elastic / elastic/cloudbeat

[KPMS] failed to get file time data, error - %woperation not permitted

Open
#1,753 0 comments 0 reactions 0 assignees View on GitHub
bug cloudbeat Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

**Motivation**
About

[example](https://qa-cycle-812-oleg-cfi-8-12-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/discover#/doc/logs-*/.ds-logs-elastic_agent.cloudbeat-default-2023.12.24-000001?id=oB4CqowByeskzjUxbUq1)

```
failed to get file time data, error - %woperation not permitted
```

It looks like there are files which we don't have permissions to perform the Stat operation.

Recommended add more context to the [log line](https://github.com/elastic/cloudbeat/blob/76d45cfdd23158a894152d79e0d995d6e2a17b77/resources/fetching/fetchers/k8s/file_system_fetcher.go#L248).

By the [frequency of the logs](https://qa-cycle-812-oleg-cfi-8-12-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/fleet/agents/87ff576e-ac13-4163-8181-88ccbffee441/logs?_q=(datasets:!(elastic_agent.cloudbeat),end:now,logLevels:!(error),query:time,start:now-1d)) looks like multiple files don't grant permission to this operation.

The impact is limited as the only non fetched information is time related https://github.com/elastic/cloudbeat/blob/76d45cfdd23158a894152d79e0d995d6e2a17b77/resources/fetching/fetchers/k8s/file_system_fetcher.go#L230-L254

**Definition of done**
- [ ] Understand which files don't have permissions
- [ ] Grant permissions if needed
- [ ] Maybe move this log line to warn

**Related tasks/epics**
- Found on https://github.com/elastic/security-team/issues/8219#issuecomment-1870039617
- Investigated on https://github.com/elastic/security-team/issues/7932#issuecomment-1871106944

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.