Skip to content

[docker][agentbeat]: add cap_sys_ptrace and cap_dac_override in permitted set #5271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
VihasMakwana wants to merge 4 commits into from
Closed

[docker][agentbeat]: add cap_sys_ptrace and cap_dac_override in permitted set #5271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f80067a
fix: add cap_sys_ptrace and cap_dac_override in permitted set
VihasMakwana Aug 8, 2024
6048444
add: fragement
VihasMakwana Aug 8, 2024
affaaea
fix: update k8s tests with sufficient capabilities
VihasMakwana Aug 8, 2024
8fbae58
fix: fix flaky agent long running test
VihasMakwana Aug 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions changelog/fragments/1723149357-fix-insufficient-capabilities.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
kind: bug-fix
summary: Assign sys_ptrace and dac_override capabilities in permitted set to agentbeat binary.
component: elastic-agent, metricbeat
2 changes: 1 addition & 1 deletion dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ RUN true && \

# Keep this after any chown command, chown resets any applied capabilities
RUN setcap =p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/elastic-agent
RUN setcap cap_net_raw,cap_setuid+p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/components/agentbeat && \
RUN setcap cap_net_raw,cap_setuid,cap_sys_ptrace,cap_dac_override+p {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/components/agentbeat && \

@pkoutsovasilis pkoutsovasilis Aug 13, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dac_override is way too open why dac_read_search is not adequate?

{{- if .linux_capabilities }}
# Since the beat is stored at the other end of a symlink we must follow the symlink first
# For security reasons setcap does not support symlinks. This is smart in the general case
Expand Down
2 changes: 1 addition & 1 deletion testing/integration/agent_long_running_leak_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ func (runner *ExtendedRunner) TestHandleLeak() {
timer := time.NewTimer(testDuration)
defer timer.Stop()

ticker := time.NewTicker(time.Second * 10)
ticker := time.NewTicker(time.Second * 60)
defer ticker.Stop()

done := false
Expand Down
4 changes: 2 additions & 2 deletions testing/integration/agent_long_test_base_system_integ.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -531,7 +531,7 @@
}
},
{
"enabled": true,
"enabled": false,

@michel-laterman michel-laterman Aug 12, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are these being disabled?

@VihasMakwana VihasMakwana Aug 12, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michel-laterman i actually forgot to update the description. my bad

Please take a look now.

"data_stream": {
"type": "metrics",
"dataset": "system.process"
Expand Down Expand Up @@ -596,7 +596,7 @@
}
},
{
"enabled": true,
"enabled": false,
"data_stream": {
"type": "metrics",
"dataset": "system.process.summary"
Expand Down
4 changes: 2 additions & 2 deletions testing/integration/kubernetes_agent_standalone_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,15 +118,15 @@ func TestKubernetesAgentStandalone(t *testing.T) {
int64Ptr(1000), // elastic-agent uid
nil,
[]corev1.Capability{"ALL"},
[]corev1.Capability{"CHOWN", "SETPCAP"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_OVERRIDE", "SYS_PTRACE"},
true,
},
{
"drop ALL add CHOWN, SETPCAP capabilities - rootless agent random uid:gid",
int64Ptr(500),
int64Ptr(500),
[]corev1.Capability{"ALL"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_READ_SEARCH"},
[]corev1.Capability{"CHOWN", "SETPCAP", "DAC_OVERRIDE", "SYS_PTRACE"},
true,
},
}
Expand Down