Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[7.x](backport #27878) [Heartbeat] Setuid to regular user / lower capabilities when possible #28377

Merged
merged 4 commits into from
Oct 14, 2021
Merged

[7.x](backport #27878) [Heartbeat] Setuid to regular user / lower capabilities when possible #28377

merged 4 commits into from
Oct 14, 2021

Commits on Oct 13, 2021

  1. [Heartbeat] Setuid to regular user / lower capabilities when possible (… 

    …#27878)

partial fix for #27648 , this PR:

Detects if the user is running as root then:
Checks to see if an environment variable BEAT_SETUID_AS (set in our Docker.tmpl) is present
Attempts to Setuid , Setgid and Setgroups to that user / groups
Invokes setcap to drop all privileges except NET_RAW+ep
This PR also fixes the broken syscall filtering in heartbeat, some non-syscall strings were breaking that.

With the changes here elastic-agent can still run as root, but the subprocesses can lower their privileges ASAP. This should also make it possible for heartbeat to safely run ICMP pings and synthetics. Synthetics must run as non-root, but ICMP requires NET_RAW. This lets us be consistent in our docs with the recommendation that elastic-agent run as root.

(cherry picked from commit a78a980)

# Conflicts:
#	NOTICE.txt
#	dev-tools/packaging/packages.yml
#	go.mod
    @andrewvc
    andrewvc authored and mergify-bot committed Oct 13, 2021
    Configuration menu
    Copy the full SHA
    51a7648 View commit details
    Browse the repository at this point in the history

  2. Resolve conflicts

    @andrewvc
    andrewvc committed Oct 13, 2021
    Configuration menu
    Copy the full SHA
    de736cb View commit details
    Browse the repository at this point in the history

  3. Merge remote-tracking branch 'origin/7.x' into mergify/bp/7.x/pr-27878

    @andrewvc
    andrewvc committed Oct 13, 2021
    Configuration menu
    Copy the full SHA
    23a7914 View commit details
    Browse the repository at this point in the history

  4. Fix notice

    @andrewvc
    andrewvc committed Oct 13, 2021
    Configuration menu
    Copy the full SHA
    b3dc93c View commit details
    Browse the repository at this point in the history