-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Handle linux capability if available #3155
Commits on Nov 9, 2020
-
capability: Implement Fluent::Capability for Linux capability handling
Currently, Fluentd core does not handle/refer Linux capability. This class should handle/refer Linux capability. Note that this class implementation is only working for Linux with libcap-ng binding (capng_c) installed platform. In other platform, this class only returns stubbed results. Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 933248a - Browse repository at this point
Copy the full SHA 933248aView commit details -
in_tail: Refer Linux capability if available
in_tail should handle Linux capbilities. In in_tail, File.readable? does not handles Linux capabilities. So, we should handle them by libcap-ng binding wrapped class which is Fluent::Capability. On in_tail, the following capabilities should be handled: * CAP_DAC_READ_SEARCH(:dac_read_search on capng_c) * CAP_DAC_OVERRIDE(:dac_override on capng_c) See also: https://man7.org/linux/man-pages/man7/capabilities.7.html Thus, if ruby executable has CAP_DAC_OVERRIDE(:dac_override on Fluent implementation) or CAP_DAC_READ_SEARCH (:dac_read_search on Fluentd implementation) capability, Fluentd can read files even if they are owned by root and 640 (-rw-r-----) mode. e.g.) syslog log file: ```console % ls -lh /var/log/syslog -rw-r----- 1 syslog adm 49K 10月 30 16:26 /var/log/syslog ``` Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for ee5e75e - Browse repository at this point
Copy the full SHA ee5e75eView commit details -
in_tail: Add test case for checking capability method
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 4ef8dde - Browse repository at this point
Copy the full SHA 4ef8ddeView commit details -
Add a Linux capability enabled environment job in Travis CI
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for d7733c4 - Browse repository at this point
Copy the full SHA d7733c4View commit details -
Use Gemfile.local instead of gem install
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 71729c1 - Browse repository at this point
Copy the full SHA 71729c1View commit details -
Use x"${VAR}" style on bash if clause
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 7b9ead6 - Browse repository at this point
Copy the full SHA 7b9ead6View commit details -
in_tail: test: Add testcase for path w/ Linux capability
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for a65bbb9 - Browse repository at this point
Copy the full SHA a65bbb9View commit details
Commits on Nov 10, 2020
-
capability: Separate class implementation
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 6d247cd - Browse repository at this point
Copy the full SHA 6d247cdView commit details -
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for e4a833a - Browse repository at this point
Copy the full SHA e4a833aView commit details -
capability: Follow capng_c argument style for CapNG#initialize
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 60d22aa - Browse repository at this point
Copy the full SHA 60d22aaView commit details -
capability: Use unspecified target on #initialize
Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
Configuration menu - View commit details
-
Copy full SHA for 9a4ad43 - Browse repository at this point
Copy the full SHA 9a4ad43View commit details