `ls *.plugin`; do getcap $i ; done
apps.plugin cap_dac_read_search,cap_sys_ptrace=ep
debugfs.plugin cap_dac_read_search=ep
go.d.plugin cap_dac_read_search,cap_net_admin,cap_net_raw=eip
perf.plugin cap_perfmon=ep
slabinfo.plugin cap_dac_read_search=ep

This branch:

bash-5.2# for i in `ls *.plugin`; do getcap $i ; done
go.d.plugin cap_dac_read_search,cap_net_admin,cap_net_raw=eip

I suspect we are not expecting these changes.

@Ferroin
Copy link
Member Author

Ferroin commented Feb 19, 2025

I suspect we are not expecting these changes.

Not expected at all. Especially since the code involved for manual builds was one of the things we had confirmed was working correctly on the previous PR and it’s essentially unmodified in this one.

@thiagoftsm
Copy link
Contributor

I tested the RPMs on CentOS 9 Stream, and they are working as expected.

@thiagoftsm
Copy link
Contributor

@Ferroin , on Ubuntu, the following plugins do not have the expected permissions:

-rwxr-xr-x 1 root netdata  22K Feb 19 22:40 charts.d.plugin
-rwxr-xr-x 1 root netdata 214K Feb 19 22:47 cups.plugin
-rwsr-x--- 1 root netdata 6.4K Feb 19 22:40 ioping.plugin
-rwxr-x--- 1 root netdata 350K Feb 19 22:48 network-viewer.plugin
-rwxr-xr-x 1 root netdata  28K Feb 19 22:40 python.d.plugin

@thiagoftsm
Copy link
Contributor

thiagoftsm commented Feb 20, 2025

@Ferroin, static building is also giving permission to others, something we do not observe in current master branch:

-rwxr-xr-x. 1 root netdata 1.5M Feb 20 12:20 apps.plugin
-rwxr-xr-x. 1 root netdata  22K Feb 20 12:16 charts.d.plugin
-rwxr-xr-x. 1 root netdata 1.4M Feb 20 12:20 debugfs.plugin
-rwsr-x---. 1 root netdata 3.9M Feb 20 12:25 ebpf.plugin
-rwxr-xr-x. 1 root netdata 115M Feb 20 12:21 go.d.plugin
-rwxr-xr-x. 1 root netdata 6.5K Feb 20 12:16 ioping.plugin
-rwsr-x---. 1 root netdata 1.6M Feb 20 12:19 network-viewer.plugin
-rwsr-x---. 1 root netdata 865K Feb 20 12:19 nfacct.plugin
-rwxr-xr-x. 1 root netdata 836K Feb 20 12:19 perf.plugin
-rwxr-xr-x. 1 root netdata  28K Feb 20 12:16 python.d.plugin
-rwxr-xr-x. 1 root netdata 826K Feb 20 12:19 slabinfo.plugin
```

I tested the static on CentOS 7.

@thiagoftsm
Copy link
Contributor

@Ferroin ,
Please, rebase your PR for we have conditions to test on FreeBSD.

@thiagoftsm
Copy link
Contributor

Hello @Ferroin,

Testing on FreeBSD 14, I also observed unexpected permissions with this PR:

Current Master:

-rwsr-x---  1 root netdata  583K Feb 20 16:53 apps.plugin
-rwxr-x---  1 root netdata   21K Feb 20 16:51 charts.d.plugin
-rwxr-x---  1 root netdata  101M Feb 20 16:55 go.d.plugin
-rwxr-x---  1 root netdata  6.5K Feb 20 16:51 ioping.plugin
-rwxr-x---  1 root netdata   27K Feb 20 16:51 python.d.plugin

This branch:

-rwxr-xr-x  1 root daemon  474K Feb 21 14:50 apps.plugin
-rwxr-xr-x  1 root daemon   21K Feb 21 14:48 charts.d.plugin
-rwxr-xr-x  1 root daemon  113M Feb 21 14:53 go.d.plugin
-rwxr-xr-x  1 root daemon  6.4K Feb 21 14:48 ioping.plugin
-rwxr-xr-x  1 root daemon   25K Feb 21 14:48 python.d.plugin

@thiagoftsm
Copy link
Contributor

@netdata/agent , please, test on Mac, because I do not have this environment.

@Ferroin
Copy link
Member Author

Ferroin commented Mar 4, 2025

@thiagoftsm The latest updates should fix the issues you were seeing.

@thiagoftsm
Copy link
Contributor

@thiagoftsm The latest updates should fix the issues you were seeing.

Please, resolve the conflicts for me start the tests again.

@Ferroin
Copy link
Member Author

Ferroin commented Mar 7, 2025

Rebased to resolve merge conflicts.

@thiagoftsm
Copy link
Contributor

Hello @Ferroin ,

Is the ppc64le CI failure expected?

@thiagoftsm
Copy link
Contributor

thiagoftsm commented Mar 7, 2025

Hello @Ferroin ,

We had some improvements, but we still have important differences when we compare with current master:

Current Master

bash-5.2# ls -l /usr/libexec/netdata/plugins.d/*.plugin
-rwxr-x--- 1 root netdata  4082824 Mar  7 13:25 /usr/libexec/netdata/plugins.d/apps.plugin
-rwxr-x--- 1 root netdata    21775 Mar  7 13:10 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-x--- 1 root netdata  2860488 Mar  7 13:26 /usr/libexec/netdata/plugins.d/cups.plugin
-rwxr-x--- 1 root netdata  3464448 Mar  7 13:25 /usr/libexec/netdata/plugins.d/debugfs.plugin
-rwsr-x--- 1 root netdata  7957680 Mar  7 13:27 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwsr-x--- 1 root netdata  3030544 May 17  2024 /usr/libexec/netdata/plugins.d/freeipmi.plugin
-rwxr-x--- 1 root netdata 70004888 Apr  2  2024 /usr/libexec/netdata/plugins.d/go.d.plugin
-rwxr-x--- 1 root netdata     6521 Mar  7 13:10 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x--- 1 root netdata 11346168 Jul 17  2024 /usr/libexec/netdata/plugins.d/logs-management.plugin
-rwsr-x--- 1 root netdata  3703128 Mar  7 13:27 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwsr-x--- 1 root netdata  2046312 Apr 10  2024 /usr/libexec/netdata/plugins.d/nfacct.plugin
-rwxr-x--- 1 root netdata  2765456 Mar  7 13:25 /usr/libexec/netdata/plugins.d/perf.plugin
-rwxr-x--- 1 root netdata    25678 Mar  7 13:10 /usr/libexec/netdata/plugins.d/python.d.plugin
-rwxr-x--- 1 root netdata  2598216 Mar  7 13:25 /usr/libexec/netdata/plugins.d/slabinfo.plugin

This Branch

-rwxr-x--- 1 root netdata  4086592 Mar  7 14:00 /usr/libexec/netdata/plugins.d/apps.plugin*
-rwxr-xr-x 1 root root       21775 Mar  7 13:41 /usr/libexec/netdata/plugins.d/charts.d.plugin*
-rwxr-xr-x 1 root root     2863600 Mar  7 14:01 /usr/libexec/netdata/plugins.d/cups.plugin*
-rwxr-x--- 1 root netdata  3467696 Mar  7 14:00 /usr/libexec/netdata/plugins.d/debugfs.plugin*
-rwxr-xr-x 1 root root     7961720 Mar  7 14:02 /usr/libexec/netdata/plugins.d/ebpf.plugin*
-rwsr-x--- 1 root netdata  3030544 May 17  2024 /usr/libexec/netdata/plugins.d/freeipmi.plugin*
-rwxr-x--- 1 root netdata 70004888 Apr  2  2024 /usr/libexec/netdata/plugins.d/go.d.plugin*
-rwxr-xr-x 1 root root        6521 Mar  7 13:41 /usr/libexec/netdata/plugins.d/ioping.plugin*
-rwxr-x--- 1 root netdata 11346168 Jul 17  2024 /usr/libexec/netdata/plugins.d/logs-management.plugin*
-rwxr-x--- 1 root netdata  3706592 Mar  7 14:02 /usr/libexec/netdata/plugins.d/network-viewer.plugin*
-rwsr-x--- 1 root netdata  2046312 Apr 10  2024 /usr/libexec/netdata/plugins.d/nfacct.plugin*
-rwxr-x--- 1 root netdata  2768448 Mar  7 14:00 /usr/libexec/netdata/plugins.d/perf.plugin*
-rwxr-xr-x 1 root root       25678 Mar  7 13:41 /usr/libexec/netdata/plugins.d/python.d.plugin*
-rwxr-x--- 1 root netdata  2601224 Mar  7 14:00 /usr/libexec/netdata/plugins.d/slabinfo.plugin*

As you can see, we are missing the correct groups and permissions for some collectors.

These are results from a local compilation.

@thiagoftsm
Copy link
Contributor

RPMs have the expected permissions.

@thiagoftsm
Copy link
Contributor

@Ferroin ,

I also observed improvements for Debian Packages, but we still have unexpected permissions for these plugins:

-rwxr-xr-x 1 root netdata     21775 Mar  7 19:18 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-xr-x 1 root netdata    226456 Mar  7 19:27 /usr/libexec/netdata/plugins.d/cups.plugin
-rwsr-x--- 1 root netdata      6521 Mar  7 19:18 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x--- 1 root netdata    382408 Mar  7 19:27 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-xr-x 1 root netdata     25678 Mar  7 19:18 /usr/libexec/netdata/plugins.d/python.d.plugin

@thiagoftsm
Copy link
Contributor

@Ferroin ,

FreeBSD 14 is the OS we have more work to do until now, please, see the output:

Current Master

[root@freebsd14 /home/thiago/Netdata/netdata]# ls -l /usr/libexec/netdata/plugins.d/*.plugin
-rwsr-x---  1 root netdata    480312 Mar  7 23:43 /usr/libexec/netdata/plugins.d/apps.plugin
-rwxr-x---  1 root netdata     21775 Mar  7 23:41 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwsr-x---  1 root netdata 118997154 Mar  7 23:48 /usr/libexec/netdata/plugins.d/go.d.plugin
-rwxr-x---  1 root netdata      6521 Mar  7 23:41 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x---  1 root netdata     25678 Mar  7 23:41 /usr/libexec/netdata/plugins.d/python.d.plugin

This Branch

[root@freebsd14 /home/thiago/Netdata/netdata]# ls -l /usr/libexec/netdata/plugins.d/*.plugin
-rwxr-xr-x  1 root daemon    480312 Mar  8 00:11 /usr/libexec/netdata/plugins.d/apps.plugin
-rwxr-xr-x  1 root daemon     21775 Mar  8 00:08 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-xr-x  1 root daemon 118919330 Mar  8 00:11 /usr/libexec/netdata/plugins.d/go.d.plugin
-rwxr-xr-x  1 root daemon      6521 Mar  8 00:08 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-xr-x  1 root daemon     25678 Mar  8 00:08 /usr/libexec/netdata/plugins.d/python.d.plugin

@Ferroin
Copy link
Member Author

Ferroin commented Mar 11, 2025

Rebased to pick up the latest changes in the master branch.

Ferroin added 2 commits July 23, 2025 09:35
This provides support in CMake for:

- Differentiating between package build types, allowing different
  handling for different types.
- Handling of file capabilities, SUID, and basic permissions on install.
  The version in this PR currently only handles manual builds, but it
  provides sufficient infrastructure to expand this to cover all install
  types eventually.
@Ferroin
Copy link
Member Author

Ferroin commented Jul 23, 2025

Rebased to resolve merge conflicts and pick up the latest changes.

@thiagoftsm
Copy link
Contributor

@Ferroin , CI is failing on Ubuntu 22.04.

@thiagoftsm
Copy link
Contributor

Hello @Ferroin,

When current master on Slackware, we have:

-rwxr-x--- 1 root netdata    21787 Jul 23 21:08 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-x--- 1 root netdata  3195968 Jul 23 21:17 /usr/libexec/netdata/plugins.d/cups.plugin
-rwsr-x--- 1 root netdata  9298560 Jul 23 21:34 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwxr-x--- 1 root netdata     6521 Jul 23 21:08 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwsr-x--- 1 root netdata  5232024 Jul 23 21:23 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-x--- 1 root netdata    25678 Jul 23 21:08 /usr/libexec/netdata/plugins.d/python.d.plugin

While this PR changed for:

-rwxr-xr-x 1 root root       21787 Jul 24 14:18 /usr/libexec/netdata/plugins.d/charts.d.plugin*
-rwxr-xr-x 1 root root     3195512 Jul 24 14:27 /usr/libexec/netdata/plugins.d/cups.plugin*
-rwxr-xr-x 1 root root     9298112 Jul 24 14:44 /usr/libexec/netdata/plugins.d/ebpf.plugin*
-rwxr-xr-x 1 root root        6521 Jul 24 14:18 /usr/libexec/netdata/plugins.d/ioping.plugin*
-rwxr-x--- 1 root netdata  5231776 Jul 24 14:33 /usr/libexec/netdata/plugins.d/network-viewer.plugin*
-rwxr-xr-x 1 root root       25678 Jul 24 14:18 /usr/libexec/netdata/plugins.d/python.d.plugin*

@thiagoftsm
Copy link
Contributor

@Ferroin ,

An analogous issues is happening on Debian 12.11. On current master branch:

-rwxr-x--- 1 root netdata  22K Jul 24 20:56 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwsr-x--- 1 root netdata 8.7M Jul 24 21:04 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwxr-x--- 1 root netdata 6.4K Jul 24 20:56 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwsr-x--- 1 root netdata 4.8M Jul 24 20:59 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-x--- 1 root netdata  26K Jul 24 20:56 /usr/libexec/netdata/plugins.d/python.d.plugin
-rwxr-x--- 1 root netdata 6.3M Jul 24 20:59 /usr/libexec/netdata/plugins.d/systemd-units.plugin

Current branch:

-rwxr-xr-x 1 root root     22K Jul 24 21:48 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-xr-x 1 root root    8.7M Jul 24 21:56 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwxr-xr-x 1 root root    6.4K Jul 24 21:48 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x--- 1 root netdata 4.8M Jul 24 21:50 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-xr-x 1 root root     26K Jul 24 21:48 /usr/libexec/netdata/plugins.d/python.d.plugin
-rwxr-xr-x 1 root root    6.3M Jul 24 21:50 /usr/libexec/netdata/plugins.d/systemd-units.plugin

@thiagoftsm
Copy link
Contributor

@Ferroin , the same situation happens on CentOS 9:

Master:

-rwxr-x---. 1 root netdata   21787 Jul 24 19:24 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwsr-x---. 1 root netdata 9354384 Jul 24 19:49 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwxr-x---. 1 root netdata    6521 Jul 24 19:24 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwsr-x---. 1 root netdata 5289648 Jul 24 19:31 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-x---. 1 root netdata 6903056 Jul 24 19:30 /usr/libexec/netdata/plugins.d/systemd-units.plugin

This Branch:

-rwxr-xr-x. 1 root root      21787 Jul 24 19:58 /usr/libexec/netdata/plugins.d/charts.d.plugin
-rwxr-xr-x. 1 root root    9354352 Jul 24 20:24 /usr/libexec/netdata/plugins.d/ebpf.plugin
-rwxr-xr-x. 1 root root       6521 Jul 24 19:58 /usr/libexec/netdata/plugins.d/ioping.plugin
-rwxr-x---. 1 root netdata 5289648 Jul 24 20:04 /usr/libexec/netdata/plugins.d/network-viewer.plugin
-rwxr-xr-x. 1 root root    6903056 Jul 24 20:03 /usr/libexec/netdata/plugins.d/systemd-units.plugin

@thiagoftsm
Copy link
Contributor

@Ferroin ,

Now changing to RPM. I observed issue only with one plugin:

Current master:

-rwsr-x--- 1 root netdata  5229848 Jul 25 00:20 /usr/libexec/netdata/plugins.d/network-viewer.plugin

Branch (RPM):

-rwxr-x---. 1 root netdata   5244320 Jul 24 23:12 /usr/libexec/netdata/plugins.d/network-viewer.plugin

@thiagoftsm
Copy link
Contributor

@Ferroin ,

Debian packages, on Ubuntu 20.04 has all pluigins with permission -rwxr-xr-x, this is not expected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/build Build system (autotools and cmake). area/packaging Packaging and operating systems support

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants