No certs picked up if one of the certificates in a directory has wrong SELinux context set

[barlik]

Description Exporter fails to examine all certificates in a directory when there's a single file with wrong SELinux context set.

Steps to reproduce the issue:

1. Prepare a directory with some certificates.
2. Make sure that SELinux runs in enforcing mode setenforce 1
3. Change the context of one of the certificates chcon -t admin_home_t /etc/origin/test-bundle.crt
4. Run the exporter within a different context runcon -u system_u -r system_r -t container_t ./node-cert-exporter-linux-amd64 --path /etc/origin/
5. Query the exporter
6. There's no metrics for any of the certs in the directory.

Describe the results you received: No metrics exposed.

Describe the results you expected: Metrics exposed for all certificates barring the single cert (file) with wrong file permissions (SELinux context).

Additional information:

Output of node-cert-exporter --version:

Version: 1.0.0
Commit: 45a23445d365cb7f1db9e3e6d55666f759e1fc99
Branch: master
GoVersion: 1.15.2

Additional environment details: Red Hat Enterprise Linux Server release 7.6

[amimof]

Thanks for reporting. Sounds similar to #42

[amimof]

@barlik Have you tried v1.0.1?

[barlik]

Hi, I've just tried v1.0.1 and the issue is still present.

Version: 0ee95f1
Commit: 0ee95f156d30ff3b2d7fad2a114c98ad4bab341a
Branch: HEAD
GoVersion: 1.13

Had a look at the code, the problem seems to be here: https://github.com/amimof/node-cert-exporter/blob/d25cd15ea624cf023f11cfbc0be3648fc27b1b46/pkg/exporter/exporter.go#L26 where filepath.Walk function calls lstat() on every file in a directory, but SELinux blocks lstat() calls when a file has incorrect SELinux context. This then causes Walk function to prematurely exit a couple of lines later.

err := filepath.Walk(p, func(path string, info os.FileInfo, err error) error {
...
        if err != nil {
            return err
        }
...
    })
    if err != nil {
        return nil, err
    }

BTW: v1.0.1 seems to have been built using a git hash that's no longer available.

[amimof]

@barlik Yeah I discovered the same thing. Thanks for the PR. v1.0.1 should be this commit https://github.com/amimof/node-cert-exporter/commit/d25cd15ea624cf023f11cfbc0be3648fc27b1b46