We want to run external processes in some parts of Beats. A few cases we want to support are:

• Running a java jar to collect JMX metrics as a Metricbeat module
• Running Nagios scripts to collect metrics or health status

This issue is minded to implement a common mechanism that we can reuse in several places, with a simple API.

• Communication with the process (when needed) will be done through stdin/stdout
• We foresee using several models of running processes, so we should be able to: start/stop/kill, also be notified if they stop (including exit code)

Security model:

Running external stuff can represent an attack vector so we should put some measures in place to avoid issues, for anything that we run we should require:

• Script/binary must be owned by the same user that is running beats
• Permissions must also be strict: only be writable by the owner (we do the same check for config files)
• We should only run scripts that are located in paths that the user has configured
• We won't allow for this paths config to happen remotely (ie with fleet)
• We should explore dropping privileges when they are not needed, for instance, the code requesting to run the script must communicate the needed capabilities, the rest will be disabled
• In the same sense, it should be allowed to set a different user if beats is running as root