Fix/8544 mac linux unprivileged reenroll by kaanyalti · Pull Request #9604 · elastic/elastic-agent

kaanyalti · 2025-08-27T17:22:09Z

Bug

What does this PR do?

Updates the enroll command so that the file permissions are fixed when a privileged user executes enroll. Implemented only for mac/linux. Permission fix is executed every time root executes enroll and enroll is not triggered by install. Windows implementation will be in a follow up pr. Split the PRs as windows implementation may end up being more involved.

Why is it important?

Currently a root user needs to run sudo -u elastic-agent-user elastic-agent enroll ... in order to re-enroll an unprivileged agent.

Checklist

I have read and understood the pull request guidelines of this project.
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
~~[ ] I have made corresponding changes to the documentation~~
~~[ ] I have made corresponding change to the default configuration files~~
I have added tests that prove my fix is effective or that my feature works
I have added an entry in ./changelog/fragments using the changelog tool
I have added an integration test or an E2E test

Disruptive User Impact

None

How to test this PR locally

Build the agent
Install and enroll with --unprivileged flag
Execute enroll as root
Verify that agent is still healthy

Related issues

Relates Enable Safe Re-enrollment by Root/Admin for Unprivileged Elastic Agent Installs on All Platforms #8544
Prerequisite for Fix/8544 windows unprivileged reenroll #9623 -> follow up windows PR

mergify · 2025-08-27T17:22:47Z

This pull request does not have a backport label. Could you fix it @kaanyalti? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

…t tests fix(8544): added empty owner check in enroll unix tests

fix(8544): refactored fix permission computation, and added tests

fix(8544): ran mage check

elasticmachine · 2025-08-29T02:08:05Z

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

ebeahan · 2025-09-03T21:30:11Z

Buildkite test this

elastic-sonarqube · 2025-09-04T00:20:35Z

Quality Gate passed

Issues
2 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
77.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2025-09-04T00:48:48Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: ce209c4

Failed CI Steps

arm:sudo: default

History

💔 Build #26026 failed ce209c4
💔 Build #26013 failed 1a90e8c
💚 Build #25883 succeeded 84d2dd7
💔 Build #25856 failed 8cc7a4d
💔 Build #25855 failed e27504c

cc @kaanyalti

blakerouse · 2025-09-04T13:27:57Z

Code looks good. I am building it now, and will run it before +1.

michalpristas · 2025-09-05T07:50:09Z

as blake seems to be testing it as well please wait for him to get back to you

blakerouse · 2025-09-05T12:05:36Z

I was able to test this on Linux arm64 and it is working as expected. After re-enrollment as root on an unprivileged installation all files written to disk have the correct permissions and the service is running successfully.

github-actions · 2025-09-05T12:08:12Z

@Mergifyio backport 8.18 8.19 9.0 9.1

mergify · 2025-09-05T12:08:23Z

backport 8.18 8.19 9.0 9.1

✅ Backports have been created

Details

#9767 [8.18] (backport #9604) Fix/8544 mac linux unprivileged reenroll has been created for branch 8.18 but encountered conflicts
#9768 [8.19] (backport #9604) Fix/8544 mac linux unprivileged reenroll has been created for branch 8.19 but encountered conflicts
#9769 [9.0] (backport #9604) Fix/8544 mac linux unprivileged reenroll has been created for branch 9.0 but encountered conflicts
#9770 [9.1] (backport #9604) Fix/8544 mac linux unprivileged reenroll has been created for branch 9.1 but encountered conflicts

* fix(8544): remove unused files * fix(8544): remove file ownership check in enroll command * fix(8544): added getOwnerFromPath for mac and linux and added relevant tests fix(8544): added empty owner check in enroll unix tests * fix(8544): added fileownership and permission fix in enroll command fix(8544): refactored fix permission computation, and added tests * fix(8544): added noop getOwnerFromPath for windows * fix(8544): updated re-enroll test * fix(8544): added changelog fragment * fix(8544): ran mage check fix(8544): ran mage check * fix(8544): refactored computeFixPermissions and updated relevant test cases * fix(8544): refactor computeFixPermissions if block (cherry picked from commit 08444d4) # Conflicts: # internal/pkg/agent/cmd/enroll.go

* Fix/8544 mac linux unprivileged reenroll (#9604) * fix(8544): remove unused files * fix(8544): remove file ownership check in enroll command * fix(8544): added getOwnerFromPath for mac and linux and added relevant tests fix(8544): added empty owner check in enroll unix tests * fix(8544): added fileownership and permission fix in enroll command fix(8544): refactored fix permission computation, and added tests * fix(8544): added noop getOwnerFromPath for windows * fix(8544): updated re-enroll test * fix(8544): added changelog fragment * fix(8544): ran mage check fix(8544): ran mage check * fix(8544): refactored computeFixPermissions and updated relevant test cases * fix(8544): refactor computeFixPermissions if block (cherry picked from commit 08444d4) # Conflicts: # internal/pkg/agent/cmd/enroll.go * fix(8544): resolve merge conflicts --------- Co-authored-by: Kaan Yalti <kaan.yalti@elastic.co>

* Fix/8544 mac linux unprivileged reenroll (#9604) * fix(8544): remove unused files * fix(8544): remove file ownership check in enroll command * fix(8544): added getOwnerFromPath for mac and linux and added relevant tests fix(8544): added empty owner check in enroll unix tests * fix(8544): added fileownership and permission fix in enroll command fix(8544): refactored fix permission computation, and added tests * fix(8544): added noop getOwnerFromPath for windows * fix(8544): updated re-enroll test * fix(8544): added changelog fragment * fix(8544): ran mage check fix(8544): ran mage check * fix(8544): refactored computeFixPermissions and updated relevant test cases * fix(8544): refactor computeFixPermissions if block (cherry picked from commit 08444d4) # Conflicts: # internal/pkg/agent/cmd/enroll.go * fix(8544): resolve merge conflicts --------- Co-authored-by: Kaan Yalti <kaan.yalti@elastic.co> Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co>

* fix(8544): remove unused files * fix(8544): remove file ownership check in enroll command * fix(8544): added getOwnerFromPath for mac and linux and added relevant tests fix(8544): added empty owner check in enroll unix tests * fix(8544): added fileownership and permission fix in enroll command fix(8544): refactored fix permission computation, and added tests * fix(8544): added noop getOwnerFromPath for windows * fix(8544): updated re-enroll test * fix(8544): added changelog fragment * fix(8544): ran mage check fix(8544): ran mage check * fix(8544): refactored computeFixPermissions and updated relevant test cases * fix(8544): refactor computeFixPermissions if block

Kaan Yalti added 2 commits August 27, 2025 16:46

fix(8544): remove unused files

319bedf

fix(8544): remove file ownership check in enroll command

300ff50

mergify Bot assigned kaanyalti Aug 27, 2025

mergify Bot mentioned this pull request Aug 27, 2025

Fix/8544 mac linux unprivileged reenroll #9603

Closed

6 tasks

kaanyalti added Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team backport-active-all Automated backport with mergify to all the active branches labels Aug 27, 2025

blakerouse reviewed Aug 27, 2025

View reviewed changes

Comment thread internal/pkg/agent/cmd/enroll.go Outdated

kaanyalti force-pushed the fix/8544_mac_linux_unprivileged_reenroll branch 3 times, most recently from cfe42f7 to f612dc5 Compare August 28, 2025 08:44

fix(8544): added getOwnerFromPath for mac and linux and added relevan…

35c0052

…t tests fix(8544): added empty owner check in enroll unix tests

kaanyalti force-pushed the fix/8544_mac_linux_unprivileged_reenroll branch 3 times, most recently from 127f60e to e27504c Compare August 28, 2025 10:17

kaanyalti commented Aug 28, 2025

View reviewed changes

Comment thread internal/pkg/agent/cmd/enroll.go Outdated

kaanyalti force-pushed the fix/8544_mac_linux_unprivileged_reenroll branch 2 times, most recently from 8cc7a4d to e15b90e Compare August 28, 2025 20:09

Kaan Yalti added 5 commits August 28, 2025 23:55

fix(8544): added fileownership and permission fix in enroll command

953f850

fix(8544): refactored fix permission computation, and added tests

fix(8544): added noop getOwnerFromPath for windows

516eb3d

fix(8544): updated re-enroll test

2506c61

fix(8544): added changelog fragment

b4279fc

fix(8544): ran mage check

84d2dd7

fix(8544): ran mage check

kaanyalti force-pushed the fix/8544_mac_linux_unprivileged_reenroll branch from e15b90e to 84d2dd7 Compare August 28, 2025 20:56

kaanyalti marked this pull request as ready for review August 29, 2025 02:08

kaanyalti requested a review from a team as a code owner August 29, 2025 02:08

kaanyalti requested review from blakerouse and michalpristas August 29, 2025 02:08

kaanyalti mentioned this pull request Aug 29, 2025

Fix/8544 windows unprivileged reenroll #9623

Merged

6 tasks

michalpristas approved these changes Sep 5, 2025

View reviewed changes

blakerouse approved these changes Sep 5, 2025

View reviewed changes

kaanyalti merged commit 08444d4 into elastic:main Sep 5, 2025
19 checks passed

kaanyalti deleted the fix/8544_mac_linux_unprivileged_reenroll branch September 5, 2025 12:08

mergify Bot mentioned this pull request Sep 5, 2025

[8.18] (backport #9604) Fix/8544 mac linux unprivileged reenroll #9767

Merged

6 tasks

This was referenced Sep 5, 2025

[8.19] (backport #9604) Fix/8544 mac linux unprivileged reenroll #9768

Merged

[9.0] (backport #9604) Fix/8544 mac linux unprivileged reenroll #9769

Merged

mergify Bot mentioned this pull request Sep 5, 2025

[9.1] (backport #9604) Fix/8544 mac linux unprivileged reenroll #9770

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/8544 mac linux unprivileged reenroll#9604

Fix/8544 mac linux unprivileged reenroll#9604
kaanyalti merged 10 commits into
elastic:mainfrom
kaanyalti:fix/8544_mac_linux_unprivileged_reenroll

kaanyalti commented Aug 27, 2025 •

edited

Loading

Uh oh!

mergify Bot commented Aug 27, 2025

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Aug 29, 2025

Uh oh!

ebeahan commented Sep 3, 2025

Uh oh!

elastic-sonarqube Bot commented Sep 4, 2025

Uh oh!

elasticmachine commented Sep 4, 2025

Uh oh!

blakerouse commented Sep 4, 2025

Uh oh!

michalpristas commented Sep 5, 2025

Uh oh!

blakerouse commented Sep 5, 2025

Uh oh!

Uh oh!

github-actions Bot commented Sep 5, 2025

Uh oh!

mergify Bot commented Sep 5, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

kaanyalti commented Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Why is it important?

Checklist

Disruptive User Impact

How to test this PR locally

Related issues

Uh oh!

mergify Bot commented Aug 27, 2025

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Aug 29, 2025

Uh oh!

ebeahan commented Sep 3, 2025

Uh oh!

elastic-sonarqube Bot commented Sep 4, 2025

Quality Gate passed

Uh oh!

elasticmachine commented Sep 4, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

History

Uh oh!

blakerouse commented Sep 4, 2025

Uh oh!

michalpristas commented Sep 5, 2025

Uh oh!

blakerouse commented Sep 5, 2025

Uh oh!

Uh oh!

github-actions Bot commented Sep 5, 2025

Uh oh!

mergify Bot commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Backports have been created

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kaanyalti commented Aug 27, 2025 •

edited

Loading

mergify Bot commented Sep 5, 2025 •

edited

Loading