Exporters unpacked to /opt are not root:root

[TomaszUrugOlszewski]

trafficstars

Hello,

Most of exporters pulled from github after unpacking have owner/group different than root:root. In some specific cases non-root user can replace binary with malicious code, and run it with (sometimes, maybe) more permissions as exporter user. Or just fake diagnostic data, which can lead to other issues.

[bastelfreak]

Hi @TomaszUrugOlszewski. thanks for rising this issue. Are you able to provide a patch for this? Should the user always be root or prometheus?

[TheMeier]

IMHO this is not an issue at all. The archive is extracted as is, and the ownership for the actually binary is set uid: root, gid:0 (https://github.com/voxpupuli/puppet-prometheus/blob/master/manifests/daemon.pp#L122-L125)

If the archive comes with weird file ownerships this should be reported to the upstream providing the archive.

[TheMeier]

Closing due to inactivity