Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Exempt root owned config files from ownership checker #3689

Merged
merged 2 commits into from
Feb 28, 2017
Merged

Exempt root owned config files from ownership checker #3689

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c004453
Exempt root owned config files from ownership checker
andrewkroh Feb 28, 2017
b6644d3
Update changelog entry for the file ownership and permission checker.
andrewkroh Feb 28, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions libbeat/common/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"flag"
"fmt"
"os"
"path/filepath"
"runtime"
"strings"

Expand Down Expand Up @@ -411,9 +412,9 @@ func filterDebugObject(c interface{}) {
}
}

// ownerHasExclusiveWritePerms asserts that the current user is the
// ownerHasExclusiveWritePerms asserts that the current user or root is the
// owner of the config file and that the config file is (at most) writable by
// the owner (e.g. group and other cannot have write access).
// the owner or root (e.g. group and other cannot have write access).
func ownerHasExclusiveWritePerms(name string) error {
if runtime.GOOS == "windows" {
return nil
Expand All @@ -428,16 +429,21 @@ func ownerHasExclusiveWritePerms(name string) error {
fileUID, _ := info.UID()
perm := info.Mode().Perm()

if euid != fileUID {
if fileUID != 0 && euid != fileUID {
return fmt.Errorf(`config file ("%v") must be owned by the beat user `+
`(uid=%v)`, name, euid)
`(uid=%v) or root`, name, euid)
}

// Test if group or other have write permissions.
if perm&0022 > 0 {
nameAbs, err := filepath.Abs(name)
if err != nil {
nameAbs = name
}
return fmt.Errorf(`config file ("%v") can only be writable by the `+
`owner but the permissions are "%v"`,
name, perm)
`owner but the permissions are "%v" (to fix the permissions use: `+
`'chmod go-w %v')`,
name, perm, nameAbs)
}

return nil
Expand Down