Skip to content

Ensure CAP_CHOWN capability is included if root user is required #2331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 13, 2025
Merged

Ensure CAP_CHOWN capability is included if root user is required #2331

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d7a9e19
Ensure CAP_CHOWN is included if root user is required
mrodm Jan 10, 2025
7b6901d
Take into account root privileges set in datastream manifest
mrodm Jan 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions internal/testrunner/runners/system/tester.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,7 +436,7 @@ func (r *tester) createServiceOptions(variantName string) servicedeployer.Factor
}
}

func (r *tester) createAgentInfo(policy *kibana.Policy, config *testConfig, runID string, agentManifest packages.Agent) (agentdeployer.AgentInfo, error) {
func (r *tester) createAgentInfo(policy *kibana.Policy, config *testConfig, runID string) (agentdeployer.AgentInfo, error) {
var info agentdeployer.AgentInfo

info.Name = r.testFolder.Package
Expand All @@ -456,11 +456,18 @@ func (r *tester) createAgentInfo(policy *kibana.Policy, config *testConfig, runI
info.Agent.AgentSettings = config.Agent.AgentSettings

// If user is defined in the configuration file, it has preference
// and it should not be overwritten by the value in the manifest
if info.Agent.User == "" && agentManifest.Privileges.Root {
// and it should not be overwritten by the value in the package or DataStream manifest
if info.Agent.User == "" && (r.pkgManifest.Agent.Privileges.Root || r.dataStreamManifest.Agent.Privileges.Root) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, it was just considered the privileges settings from package manifest. It was no taken into account the one from the data stream manifest.

info.Agent.User = "root"
}

if info.Agent.User == "root" {
// Ensure that CAP_CHOWN is present if the user for testing is root
if !slices.Contains(info.Agent.LinuxCapabilities, "CAP_CHOWN") {
info.Agent.LinuxCapabilities = append(info.Agent.LinuxCapabilities, "CAP_CHOWN")
}
}

// This could be removed once package-spec adds this new field
if !slices.Contains([]string{"", "default", "complete", "systemd"}, info.Agent.BaseImage) {
return agentdeployer.AgentInfo{}, fmt.Errorf("invalid value for agent.base_image: %q", info.Agent.BaseImage)
Expand Down Expand Up @@ -1053,7 +1060,7 @@ func (r *tester) prepareScenario(ctx context.Context, config *testConfig, svcInf
policy = policyCurrent
}

agentDeployed, agentInfo, err := r.setupAgent(ctx, config, serviceStateData, policy, r.pkgManifest.Agent)
agentDeployed, agentInfo, err := r.setupAgent(ctx, config, serviceStateData, policy)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -1392,7 +1399,7 @@ func (r *tester) setupService(ctx context.Context, config *testConfig, serviceOp
return service, service.Info(), nil
}

func (r *tester) setupAgent(ctx context.Context, config *testConfig, state ServiceState, policy *kibana.Policy, agentManifest packages.Agent) (agentdeployer.DeployedAgent, agentdeployer.AgentInfo, error) {
func (r *tester) setupAgent(ctx context.Context, config *testConfig, state ServiceState, policy *kibana.Policy) (agentdeployer.DeployedAgent, agentdeployer.AgentInfo, error) {
if !r.runIndependentElasticAgent {
return nil, agentdeployer.AgentInfo{}, nil
}
Expand All @@ -1401,7 +1408,7 @@ func (r *tester) setupAgent(ctx context.Context, config *testConfig, state Servi
agentRunID = state.AgentRunID
}
logger.Debug("setting up independent Elastic Agent...")
agentInfo, err := r.createAgentInfo(policy, config, agentRunID, agentManifest)
agentInfo, err := r.createAgentInfo(policy, config, agentRunID)
if err != nil {
return nil, agentdeployer.AgentInfo{}, err
}
Expand Down