elastic / elastic/logstash

upstart file umask results in unwritable sock files for other users

Open
#6,358 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
1d 4h
Merged PRs (30d)
88

Description

This is specific to Ubuntu 14.04 LTS, but may also apply to other systems using Upstart.

I tested this with logstash 1:5.0.0~rc1-1 from `https://artifacts.elastic.co/packages/5.x-prerelease/apt/ stable/main` on Ubuntu 14.04.3 LTS running `Linux 3.13.0-63-generic #103-Ubuntu SMP Fri Aug 14 21:42:59 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux`

When the unix plugin creates a file, due to the`umask` which gets set to `022` by upstart ( http://upstart.ubuntu.com/cookbook/#umask ), the socket file for incoming log lines is only writable by the `logstash` user. Here is the complete `/etc/init/logstash.conf` which gets created by https://github.com/jordansissel/pleaserun based on the template which ends up in `/etc/logstash/startup.options`:

```
description "logstash"
start on filesystem or runlevel [2345]
stop on runlevel [!2345]

respawn
umask 022
nice 19
chroot /
chdir /
#limit msgqueue
#limit nice
limit nofile 16384 16384
#limit rtprio
#limit sigpending
setuid logstash
setgid logstash
console log # log stdout/stderr to /var/log/upstart/

exec /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
```

The result should be `umask 002` instead of `umask 022` , which would allow any users part of the `logstash` group (in this [default] case) to write to the socket file.

Here is an example of a config which creates a socket file which this can be tested with:
```
input {
unix {
type => "foo"
path => "/tmp/logstash.sock"
codec => json {
charset => "UTF-8"
}
}
}
```

Letting logstash start with this config results in `/tmp/logstash.sock` having permissions as follows:

```
# stat /tmp/logstash.sock
File: ‘/tmp/logstash.sock’
Size: 0 Blocks: 0 IO Block: 4096 socket
Device: ca01h/51713d Inode: 12121 Links: 1
Access: (0755/srwxr-xr-x) Uid: ( 999/logstash) Gid: ( 999/logstash)
Access: 2016-12-06 02:28:15.391459999 +0000
Modify: 2016-12-06 02:28:15.391459999 +0000
Change: 2016-12-06 02:28:15.391459999 +0000
Birth: -
```

Possibly related: https://github.com/logstash-plugins/logstash-input-unix/issues/1

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with the generated /etc/init/logstash.conf and the /etc/logstash/startup.options template, following the pleaserun template link to identify where umask 022 is set. Reproduce the unix input example and verify that /tmp/logstash.sock is group-writable; done means the generated Upstart configuration uses umask 002 and the socket permissions allow logstash-group users to write.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, ubuntu
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.