Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #20054 to 7.8: [Filebeat] Chmod/Chown seccomp fix #20062

Merged
merged 2 commits into from
Jul 20, 2020

Conversation

andrewstucki
Copy link

@andrewstucki andrewstucki commented Jul 20, 2020

Cherry-pick of PR #20054 to 7.8 branch. Original message:

What does this PR do?

So, to support changing the file permissions dynamically for the filebeat unix socket input under seccomp, I had previously leveraged the fact that chmod was already in our whitelist--corresponding to this call--which was initially added in this commit, and also added a whitelist entry for chown to support os.Chown.

However, interestingly enough, on Linux systems syscall.Chmod and syscall.Chown don't actually call the chown or chmod syscalls at all (good naming convention, right?). Instead they use fchownat and fchmodat--see here.

Currently filebeat is broken under seccomp without these additional entries.

Checklist

  • My code follows the style guidelines of this project
  • [ ] I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

* Fix fchmod syscall seccomp policy

* Fix chown

* Add changelog entry

(cherry picked from commit bf56f6c)
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 20, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 20, 2020

💔 Build Failed

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20062 updated]

  • Start Time: 2020-07-20T14:34:34.214+0000

  • Duration: 76 min 41 sec

Test stats 🧪

Test Results
Failed 0
Passed 9179
Skipped 1581
Total 10760

Steps errors

Expand to view the steps failures

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 2 min 22 sec

    • Start Time: 2020-07-20T15:10:49.863+0000

    • log

  • Name: Make -C libbeat testsuite

    • Description: make -C libbeat testsuite

    • Duration: 30 min 38 sec

    • Start Time: 2020-07-20T14:56:39.964+0000

    • log

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 1 min 27 sec

    • Start Time: 2020-07-20T15:22:29.147+0000

    • log

  • Name: Make -C generator/_templates/metricbeat test

    • Description: make -C generator/_templates/metricbeat test

    • Duration: 2 min 48 sec

    • Start Time: 2020-07-20T15:33:32.056+0000

    • log

  • Name: Make -C generator/_templates/beat test

    • Description: make -C generator/_templates/beat test

    • Duration: 1 min 23 sec

    • Start Time: 2020-07-20T15:38:52.919+0000

    • log

Log output

Expand to view the last 100 lines of log output

[2020-07-20T15:49:46.446Z] + [ -f packetbeat/build/coverage/full.cov ]
[2020-07-20T15:49:46.446Z] + FILE=winlogbeat/build/coverage/full.cov
[2020-07-20T15:49:46.446Z] + [ -f winlogbeat/build/coverage/full.cov ]
[2020-07-20T15:49:46.446Z] + FILE=journalbeat/build/coverage/full.cov
[2020-07-20T15:49:46.446Z] + [ -f journalbeat/build/coverage/full.cov ]
[2020-07-20T15:49:47.133Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats
[2020-07-20T15:49:47.451Z] + find . -type f -name TEST*.xml -path */build/* -delete
[2020-07-20T15:49:47.465Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Lint
[2020-07-20T15:49:47.562Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Elastic-Agent-x-pack
[2020-07-20T15:49:47.671Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Winlogbeat-oss
[2020-07-20T15:49:47.802Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-crosscompile
[2020-07-20T15:49:47.927Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Dockerlogbeat
[2020-07-20T15:49:48.042Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Generators-Metricbeat-Linux
[2020-07-20T15:49:48.156Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Journalbeat-oss
[2020-07-20T15:49:48.271Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Functionbeat-x-pack
[2020-07-20T15:49:48.380Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Elastic-Agent-x-pack-Windows
[2020-07-20T15:49:48.484Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-OSS-Unit-tests
[2020-07-20T15:49:48.595Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Heartbeat-oss
[2020-07-20T15:49:48.938Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-oss-Windows
[2020-07-20T15:49:49.036Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-x-pack
[2020-07-20T15:49:49.135Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-crosscompile
[2020-07-20T15:49:49.215Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Libbeat-x-pack
[2020-07-20T15:49:49.291Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-x-pack-Windows
[2020-07-20T15:49:49.384Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Elastic-Agent-Mac-OS-X
[2020-07-20T15:49:49.462Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-Windows
[2020-07-20T15:49:49.536Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-oss-Linux
[2020-07-20T15:49:49.611Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-x-pack-Windows
[2020-07-20T15:49:49.728Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Winlogbeat-Windows-x-pack
[2020-07-20T15:49:49.802Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Packetbeat-oss
[2020-07-20T15:49:49.888Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Winlogbeat-Windows
[2020-07-20T15:49:49.962Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-Windows
[2020-07-20T15:49:50.039Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-x-pack-Mac-OS-X
[2020-07-20T15:49:50.115Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-oss-Mac-OS-X
[2020-07-20T15:49:50.189Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-Mac-OS-X
[2020-07-20T15:49:50.265Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Generators-Beat-Linux
[2020-07-20T15:49:50.338Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Auditbeat-x-pack-Mac-OS-X
[2020-07-20T15:49:50.412Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-x-pack
[2020-07-20T15:49:50.579Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack-Windows
[2020-07-20T15:49:50.653Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-Mac-OS-X
[2020-07-20T15:49:50.725Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack-Mac-OS-X
[2020-07-20T15:49:50.799Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Filebeat-oss
[2020-07-20T15:49:50.873Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Functionbeat-Mac-OS-X-x-pack
[2020-07-20T15:49:50.948Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Libbeat-oss
[2020-07-20T15:49:51.025Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Heartbeat-Mac-OS-X
[2020-07-20T15:49:51.102Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-Python-integration-tests
[2020-07-20T15:49:51.175Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Generators-Metricbeat-Mac-OS-X
[2020-07-20T15:49:51.257Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Generators-Beat-Mac-OS-X
[2020-07-20T15:49:51.331Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-OSS-Integration-tests
[2020-07-20T15:49:51.411Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Functionbeat-Windows
[2020-07-20T15:49:51.492Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Heartbeat-Windows
[2020-07-20T15:49:51.572Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack
[2020-07-20T15:49:51.930Z] + cat
[2020-07-20T15:49:51.930Z] + /usr/local/bin/runbld ./runbld-script
[2020-07-20T15:49:51.930Z] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF8
[2020-07-20T15:49:58.529Z] runbld>>> runbld started
[2020-07-20T15:49:58.529Z] runbld>>> 1.6.12/f45d832f2ba0aa2722ab4ec1fda8ad140f027f8b
[2020-07-20T15:50:00.441Z] runbld>>> The following profiles matched the job 'Beats/beats/PR-20062' in order of occurrence in the config (last value wins).
[2020-07-20T15:50:01.826Z] runbld>>> Debug logging enabled.
[2020-07-20T15:50:01.826Z] runbld>>> Storing result
[2020-07-20T15:50:02.087Z] runbld>>> Store result: created {:total 2, :successful 2, :failed 0} 1
[2020-07-20T15:50:02.087Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200720155001-A2CF75F5
[2020-07-20T15:50:02.087Z] runbld>>> Adding system facts.
[2020-07-20T15:50:03.027Z] runbld>>> Adding vcs info for the latest commit:  e7efce485a8f40931643870fb9746e7233612eae
[2020-07-20T15:50:03.028Z] runbld>>> >>>>>>>>>>>> SCRIPT EXECUTION BEGIN >>>>>>>>>>>>
[2020-07-20T15:50:03.028Z] runbld>>> Adding /usr/lib/jvm/java-8-openjdk-amd64/bin to the path.
[2020-07-20T15:50:03.028Z] Processing JUnit reports with runbld...
[2020-07-20T15:50:03.028Z] + echo 'Processing JUnit reports with runbld...'
[2020-07-20T15:50:03.288Z] runbld>>> <<<<<<<<<<<< SCRIPT EXECUTION END <<<<<<<<<<<<
[2020-07-20T15:50:03.288Z] runbld>>> DURATION: 37ms
[2020-07-20T15:50:03.288Z] runbld>>> STDOUT: 40 bytes
[2020-07-20T15:50:03.288Z] runbld>>> STDERR: 49 bytes
[2020-07-20T15:50:03.288Z] runbld>>> WRAPPED PROCESS: SUCCESS (0)
[2020-07-20T15:50:03.288Z] runbld>>> Searching for build metadata in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats
[2020-07-20T15:50:04.672Z] runbld>>> Storing build metadata: 
[2020-07-20T15:50:04.672Z] runbld>>> Adding test report.
[2020-07-20T15:50:04.672Z] runbld>>> Searching for junit test output files with the pattern: TEST-.*\.xml$ in: /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats
[2020-07-20T15:50:06.054Z] runbld>>> Found 114 test output files
[2020-07-20T15:50:07.001Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-istio.xml
[2020-07-20T15:50:07.001Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-openmetrics.xml
[2020-07-20T15:50:07.001Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-tomcat.xml
[2020-07-20T15:50:07.001Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-cloudfoundry.xml
[2020-07-20T15:50:07.263Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-activemq.xml
[2020-07-20T15:50:07.263Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-x-pack/x-pack/metricbeat/build/TEST-go-integration-iis.xml
[2020-07-20T15:50:07.525Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-OSS-Integration-tests/metricbeat/build/TEST-go-integration-graphite.xml
[2020-07-20T15:50:07.525Z] runbld>>> No testsuite node found in /var/lib/jenkins/workspace/Beats_beats_PR-20062/src/github.com/elastic/beats/Metricbeat-OSS-Integration-tests/metricbeat/build/TEST-go-integration-windows.xml
[2020-07-20T15:50:08.095Z] runbld>>> Test output logs contained: Errors: 0 Failures: 0 Tests: 10610 Skipped: 1344
[2020-07-20T15:50:08.095Z] runbld>>> Storing result
[2020-07-20T15:50:08.095Z] runbld>>> FAILURES: 0
[2020-07-20T15:50:08.355Z] runbld>>> Store result: updated {:total 2, :successful 2, :failed 0} 2
[2020-07-20T15:50:08.355Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200720155001-A2CF75F5
[2020-07-20T15:50:08.616Z] runbld>>> Email notification disabled by environment variable.
[2020-07-20T15:50:08.616Z] runbld>>> Slack notification disabled by environment variable.
[2020-07-20T15:50:14.185Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats_PR-20062
[2020-07-20T15:50:14.295Z] [INFO] getVaultSecret: Getting secrets
[2020-07-20T15:50:14.378Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-07-20T15:50:15.096Z] + chmod 755 generate-build-data.sh
[2020-07-20T15:50:15.096Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-20062/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-20062/runs/2 FAILURE 4540623
[2020-07-20T15:50:15.096Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-20062/runs/2/steps/?limit=10000 -o steps-info.json
[2020-07-20T15:50:16.958Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-20062/runs/2/tests/?status=FAILED -o tests-errors.json
[2020-07-20T15:50:17.208Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-20062/runs/2/log/ -o pipeline-log.txt

@andrewstucki andrewstucki merged commit 94f7632 into elastic:7.8 Jul 20, 2020
@andrewstucki andrewstucki deleted the backport_20054_7.8 branch July 20, 2020 16:05
@zube zube bot removed the [zube]: Done label Oct 19, 2020
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
…lastic#20062)

* [Filebeat] Chmod/Chown seccomp fix (elastic#20054)

* Fix fchmod syscall seccomp policy

* Fix chown

* Add changelog entry

(cherry picked from commit f4b2c48)

* fix changelog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants