[Filebeat] Chmod/Chown seccomp fix

[andrewstucki]

What does this PR do?

So, to support changing the file permissions dynamically for the filebeat unix socket input under seccomp, I had previously leveraged the fact that chmod was already in our whitelist--corresponding to this call--which was initially added in this commit, and also added a whitelist entry for chown to support os.Chown.

However, interestingly enough, on Linux systems syscall.Chmod and syscall.Chown don't actually call the chown or chmod syscalls at all (good naming convention, right?). Instead they use fchownat and fchmodat--see here.

Currently filebeat is broken under seccomp without these additional entries.

Checklist

• My code follows the style guidelines of this project
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• [ ] I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[andrewstucki]

BTW, since the seccomp policy is in libbeat itself and technically this affects anything that could potentially use os.Chmod/os.Chown--I added the changelog entry to the section for "Affecting all Beats"--let me know if you want me to switch it to "Filebeat"--since it's the only beat that I know for sure uses those two standard library functions.

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20054 updated]

• Start Time: 2020-07-20T12:57:16.761+0000

• Duration: 89 min 28 sec

Test stats 🧪

Test	Results
Failed	0
Passed	17703
Skipped	1902
Total	19605

Steps errors

Expand to view the steps failures

• Name: Report to Codecov

  • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

  • Duration: 2 min 22 sec

  • Start Time: 2020-07-20T14:10:39.115+0000

  • log