Improve sandboxing of prometheus collectors

diff --git a/cookbooks/fail2ban/recipes/default.rb b/cookbooks/fail2ban/recipes/default.rb
index ca03d37d688ee97e734d6a7ed1cac876ce2b06fa..0a4c479f469537a5d88b92b8d54c9ba2ce3f4ae8 100644 (file)
--- a/cookbooks/fail2ban/recipes/default.rb
+++ b/cookbooks/fail2ban/recipes/default.rb
@@ -49,4 +49,6 @@ munin_plugin "fail2ban"
 
 prometheus_exporter "fail2ban" do
   port 9635
+  user "root"
+  restrict_address_families "AF_UNIX"
 end

diff --git a/cookbooks/hardware/recipes/default.rb b/cookbooks/hardware/recipes/default.rb
index 6679bb178175733da48a17fce9de4c5fc95976b7..d8bfadbe5d18dc50c1821f086582fee4be1be738 100644 (file)
--- a/cookbooks/hardware/recipes/default.rb
+++ b/cookbooks/hardware/recipes/default.rb
@@ -219,6 +219,10 @@ if node[:kernel][:modules].include?("ipmi_si")
 
   prometheus_exporter "ipmi" do
     port 9290
+    user "root"
+    private_devices false
+    protect_clock false
+    system_call_filter ["@system-service", "@raw-io"]
     options "--config.file=/etc/prometheus/ipmi_local.yml"
     subscribes :restart, "template[/etc/prometheus/ipmi_local.yml]"
   end
@@ -253,6 +257,7 @@ end
 
 prometheus_exporter "rasdaemon" do
   port 9797
+  user "root"
 end
 
 tools_packages = []
@@ -530,6 +535,11 @@ if disks.count.positive?
 
   prometheus_collector "smart" do
     interval "15m"
+    user "root"
+    capability_bounding_set "CAP_SYS_ADMIN"
+    private_devices false
+    private_users false
+    protect_clock false
   end
 
   # Don't try and do munin monitoring of disks behind
@@ -688,4 +698,10 @@ end
 
 prometheus_collector "ohai" do
   interval "15m"
+  user "root"
+  proc_subset "all"
+  capability_bounding_set "CAP_SYS_ADMIN"
+  private_devices false
+  private_users false
+  protect_clock false
 end

diff --git a/cookbooks/nominatim/recipes/default.rb b/cookbooks/nominatim/recipes/default.rb
index 75f06fa568ee8371bf1b85e90eafbc5aeec42a10..537de83f5d8080e968bd312d52884a8925c4a9e9 100644 (file)
--- a/cookbooks/nominatim/recipes/default.rb
+++ b/cookbooks/nominatim/recipes/default.rb
@@ -512,6 +512,7 @@ end
 prometheus_exporter "nominatim" do
   port 8082
   user "www-data"
+  restrict_address_families "AF_UNIX"
   options [
     "--nominatim.query-log=#{node[:nominatim][:logdir]}/query.log",
     "--nominatim.database-name=#{node[:nominatim][:dbname]}"

diff --git a/cookbooks/overpass/recipes/default.rb b/cookbooks/overpass/recipes/default.rb
index 9908e330b65bcd16507a4c4c66786283f78bc85c..720b113216d342abe8f6ccec947cd0aa5f15eb28 100644 (file)
--- a/cookbooks/overpass/recipes/default.rb
+++ b/cookbooks/overpass/recipes/default.rb
@@ -250,6 +250,7 @@ end
 prometheus_exporter "overpass" do
   port 9898
   user username
+  restrict_address_families "AF_UNIX"
   options [
     "--overpass.base-directory=#{basedir}"
   ]

diff --git a/cookbooks/php/resources/fpm.rb b/cookbooks/php/resources/fpm.rb
index 49df4effe105be998f7971ca2199c3906325156d..f8cc208b51d0cf69c3580f7dd497b1575f195da6 100644 (file)
--- a/cookbooks/php/resources/fpm.rb
+++ b/cookbooks/php/resources/fpm.rb
@@ -53,6 +53,7 @@ action :create do
   if new_resource.prometheus_port
     prometheus_exporter "phpfpm" do
       port new_resource.prometheus_port
+      restrict_address_families "AF_UNIX"
       service service_name
       command "server"
       options "--phpfpm.scrape-uri=#{scrape_uri}"

diff --git a/cookbooks/postgresql/recipes/default.rb b/cookbooks/postgresql/recipes/default.rb
index 721cd6babd5cf3081909d7ebb595265d09214ee0..a57e1b3481f3918d011342bcc559940ce5cba9d6 100644 (file)
--- a/cookbooks/postgresql/recipes/default.rb
+++ b/cookbooks/postgresql/recipes/default.rb
@@ -181,5 +181,6 @@ prometheus_exporter "postgres" do
   environment "DATA_SOURCE_URI" => uris.sort.uniq.first,
               "PG_EXPORTER_AUTO_DISCOVER_DATABASES" => "true",
               "PG_EXPORTER_EXCLUDE_DATABASES" => "postgres,template0,template1"
+  restrict_address_families "AF_UNIX"
   subscribes :restart, "template[/etc/prometheus/exporters/postgres_queries.yml]"
 end

diff --git a/cookbooks/prometheus/recipes/default.rb b/cookbooks/prometheus/recipes/default.rb
index de601b766f64ea588a4dc331ca95707e727e2f28..7b281b03cb4dd07985aa7a28a95572584ae1ac02 100644 (file)
--- a/cookbooks/prometheus/recipes/default.rb
+++ b/cookbooks/prometheus/recipes/default.rb
@@ -99,6 +99,11 @@ end
 
 prometheus_exporter "node" do
   port 9100
+  user "root"
+  proc_subset "all"
+  protect_clock false
+  restrict_address_families ["AF_UNIX", "AF_NETLINK"]
+  system_call_filter ["@system-service", "@clock"]
   options %w[
     --collector.textfile.directory=/var/lib/prometheus/node-exporter
     --collector.interrupts

diff --git a/cookbooks/prometheus/resources/collector.rb b/cookbooks/prometheus/resources/collector.rb
index e82984b143354b45326bb12d47eb71c51d1fed8b..0ae8320f7ece8563979a4e1ee81a182b8db375fb 100644 (file)
--- a/cookbooks/prometheus/resources/collector.rb
+++ b/cookbooks/prometheus/resources/collector.rb
@@ -23,23 +23,33 @@ default_action :create
 
 property :collector, :kind_of => String, :name_property => true
 property :interval, :kind_of => [Integer, String], :required => [:create]
+property :user, :kind_of => String
 property :options, :kind_of => [String, Array]
 property :environment, :kind_of => Hash, :default => {}
+property :proc_subset, String
+property :capability_bounding_set, [String, Array]
+property :private_devices, [true, false]
+property :private_users, [true, false]
+property :protect_clock, [true, false]
 
 action :create do
   systemd_service service_name do
     description "Prometheus #{new_resource.collector} collector"
-    user "root"
+    user new_resource.user
+    dynamic_user new_resource.user.nil?
+    group "adm"
     environment new_resource.environment
     standard_output "file:/var/lib/prometheus/node-exporter/#{new_resource.collector}.new"
     standard_error "journal"
     exec_start "#{executable_path} #{executable_options}"
     exec_start_post "/bin/mv /var/lib/prometheus/node-exporter/#{new_resource.collector}.new /var/lib/prometheus/node-exporter/#{new_resource.collector}.prom"
-    private_tmp true
-    protect_system "strict"
-    protect_home true
+    sandbox true
+    proc_subset new_resource.proc_subset if new_resource.property_is_set?(:proc_subset)
+    capability_bounding_set new_resource.capability_bounding_set if new_resource.property_is_set?(:capability_bounding_set)
+    private_devices new_resource.private_devices if new_resource.property_is_set?(:private_devices)
+    private_users new_resource.private_users if new_resource.property_is_set?(:private_users)
+    protect_clock new_resource.protect_clock if new_resource.property_is_set?(:protect_clock)
     read_write_paths ["/var/lib/prometheus/node-exporter", "/var/lock", "/var/log"]
-    no_new_privileges true
   end
 
   systemd_timer service_name do

diff --git a/cookbooks/prometheus/resources/exporter.rb b/cookbooks/prometheus/resources/exporter.rb
index c8b4e0cd8fac96172e435fc334ab7530b6bdad0d..2d6a7cbc872876143b2f658623c49210e2391dcd 100644 (file)
--- a/cookbooks/prometheus/resources/exporter.rb
+++ b/cookbooks/prometheus/resources/exporter.rb
@@ -26,10 +26,15 @@ property :address, :kind_of => String
 property :port, :kind_of => Integer, :required => [:create]
 property :listen_switch, :kind_of => String, :default => "web.listen-address"
 property :listen_type, :kind_of => String, :default => "address"
-property :user, :kind_of => String, :default => "root"
+property :user, :kind_of => String
 property :command, :kind_of => String
 property :options, :kind_of => [String, Array]
 property :environment, :kind_of => Hash, :default => {}
+property :proc_subset, String
+property :private_devices, [true, false]
+property :protect_clock, [true, false]
+property :restrict_address_families, [String, Array]
+property :system_call_filter, [String, Array]
 property :service, :kind_of => String
 property :scrape_interval, :kind_of => String
 property :scrape_timeout, :kind_of => String
@@ -43,12 +48,15 @@ action :create do
     description "Prometheus #{new_resource.exporter} exporter"
     type "simple"
     user new_resource.user
+    dynamic_user new_resource.user.nil?
     environment new_resource.environment
     exec_start "#{executable_path} #{new_resource.command} #{executable_options}"
-    private_tmp true
-    protect_system "strict"
-    protect_home true
-    no_new_privileges true
+    sandbox :enable_network => true
+    proc_subset new_resource.proc_subset if new_resource.property_is_set?(:proc_subset)
+    private_devices new_resource.private_devices if new_resource.property_is_set?(:private_devices)
+    protect_clock new_resource.protect_clock if new_resource.property_is_set?(:protect_clock)
+    restrict_address_families new_resource.restrict_address_families if new_resource.property_is_set?(:restrict_address_families)
+    system_call_filter new_resource.system_call_filter if new_resource.property_is_set?(:system_call_filter)
   end
 
   service service_name do
@@ -140,7 +148,9 @@ action_class do
   end
 
   def listen_address
-    if new_resource.address
+    if true
+      "127.0.0.1:#{new_resource.port}"
+    elsif new_resource.address
       "#{new_resource.address}:#{new_resource.port}"
     elsif node[:prometheus][:mode] == "wireguard"
       "[#{node[:prometheus][:address]}]:#{new_resource.port}"

diff --git a/cookbooks/systemd/resources/service.rb b/cookbooks/systemd/resources/service.rb
index 94d0217c637be35b04011eb0a9ae7be0c4e47604..662528c2b81f47e417a08c2fafb83302c92f44aa 100644 (file)
--- a/cookbooks/systemd/resources/service.rb
+++ b/cookbooks/systemd/resources/service.rb
@@ -40,6 +40,7 @@ property :environment, Hash, :default => {}
 property :environment_file, [String, Hash]
 property :user, String
 property :group, String
+property :dynamic_user, [true, false]
 property :working_directory, String
 property :exec_start_pre, [String, Array]
 property :exec_start, [String, Array]

diff --git a/cookbooks/systemd/templates/default/service.erb b/cookbooks/systemd/templates/default/service.erb
index e64ead225fca2f350958f242611cc838b30b8137..1f11ffbf6bdaf1eb2be219f336bba30c81c8c4e8 100644 (file)
--- a/cookbooks/systemd/templates/default/service.erb
+++ b/cookbooks/systemd/templates/default/service.erb
@@ -54,6 +54,9 @@ User=<%= @user %>
 <% if @group -%>
 Group=<%= @group %>
 <% end -%>
+<% if @dynamic_user -%>
+DynamicUser=<%= @dynamic_user %>
+<% end -%>
 <% if @working_directory -%>
 WorkingDirectory=<%= @working_directory %>
 <% end -%>