Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle linux capability if available #3155

Merged
merged 11 commits into from
Nov 13, 2020
Merged

Commits on Nov 9, 2020

  1. capability: Implement Fluent::Capability for Linux capability handling

    Currently, Fluentd core does not handle/refer Linux capability.
    This class should handle/refer Linux capability.
    Note that this class implementation is only working for Linux with
    libcap-ng binding (capng_c) installed platform.
    In other platform, this class only returns stubbed results.
    
    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    933248a View commit details
    Browse the repository at this point in the history
  2. in_tail: Refer Linux capability if available

    in_tail should handle Linux capbilities.
    In in_tail, File.readable? does not handles Linux capabilities.
    So, we should handle them by libcap-ng binding wrapped class
    which is Fluent::Capability.
    
    On in_tail, the following capabilities should be handled:
    
    * CAP_DAC_READ_SEARCH(:dac_read_search on capng_c)
    * CAP_DAC_OVERRIDE(:dac_override on capng_c)
    
    See also: https://man7.org/linux/man-pages/man7/capabilities.7.html
    
    Thus, if ruby executable has CAP_DAC_OVERRIDE(:dac_override on
    Fluent implementation) or CAP_DAC_READ_SEARCH (:dac_read_search on Fluentd
    implementation) capability, Fluentd can read files even if they are
    owned by root and 640 (-rw-r-----) mode.
    
    e.g.) syslog log file:
    
    ```console
    % ls -lh /var/log/syslog
    -rw-r----- 1 syslog adm 49K 10月 30 16:26 /var/log/syslog
    ```
    
    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    ee5e75e View commit details
    Browse the repository at this point in the history
  3. in_tail: Add test case for checking capability method

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    4ef8dde View commit details
    Browse the repository at this point in the history
  4. Add a Linux capability enabled environment job in Travis CI

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    d7733c4 View commit details
    Browse the repository at this point in the history
  5. Use Gemfile.local instead of gem install

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    71729c1 View commit details
    Browse the repository at this point in the history
  6. Use x"${VAR}" style on bash if clause

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    7b9ead6 View commit details
    Browse the repository at this point in the history
  7. in_tail: test: Add testcase for path w/ Linux capability

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 9, 2020
    Configuration menu
    Copy the full SHA
    a65bbb9 View commit details
    Browse the repository at this point in the history

Commits on Nov 10, 2020

  1. capability: Separate class implementation

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 10, 2020
    Configuration menu
    Copy the full SHA
    6d247cd View commit details
    Browse the repository at this point in the history
  2. in_tail: Unfold if clause

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 10, 2020
    Configuration menu
    Copy the full SHA
    e4a833a View commit details
    Browse the repository at this point in the history
  3. capability: Follow capng_c argument style for CapNG#initialize

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 10, 2020
    Configuration menu
    Copy the full SHA
    60d22aa View commit details
    Browse the repository at this point in the history
  4. capability: Use unspecified target on #initialize

    Signed-off-by: Hiroshi Hatake <hatake@clear-code.com>
    cosmo0920 committed Nov 10, 2020
    Configuration menu
    Copy the full SHA
    9a4ad43 View commit details
    Browse the repository at this point in the history