Ensure CAP_CHOWN capability is included if root user is required #2331
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
| test integrations |
| Created or updated PR in integrations repository to test this version. Check elastic/integrations#12295 |
| Package healthcheck: test: "elastic-agent status" retries: 180 interval: 1s cap_drop: - ALLPackage healthcheck: test: "elastic-agent status" retries: 180 interval: 1s pid: host user: root cap_add: [AUDIT_CONTROL,AUDIT_READ,CAP_CHOWN] cap_drop: - ALLPackage healthcheck: test: "elastic-agent status" retries: 180 interval: 1s user: root cap_add: [CAP_CHOWN] cap_drop: - ALL |
💚 Build Succeeded
History
cc @mrodm |
| test integrations |
| Created or updated PR in integrations repository to test this version. Check elastic/integrations#12295 |
mrodm commented Jan 10, 2025
| // and it should not be overwritten by the value in the manifest | ||
| if info.Agent.User == "" && agentManifest.Privileges.Root { | ||
| // and it should not be overwritten by the value in the package or DataStream manifest | ||
| if info.Agent.User == "" && (r.pkgManifest.Agent.Privileges.Root || r.dataStreamManifest.Agent.Privileges.Root) { |
There was a problem hiding this comment.
Previously, it was just considered the privileges settings from package manifest. It was no taken into account the one from the data stream manifest.
mrodm changed the title 
jsoriano approved these changes Jan 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Ensure that CAP_CHOWN capability is present in the docker-compose scenario for the Elastic Agent container when the package requires or sets root privileges.
Fixes #2330
Additional:
systempackage defines root privileges in the manifest of some of its data streams: example data stream manifest linkAuthor's checklist