Skip to content

[System] Mark logs-system.syslog data stream as requires root#9893

Merged
kpollich merged 3 commits intomainfrom
9886-mark-system-logs-as-requires-root
May 16, 2024
Merged

[System] Mark logs-system.syslog data stream as requires root#9893
kpollich merged 3 commits intomainfrom
9886-mark-system-logs-as-requires-root

Conversation

@kpollich
Copy link
Copy Markdown
Member

Proposed commit message

Mark logs-system.syslog data stream as requires root

Reading syslog files requires root, so if this data stream is in use the agent will require root privileges. Adding agent.privileges.root: true makes Fleet/Agent aware of the requirement for escalated privileges.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Run an agent with the system integration and verify it collects data when run as a root user. I don't think the majority of the non-root agent work is "wired up" so there won't be anything obvious to test at this time. See elastic/kibana#183283.

Related issues

Closes #9886

@kpollich kpollich added the enhancement New feature or request label May 16, 2024
@kpollich kpollich requested a review from a team May 16, 2024 11:55
@kpollich kpollich self-assigned this May 16, 2024
@kpollich kpollich requested review from a team as code owners May 16, 2024 11:55
@kpollich
Copy link
Copy Markdown
Member Author

cc @nimarezainia

@kpollich
Copy link
Copy Markdown
Member Author

Note the formatting in the diff is just the result of elastic-package check as far as I can tell, but maybe my editor autoformatted these files? I don't recall opening anything other than the main system manifest.yml and syslog/manifest.yml though so my editor didn't touch those files AFAIK. 🤷

Copy link
Copy Markdown
Contributor

@juliaElastic juliaElastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elasticmachine
Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link
Copy Markdown

💚 Build Succeeded

cc @kpollich

@elastic-sonarqube
Copy link
Copy Markdown

@kpollich kpollich merged commit 666c108 into main May 16, 2024
@elasticmachine
Copy link
Copy Markdown

Package system - 1.58.0 containing this change is available at https://epr.elastic.co/search?package=system

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:system System

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[System package] System package should indicate that it required root privilages to read system.log file

6 participants