[os packages] local permission adjustments #66614

jbudz · 2020-05-14T18:50:16Z

This adds a few specific permission changes to limit source files to the minimum. This also adds a flag to rpmbuild to pass through our repositories current permission set.

I'm running local builds here for testing now, so leaving this as draft for the moment. CI for tests.

edit: uhh, or I can forget to set is a draft. It's a draft.

elasticmachine · 2020-05-14T18:50:18Z

Pinging @elastic/kibana-operations (Team:Operations)

tylersmalley · 2020-05-14T23:50:53Z

@elasticmachine merge upstream

tylersmalley · 2020-05-20T02:54:49Z

@jbudz is this ready for review?

tylersmalley · 2020-05-20T02:55:22Z

@elasticmachine merge upstream

jbudz · 2020-05-26T16:54:49Z

I'll add builds here shortly.

jbudz · 2020-06-01T14:58:22Z

@elasticmachine merge upstream

jbudz · 2020-06-08T14:22:13Z

@elasticmachine merge upstream

tylersmalley · 2020-06-11T14:25:35Z

A couple things:

/usr/share/kibana

drwxr-xr-x   10 tyler tyler     4096 Jun 11 07:08 ./
drwxr-xr-x  137 root  root      4096 Jun 11 07:07 ../
-rw-r--r--    1 tyler tyler     2735 Jun 10 16:23 .i18nrc.json
-rw-r--r--    1 tyler tyler    13675 Jun 10 16:23 LICENSE.txt
-rw-r--r--    1 tyler tyler  1810365 Jun 10 16:23 NOTICE.txt
-rw-r--r--    1 tyler tyler     4057 Jun 10 16:23 README.txt
drwxr-xr-x    2 tyler tyler     4096 Jun 11 07:08 bin/
drwxr-xr-x    5 tyler tyler     4096 Jun 11 07:07 built_assets/
drwxr-xr-x    6 tyler tyler     4096 Jun 11 07:08 node/
drwxr-xr-x 1634 tyler tyler    73728 Jun 11 07:08 node_modules/
-rw-r--r--    1 tyler tyler      751 Jun 10 16:23 package.json
drwxr-xr-x    2 root  kibana    4096 Jun 10 16:23 plugins/
drwxr-xr-x   11 tyler tyler     4096 Jun 11 07:08 src/
drwxr-xr-x    2 tyler tyler     4096 Jun 11 07:08 webpackShims/
drwxr-xr-x    5 tyler tyler     4096 Jun 11 07:08 x-pack/

files should be owned by root:kibana

/etc/kibana should have kibana group and should not be world readable or executable.

/var/lib/kibana

drwxr-xr-x  3 root kibana 4096 Jun 11 07:07 ./
drwxr-xr-x 40 root root   4096 Jun 11 07:07 ../
drwxr-xr-x  2 root kibana 4096 Jun 11 07:08 optimize/

should not have any world permissions

tylersmalley · 2020-06-11T14:26:04Z

A separate issue I believe is related to the change of the config directory:

/usr/share/kibana  bin/kibana --optimize                                                                                                                    ✔
FATAL CLI ERROR Error: ENOENT: no such file or directory, open '/usr/share/kibana/config/kibana.yml'
    at Object.openSync (fs.js:443:3)
    at readFileSync (fs.js:343:35)
    at readYaml (/usr/share/kibana/src/core/server/config/read_config.js:34:69)
    at getConfigFromFiles (/usr/share/kibana/src/core/server/config/read_config.js:66:18)
    at RawConfigService.loadConfig (/usr/share/kibana/src/core/server/config/raw_config_service.js:51:70)
    at bootstrap (/usr/share/kibana/src/core/server/bootstrap.js:61:20)
    at Command.<anonymous> (/usr/share/kibana/src/cli/serve/serve.js:195:33)
    at Command.<anonymous> (/usr/share/kibana/src/cli/command.js:111:20)
    at Command.listener (/usr/share/kibana/node_modules/commander/index.js:291:8)
    at Command.emit (events.js:198:13)
    at Command.parseArgs (/usr/share/kibana/node_modules/commander/index.js:672:12)
    at Command.parse (/usr/share/kibana/node_modules/commander/index.js:459:21)
    at Object.<anonymous> (/usr/share/kibana/src/cli/cli.js:60:9)
    at Module._compile (internal/modules/cjs/loader.js:778:30)
    at Module._compile (/usr/share/kibana/node_modules/pirates/lib/index.js:99:24)
    at Module._extensions..js (internal/modules/cjs/loader.js:789:10)

If I resolve that with sudo mkdir -p /usr/share/kibana/data/optimize/ && sudo chown kibana:kibana /usr/share/kibana/data/optimize/, I get another error.

FATAL CLI ERROR Error: ENOENT: no such file or directory, open '/usr/share/kibana/config/kibana.yml'
    at Object.openSync (fs.js:443:3)
    at readFileSync (fs.js:343:35)
    at readYaml (/usr/share/kibana/src/core/server/config/read_config.js:34:69)
    at getConfigFromFiles (/usr/share/kibana/src/core/server/config/read_config.js:66:18)
    at RawConfigService.loadConfig (/usr/share/kibana/src/core/server/config/raw_config_service.js:51:70)
    at bootstrap (/usr/share/kibana/src/core/server/bootstrap.js:61:20)
    at Command.<anonymous> (/usr/share/kibana/src/cli/serve/serve.js:195:33)
    at Command.<anonymous> (/usr/share/kibana/src/cli/command.js:111:20)
    at Command.listener (/usr/share/kibana/node_modules/commander/index.js:291:8)
    at Command.emit (events.js:198:13)
    at Command.parseArgs (/usr/share/kibana/node_modules/commander/index.js:672:12)
    at Command.parse (/usr/share/kibana/node_modules/commander/index.js:459:21)
    at Object.<anonymous> (/usr/share/kibana/src/cli/cli.js:60:9)
    at Module._compile (internal/modules/cjs/loader.js:778:30)
    at Module._compile (/usr/share/kibana/node_modules/pirates/lib/index.js:99:24)
    at Module._extensions..js (internal/modules/cjs/loader.js:789:10)

tylersmalley

Couple more permission changes detailed in a comment.

tylersmalley · 2020-06-16T23:46:19Z

Mind also building the RPM and DEB packages while we iterate on this PR?

jbudz · 2020-07-01T21:54:21Z

Roger on the distributions, this ones taken a few builds so lets say WIP for the moment

tylersmalley · 2020-07-02T14:27:47Z

Ok, just ping me when it's ready for review.

jbudz · 2020-07-08T20:56:26Z

Good to go. note to self, eec4079 keystore setup after we've moved it to to config

LeeDr · 2020-07-09T20:28:12Z

I'm not sure if this is a bug fix or an enhancement? It missed v7.8.1 so I removed that label and added v7.9.0

tylersmalley · 2020-07-10T00:02:29Z

Looking much better!

Only thing which is odd so far is that I am missing logs in /var/log/kibana.

I see the logs in jourcalctl:

$ journalctl -u kibana.service
Jul 06 20:13:29 tyler-ubuntu systemd[1]: Started Kibana.
Jul 06 20:13:30 tyler-ubuntu kibana[4512]: {"type":"log","@timestamp":"2020-07-06T20:13:30+00:00","tags":["warning","plugins-discovery"],"pid":4512,"message":"Expect plugin \"id\"
 in camelCase, but found: beats_management"}
...

jbudz · 2020-07-13T14:03:27Z

@elasticmachine merge upstream

jbudz · 2020-07-13T14:06:12Z

#6579 👍 - we'll have to add logging.dest to kibana.yml or the CLI

* outline permissions * rm keystore setup Co-authored-by: Elastic Machine <[email protected]>

jbudz · 2020-07-13T15:55:53Z

7.x/7.9: ac93ac6

kibanamachine · 2020-07-13T17:29:29Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 4a6d15e

Build metrics

✅ unchanged

History

💚 Build #60879 succeeded 77bfe97
💚 Build #59948 succeeded 91c78be
💔 Build #58353 failed 30d7e8a850d063a9cd81a8962d18f0bd2d80d56b
💚 Build #57949 succeeded b077bb12bd51f556a8bf6422fee6abc65be5f16c
💔 Build #57940 failed abe260e1cc4ad10c985c9b89d6611882fdd3fa50

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

jbudz added Team:Operations Team label for Operations Team v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.8.0 labels May 14, 2020

jbudz requested a review from a team as a code owner May 14, 2020 18:50

spalger marked this pull request as draft May 14, 2020 18:50

jbudz force-pushed the fix/package-permissions branch from a6ab6cc to 27cb13c Compare May 26, 2020 16:51

jbudz marked this pull request as ready for review May 26, 2020 16:53

tylersmalley suggested changes Jun 11, 2020

View reviewed changes

spalger added v7.8.1 and removed v7.8.0 labels Jun 18, 2020

jbudz added 3 commits July 7, 2020 19:21

outline permissions

0702aff

rm keystore setup

eec4079

Merge branch 'master' into fix/package-permissions

91c78be

jbudz force-pushed the fix/package-permissions branch from 30d7e8a to 91c78be Compare July 8, 2020 20:55

LeeDr added v7.9.0 and removed v7.8.1 labels Jul 9, 2020

Merge branch 'master' into fix/package-permissions

77bfe97

tylersmalley approved these changes Jul 13, 2020

View reviewed changes

rm all-platforms flag

4a6d15e

jbudz merged commit 2c19feb into elastic:master Jul 13, 2020

jbudz added a commit that referenced this pull request Jul 13, 2020

[os packages] local permission adjustments (#66614)

ac93ac6

* outline permissions * rm keystore setup Co-authored-by: Elastic Machine <[email protected]>

jbudz added the backport:skip This commit does not require backporting label Jul 13, 2020

This was referenced Jul 21, 2020

World writable files being written by kibana #61267

Closed

Kibana RPM should create the files directly with the correct user/group #10422

Closed

Diazole mentioned this pull request Sep 14, 2020

Unable to create keystore #77392

Closed

jbudz mentioned this pull request Nov 19, 2020

[deb/rpm] Cleanup user management #83848

Merged

jbudz mentioned this pull request Feb 8, 2021

Kibana 7.2.0 installed from rpm package does not start with error Error code EACCES: Insufficient permissions for extracting the browser archive #40952

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[os packages] local permission adjustments #66614

[os packages] local permission adjustments #66614

jbudz commented May 14, 2020 •

edited

Loading

elasticmachine commented May 14, 2020

tylersmalley commented May 14, 2020

tylersmalley commented May 20, 2020

tylersmalley commented May 20, 2020

jbudz commented May 26, 2020

jbudz commented Jun 1, 2020

jbudz commented Jun 8, 2020

tylersmalley commented Jun 11, 2020

tylersmalley commented Jun 11, 2020 •

edited

Loading

tylersmalley left a comment

tylersmalley commented Jun 16, 2020

jbudz commented Jul 1, 2020

tylersmalley commented Jul 2, 2020

jbudz commented Jul 8, 2020

LeeDr commented Jul 9, 2020

tylersmalley commented Jul 10, 2020 •

edited

Loading

jbudz commented Jul 13, 2020

jbudz commented Jul 13, 2020

jbudz commented Jul 13, 2020

kibanamachine commented Jul 13, 2020

[os packages] local permission adjustments #66614

[os packages] local permission adjustments #66614

Conversation

jbudz commented May 14, 2020 • edited Loading

elasticmachine commented May 14, 2020

tylersmalley commented May 14, 2020

tylersmalley commented May 20, 2020

tylersmalley commented May 20, 2020

jbudz commented May 26, 2020

jbudz commented Jun 1, 2020

jbudz commented Jun 8, 2020

tylersmalley commented Jun 11, 2020

tylersmalley commented Jun 11, 2020 • edited Loading

tylersmalley left a comment

Choose a reason for hiding this comment

tylersmalley commented Jun 16, 2020

jbudz commented Jul 1, 2020

tylersmalley commented Jul 2, 2020

jbudz commented Jul 8, 2020

LeeDr commented Jul 9, 2020

tylersmalley commented Jul 10, 2020 • edited Loading

jbudz commented Jul 13, 2020

jbudz commented Jul 13, 2020

jbudz commented Jul 13, 2020

kibanamachine commented Jul 13, 2020

💚 Build Succeeded

Build metrics

History

jbudz commented May 14, 2020 •

edited

Loading

tylersmalley commented Jun 11, 2020 •

edited

Loading

tylersmalley commented Jul 10, 2020 •

edited

Loading