Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Module need Chownroot permission to init #1

Open
jsearby opened this issue Feb 4, 2021 · 5 comments
Open

Module need Chownroot permission to init #1

jsearby opened this issue Feb 4, 2021 · 5 comments

Comments

@jsearby
Copy link

jsearby commented Feb 4, 2021

As module intialization depends on :
[module.go :: startMetricServer] err = os.Chown(socketPath, userID, groupID)
It cause following init error:
Cannot chown metricssocket: chown /tmp/mtr.0juus5: operation not permitted

When such module is run within a "secured" container it cannot pass the init state.
As long as we can configure the DEFAULTTMPFOLDER with proper permission upfront: => it could worth avoid to do this Chown.

(Thanks a lot in advance for any support you may provide, we are definitly lacking such module)

@sni
Copy link
Contributor

sni commented Feb 4, 2021

The idea is to simply load the module and get metrics in return without worrying to much about preparation.
Is the apache started as uid=0 in your case? If not, the chown could be omitted, since the only reason is to create
a communication socket between the main process (which is mostly started as root) and the forked children running as
unprivileged user.

@jsearby
Copy link
Author

jsearby commented Feb 4, 2021

Thanks for such reactivity !
I confirm my apache is not uid 0, it is running as a standard user.
I will do a try using a "local test version" of the module without the chown

@sni
Copy link
Contributor

sni commented Feb 4, 2021

I would not remove the chown, but put it in a if and check for uid=0 before.

@jsearby
Copy link
Author

jsearby commented Feb 5, 2021

Good new :
Using local recompiled module, I confirm that only the Chown issue was preventing the module to work on a non root (uid=0) apache. I've been doing some intensive testing and so far so good.
If ok with you I can try the PR you proposed ?
(unless you prefer to do it)

@sni
Copy link
Contributor

sni commented Feb 5, 2021

sure, please prepare a PR and i am happy to merge it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants