Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PMM-12529 run pmm-agent as non-root #2585

Closed
wants to merge 7 commits into from
Closed

PMM-12529 run pmm-agent as non-root #2585

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fee1ee1
PMM-12529 run pmm-agent as non-root
ademidoff Oct 31, 2023
11a419d
PMM-12529 fix the tests
ademidoff Oct 31, 2023
659a26c
Merge branch 'main' into PMM-12529-run-pmm-agent-as-non-root
ademidoff Oct 31, 2023
ec71373
Merge branch 'main' into PMM-12529-run-pmm-agent-as-non-root
ademidoff Oct 31, 2023
48b3bfd
Merge branch 'main' into PMM-12529-run-pmm-agent-as-non-root
ademidoff Oct 31, 2023
ad9a72c
PMM-12529 update create_users.sh as well
ademidoff Nov 1, 2023
fe01d68
Merge branch 'PMM-12529-run-pmm-agent-as-non-root' of github.com:perc…
ademidoff Nov 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions build/ansible/roles/pmm2-images/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,10 +100,10 @@
non_unique: true
loop:
- { name: pmm, gid: 1000 }
- { name: pmm-agent, gid: 1001 }
Copy link
Member Author

@ademidoff ademidoff Oct 31, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a dirty hack a year ago, which resulted in non-unique group and user ids.
In particular, pmm-agent overlaps with ssh_keys in RHEL9:

[root@pmm-server pmm] # ls -la /usr/local/percona/pmm2
total 48
drwxr-xr-x 1 pmm-agent ssh_keys 4096 Oct 31 08:40 .
drwxr-xr-x 1 pmm-agent ssh_keys 4096 Oct 31 08:37 ..
drwxr-xr-x 2 pmm-agent ssh_keys 4096 Oct 31 08:37 bin
drwxr-xr-x 1 pmm-agent ssh_keys 4096 Oct 31 08:38 cache
drwxr-xr-x 4 pmm-agent ssh_keys 4096 Oct 31 08:37 collectors
drwxr-xr-x 1 pmm-agent ssh_keys 4096 Oct 31 09:39 config
drwxr-xr-x 2 pmm-agent ssh_keys 4096 Oct 31 08:37 exporters
drwx------ 1 pmm-agent ssh-keys 4096 Oct 31 09:43 tmp
drwxr-xr-x 2 pmm-agent ssh_keys 4096 Oct 31 08:37 tools

I believe we'd better change it so it doesn't come in conflict with the existing groups.

- { name: nginx, gid: 999 }
- { name: grafana, gid: 998 }
- { name: clickhouse, gid: 997 }
- { name: pmm-agent, gid: 996 }

- name: Create users | Create users
user:
Expand All @@ -116,10 +116,10 @@
non_unique: true
loop:
- { name: pmm, uid: 1000, comment: "PMM Server", shell: "/bin/false", home: "/home/pmm", group: pmm, }
- { name: pmm-agent, uid: 1001, comment: "pmm-agent", shell: "/bin/false", home: "/usr/local/percona/", group: pmm-agent, }
- { name: nginx, uid: 999, comment: "nginx user", shell: "/sbin/nologin", home: "/var/cache/nginx", group: nginx, }
- { name: grafana, uid: 998, comment: "Grafana Dashboard", shell: "/sbin/nologin", home: "/etc/grafana", group: grafana, }
- { name: clickhouse, uid: 997, comment: "Clickhouse server", shell: "/sbin/nologin", home: "/var/lib/clickhouse", group: clickhouse, }
- { name: pmm-agent, uid: 996, comment: "pmm-agent", shell: "/bin/false", home: "/usr/local/percona/", group: pmm-agent, }
when: ansible_virtualization_type == "docker"

- name: Create directories | Create dirs
Expand Down
1 change: 1 addition & 0 deletions managed/services/supervisord/pmm_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,7 @@ redirect_stderr = true
[program:pmm-agent]
priority = 15
command = /usr/sbin/pmm-agent --config-file=/usr/local/percona/pmm2/config/pmm-agent.yaml
user = pmm-agent
autorestart = true
autostart = true
startretries = 1000
Expand Down
1 change: 1 addition & 0 deletions managed/testdata/supervisord.d/pmm-db_disabled.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ redirect_stderr = true
[program:pmm-agent]
priority = 15
command = /usr/sbin/pmm-agent --config-file=/usr/local/percona/pmm2/config/pmm-agent.yaml
user = pmm-agent
autorestart = true
autostart = true
startretries = 1000
Expand Down
1 change: 1 addition & 0 deletions managed/testdata/supervisord.d/pmm-db_enabled.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ redirect_stderr = true
[program:pmm-agent]
priority = 15
command = /usr/sbin/pmm-agent --config-file=/usr/local/percona/pmm2/config/pmm-agent.yaml
user = pmm-agent
autorestart = true
autostart = true
startretries = 1000
Expand Down