Bug 229335

Summary: net-mgmt/telegraf: should probably not run as root ..?
Product: Ports & Packages Reporter: Julien Cigar <julien>
Component: Individual Port(s)Assignee: Palle Girgensohn <girgen>
Status: Closed FIXED    
Severity: Affects Some People Flags: bugzilla: maintainer-feedback? (girgen)
Priority: ---    
Version: Latest   
Hardware: Any   
OS: Any   

Description Julien Cigar 2018-06-25 13:48:16 UTC 
Hello,

I'm wondering if running Telegraf as root by default is really appropriate ? I understand that it could cause a lot of permission "issues" to read certains metrics, but still, running arbitrary scripts as root through the exec plugin for instance looks scary to me ..

I'm wondering if it would it be possible to add the creation of a dedicated user in the ports, and a telegraf_user="telegraf" in the rc.d script ?

Thanks!
Comment 1 Palle Girgensohn freebsd_committer freebsd_triage 2018-06-25 14:48:59 UTC 
It might work to run it as `nobody`. I need to check. It shouldn't really need a special user, but as you say, that depends on what metrics you read from the system.

Barring that is doesn't work, I'm inclined to add an option telegraf_user and default to nobody.
Comment 2 Julien Cigar 2018-06-25 15:04:01 UTC 
(In reply to Palle Girgensohn from comment #1)

Thank you for your quick reply.

Adding a special (dedicated) user would be easier for usage with sudo (as suggested by many plugins, see https://github.com/influxdata/telegraf/tree/master/plugins/inputs/pf for example)
Comment 3 Palle Girgensohn freebsd_committer freebsd_triage 2018-06-25 15:50:37 UTC 
(In reply to Julien Cigar from comment #2)

Ah, of course. I see. I haven't used any of the modules suggesting sudo... I'll look into it.