search

prometheus-community / smartctl_exporter

Export smartctl statistics to prometheus
Apache License 2.0
311 stars 89 forks source link

Running exporter as non-root? sudo for calls to smartctl? #146

Open frittentheke opened 1 year ago

frittentheke commented 1 year ago

I was wondering if it was really necessary to run the whole smartctl_exporter as root. This is even promoted via the provided systemd unit https://github.com/prometheus-community/smartctl_exporter/blob/master/systemd/smartctl_exporter.service

I know smartctl does seem to require this (https://github.com/smartmontools/smartmontools/issues/205). But maybe there is a way to not require for the exporter to run as root but to just call a privileged smartctl? Is the good old sudo the right approach? Just by setting smartctl.path to sudo smartctl.path maybe?

lahwaacz commented 1 year ago

You can easily switch various security features of the systemd service to see what works and what not. I don't see an advantage in adding another layer with sudo...

NiceGuyIT commented 1 year ago

Adding sudo to the exporter is not going to happen.

As suggested by @lahwaacz, if you figure out how to configure systemd to improve the security, PRs are welcome!

k0ste commented 1 year ago

@frittentheke FYI prometheus-smartctl-exporter.service in AUR If you can test it, tune it, PR it - it can be part of smartctl_exporter tarball

frittentheke commented 1 year ago

I see my provocation of creativity by just mentioning sudo worked :-). Thanks for taking the quest to reduce the privileges seriously and let's see if there is something that could work for most installs.

DaAwesomeP commented 1 year ago

The AUR service unit looks very promising! Unfortunately I am not able to test/pull at this time.

The full documentation of these options can he found here: https://www.freedesktop.org/software/systemd/man/systemd.exec.html

Note that not all distros ship the latest Systemd, so newer options may result in warnings in the journal. However, in my experience it is backward-compatible without issue (you may not get all of the security features but still as many as possible).

subnix commented 9 months ago

I'm looking for a secure way to run the exporter too. These privileges are required for smartctl:

  1. CAP_SYS_RAWIO capability to be able to access raw devices;
  2. disk user group, which owns all the disks.

So you can add these lines to the systemd unit:

[Service]
...
CapabilityBoundingSet=CAP_SYS_RAWIO
AmbientCapabilities=CAP_SYS_RAWIO
Group=disk
...

But this set of privileges may lead to privilege escalation since root filesystem is accessible for writing. So sudo with limiting sudoers configuration still looks more secure.