Skip to content

Commit

Permalink
Stop running auditbeat container as root by default (elastic#21202)
Browse files Browse the repository at this point in the history
Stop running Auditbeat container as root by default. After this change,
when user root is required it will need to be explicitly set on runtime.
This is already done in Kubernetes manifests and some other examples
in the documentation, so change is probably not so breaking.
Also `USER root` is usually not enough to be fully privileged, so some
customization was always expected when running Auditbeat on docker.
  • Loading branch information
jsoriano authored Sep 24, 2020
1 parent 0c8f82b commit 6bd7090
Show file tree
Hide file tree
Showing 5 changed files with 4 additions and 4 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- File integrity dataset (macOS): Replace unnecessary `file.origin.raw` (type keyword) with `file.origin.text` (type `text`). {issue}12423[12423] {pull}15630[15630]
- Change event.kind=error to event.kind=event to comply with ECS. {issue}18870[18870] {pull}20685[20685]
- Change network.direction values to ECS recommended values (inbound, outbound). {issue}12445[12445] {pull}20695[20695]
- Docker container needs to be explicitly run as user root for auditing. {pull}21202[21202]

*Filebeat*

Expand Down
2 changes: 1 addition & 1 deletion auditbeat/docs/running-on-docker.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@ It is also essential to run {beatname_uc} in the host PID namespace.

["source","sh",subs="attributes"]
----
docker run --cap-add=AUDIT_CONTROL,AUDIT_READ --pid=host {dockerimage}
docker run --cap-add=AUDIT_CONTROL --cap-add=AUDIT_READ --user=root --pid=host {dockerimage}
----
2 changes: 1 addition & 1 deletion auditbeat/magefile.go
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ func Package() {

// TestPackages tests the generated packages (i.e. file modes, owners, groups).
func TestPackages() error {
return devtools.TestPackages(devtools.WithRootUserContainer())
return devtools.TestPackages()
}

// Update is an alias for running fields, dashboards, config, includes.
Expand Down
1 change: 0 additions & 1 deletion auditbeat/scripts/mage/package.go
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,6 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) {
args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.reference.yml", referenceConfig)
sampleRulesTarget = "/etc/{{.BeatName}}/" + defaultSampleRulesTarget
case devtools.Docker:
args.Spec.ExtraVar("user", "root")
default:
panic(errors.Errorf("unhandled package type: %v", pkgType))
}
Expand Down
2 changes: 1 addition & 1 deletion x-pack/auditbeat/magefile.go
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ func Package() {

// TestPackages tests the generated packages (i.e. file modes, owners, groups).
func TestPackages() error {
return devtools.TestPackages(devtools.WithRootUserContainer())
return devtools.TestPackages()
}

// Update is an alias for running fields, dashboards, config.
Expand Down

0 comments on commit 6bd7090

Please sign in to comment.