Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add non-root support in sysvinit script #4340

Merged
merged 5 commits into from
May 24, 2017

Conversation

dreampuf
Copy link
Contributor

As #4333 mentioned, I found that the sysvinit script of beats will fail on non-root user launch the beats. Cause the arguments checker will be executed as root by default.
I add an optional BEAT_USER, which may come from /etc/default/$NAME.

@andrewkroh
Copy link
Member

What provides runuser? And it is safe to assume that it is present?

@dreampuf
Copy link
Contributor Author

@andrewkroh runuser(man page) is a tool released by util-linux-2.23link . It has been provided in most popular distributions. CentOS 6+, Debian 8+, Ubuntu 16.04+.
su is another option, there are some comments of these two. Details: http://danwalsh.livejournal.com/55588.html

Basically, if Filebeat plan to support some older distribution. CentOS5/Debian7/Ubuntu14.04. su USER -c will be the option. Otherwise runuser is a better choice.

@andrewkroh
Copy link
Member

andrewkroh commented May 18, 2017

Thanks for the details on runuser vs su. We do need to support ubuntu 14.04 and debian 7. Could it test if runuser is available and fallback to su if not?

@andrewkroh andrewkroh requested a review from tsg May 18, 2017 12:06
@andrewkroh
Copy link
Member

Can you please sign the CLA (contributor license agreement)? http://www.elasticsearch.org/contributor-agreement/

@dreampuf
Copy link
Contributor Author

@andrewkroh su added. Also signed CLA.

@@ -42,8 +44,12 @@ if status | grep -q -- '-p' 2>/dev/null; then
pidopts="-p $pidfile"
fi

if [ -f /sbin/runuser ]; then
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather than explicitly stating the path, I think it would be better to use the check described here. WDYT?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point.

@@ -42,8 +44,12 @@ if status | grep -q -- '-p' 2>/dev/null; then
pidopts="-p $pidfile"
fi

if [ -f /sbin/runuser ]; then
user_wrapper="runuser"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you also need to update to user_wrapperopts="-u $beat_user"?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's same argument and order. So I can reuse user_wrapperopts here.

@dreampuf
Copy link
Contributor Author

@andrewkroh It seems like only a CLA need to be done from this checklist. But I had signed a CLA yesterday(with my github username and email address). Anything I can do?

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I'm going to wait to have @tsg review when he returns from vacation next week.

@tsg
Copy link
Contributor

tsg commented May 23, 2017

jenkins, test it

Copy link
Contributor

@tsg tsg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks for the contribution!

@tsg
Copy link
Contributor

tsg commented May 23, 2017

We should have a CHANGELOG entry on this one. @dreampuf could you add a line under the Added section, please? I can also easily add it in a follow up PR if you prefer to merge it quickly.

@tsg
Copy link
Contributor

tsg commented May 23, 2017

Jenkins test failure is not related.

@andrewkroh andrewkroh merged commit 2e9d1f7 into elastic:master May 24, 2017
@dreampuf dreampuf deleted the non-root-user-support branch March 7, 2018 16:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants