Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Heartbeat] Setuid has perms issues with user controlled config files #28572

Closed
andrewvc opened this issue Oct 20, 2021 · 1 comment · Fixed by #28577
Closed

[Heartbeat] Setuid has perms issues with user controlled config files #28572

andrewvc opened this issue Oct 20, 2021 · 1 comment · Fixed by #28577
Assignees
@andrewvc
Labels
backport-v7.16.0 Automated backport with mergify bug Team:obs-ds-hosted-services Label for the Observability Hosted Services team v7.16.0

Comments

@andrewvc
Copy link
Contributor

andrewvc commented Oct 20, 2021 •
edited by zube bot
Loading

In #28514 we added support for setuid-ing to a regular user from root. This wasn't thought of as a breaking change, because it generally isn't. One place where that's not quite true is that if users have config files that are owned by root with no o+r perms heartbeat can't read these after downgrading its credentials.

To remedy this I propose we only invoke setuid in the elastic-agent containers where we control config files completely.
@andrewvc andrewvc added bug v7.16.0 backport-v7.16.0 Automated backport with mergify labels Oct 20, 2021
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 20, 2021
@andrewvc andrewvc self-assigned this Oct 20, 2021
@andrewvc andrewvc added the Team:obs-ds-hosted-services Label for the Observability Hosted Services team label Oct 20, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/uptime (Team:Uptime)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 20, 2021
@andrewvc andrewvc mentioned this issue Oct 20, 2021
Merged
9 tasks
@andrewvc andrewvc changed the title [Heartbeat] Setuid should be after reading config files [Heartbeat] Setuid has perms issues with user controlled config files Oct 20, 2021
andrewvc added a commit to andrewvc/beats that referenced this issue Oct 20, 2021
@andrewvc
[Heartbeat] Only setuid in elastic-agent image
6778cf8 
Fixes elastic#28572 by only invoking setuid in the elastic-agent container, and
no longer in the heartbeat container. See the linked issue for details.
@andrewvc andrewvc mentioned this issue Oct 20, 2021
Merged
5 tasks
andrewvc added a commit that referenced this issue Oct 21, 2021
@andrewvc
[Heartbeat] Only setuid in elastic-agent image (#28577)
da2bc89 
Fixes #28572 by only invoking setuid in the elastic-agent container, and
no longer in the heartbeat container. See the linked issue for details.
mergify bot pushed a commit that referenced this issue Oct 21, 2021
@andrewvc
[Heartbeat] Only setuid in elastic-agent image (#28577)
6478ed4 
Fixes #28572 by only invoking setuid in the elastic-agent container, and
no longer in the heartbeat container. See the linked issue for details.

(cherry picked from commit da2bc89)
andrewvc added a commit that referenced this issue Oct 22, 2021
@mergify @andrewvc
[Heartbeat] Only setuid in elastic-agent image (#28577) (#28592)
a44d4fe 
Fixes #28572 by only invoking setuid in the elastic-agent container, and
no longer in the heartbeat container. See the linked issue for details.

(cherry picked from commit da2bc89)

Co-authored-by: Andrew Cholakian <[email protected]>
Icedroid pushed a commit to Icedroid/beats that referenced this issue Nov 1, 2021
@andrewvc
[Heartbeat] Only setuid in elastic-agent image (elastic#28577)
125c423 
Fixes elastic#28572 by only invoking setuid in the elastic-agent container, and
no longer in the heartbeat container. See the linked issue for details.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@andrewvc andrewvc

Labels
backport-v7.16.0 Automated backport with mergify bug Team:obs-ds-hosted-services Label for the Observability Hosted Services team v7.16.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Heartbeat] Only setuid in elastic-agent image andrewvc/beats
2 participants
@andrewvc @elasticmachine