upstart file umask results in unwritable sock files for other users
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 88
Description
This is specific to Ubuntu 14.04 LTS, but may also apply to other systems using Upstart.
I tested this with logstash 1:5.0.0~rc1-1 from `https://artifacts.elastic.co/packages/5.x-prerelease/apt/ stable/main` on Ubuntu 14.04.3 LTS running `Linux 3.13.0-63-generic #103-Ubuntu SMP Fri Aug 14 21:42:59 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux`
When the unix plugin creates a file, due to the`umask` which gets set to `022` by upstart ( http://upstart.ubuntu.com/cookbook/#umask ), the socket file for incoming log lines is only writable by the `logstash` user. Here is the complete `/etc/init/logstash.conf` which gets created by https://github.com/jordansissel/pleaserun based on the template which ends up in `/etc/logstash/startup.options`:
```
description "logstash"
start on filesystem or runlevel [2345]
stop on runlevel [!2345]
respawn
umask 022
nice 19
chroot /
chdir /
#limit msgqueue
#limit nice
limit nofile 16384 16384
#limit rtprio
#limit sigpending
setuid logstash
setgid logstash
console log # log stdout/stderr to /var/log/upstart/
exec /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
```
The result should be `umask 002` instead of `umask 022` , which would allow any users part of the `logstash` group (in this [default] case) to write to the socket file.
Here is an example of a config which creates a socket file which this can be tested with:
```
input {
unix {
type => "foo"
path => "/tmp/logstash.sock"
codec => json {
charset => "UTF-8"
}
}
}
```
Letting logstash start with this config results in `/tmp/logstash.sock` having permissions as follows:
```
# stat /tmp/logstash.sock
File: ‘/tmp/logstash.sock’
Size: 0 Blocks: 0 IO Block: 4096 socket
Device: ca01h/51713d Inode: 12121 Links: 1
Access: (0755/srwxr-xr-x) Uid: ( 999/logstash) Gid: ( 999/logstash)
Access: 2016-12-06 02:28:15.391459999 +0000
Modify: 2016-12-06 02:28:15.391459999 +0000
Change: 2016-12-06 02:28:15.391459999 +0000
Birth: -
```
Possibly related: https://github.com/logstash-plugins/logstash-input-unix/issues/1
Thanks!
Contributor guide
Research direction
Start with the generated /etc/init/logstash.conf and the /etc/logstash/startup.options template, following the pleaserun template link to identify where umask 022 is set. Reproduce the unix input example and verify that /tmp/logstash.sock is group-writable; done means the generated Upstart configuration uses umask 002 and the socket permissions allow logstash-group users to write.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, ubuntu
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100