the permissions for the datadog-agent need to be modifiable #91649

maxgitt · 2020-06-27T02:19:40Z

Motivation for this change

I can't get any disk metrics with the user-group datadog. My system runs all daemons through root. Below is my error message that I was able to resolve by creating a permissions option in the datadog-agent module setting my services.datadog-agent.permissions = { User = "root"; Group = "root"; };

Jun 27 02:14:59 nixos zx0f096xv8lgg1wxgnwhspxq0n4lj96g-unit-script-datadog-agent-start[16394]: 2020-06-27 02:14:59 UTC | CORE | WARN | (pkg/collector/py/datadog_agent.go:148 in LogMessage) | (disk.py:107) | Unable to get disk metrics for /run/user/1000/gvfs: [Errno 13] Permission denied: '/run/user/1000/gvfs'

Things done

dasJ · 2020-06-28T00:04:29Z

nixos/modules/services/monitoring/datadog-agent.nix

+
+    permissions = mkOption {
+      description = "User and group permissions for datadog-agent";
+      type = types.attrs;


Please use a submodule so the type documents itself or switch to flat options instead of this nested approach.

updated to use a submodule. let me know if there is something more you'd like in here.

Ma27 · 2020-06-28T16:11:45Z

nixos/modules/services/monitoring/datadog-agent.nix

@@ -201,6 +201,16 @@ in {
          excluded_interfaces = [ "lo" "lo0" ]; } ];
      };
    };
+
+    permissions = mkOption {


If User/Group don't equal datadog, the datadog user shouldn't be created probably.

My thoughts are that the developer should be able to atleast set the User/Group to root. In my case, the datadog agent couldn't retrieve disk info.

Yes, but in either way a user named datadog will be created in the module and you probably don't want to create a new user that is unused then.

yeah looks like you're right. I have this unused datadog user.

Maybe I'm asking the wrong question here. Perhaps it should be, Why can't datadog access disk metrics?

Hey @Ma27 I did some digging. Here is what I have:

The datadog-agent's User/Group is datadog by default from the datadog module. The agent attempts to call into run/user/1000/gvfs or the Gnome Virtual File System. Take a look.

[myorg@myhost:/run/user]$ ll total 0 drwx------ 5 myorg myorg 100 Jun 30 07:41 1000 [myorg@myhost:/run/user/1000]$ ll total 0 drwx------ 3 myorg myorg 60 Jun 30 07:41 dbus-1 dr-x------ 2 myorg myorg 0 Jun 30 07:41 gvfs drwxr-xr-x 2 myorg myorg 80 Jun 30 19:41 systemd

Of course it makes sense that the agent doesn't have access to gvfs. I also found similar issues here and here where the fix is to either set root permissions or blacklist the offending error. So naturally I tried

[myorg@myhost:~]$ cat /etc/datadog-agent/conf.d/disk.d/conf.yaml | jq { "init_config": null, "instances": [ { "device_blacklist": [ "gvfs" ], "file_system_blacklist": [ "gvfs" ], "mount_point_blacklist": [ "gvfs" ], "use_mount": false } ] }

And, yet even after attempting to blacklist the gvfs I'm still left with the same error as before:

Jun 30 20:41:37 myhost somehash-unit-script-datadog-agent-start[32208]: 2020-06-30 20:41:37 UTC | CORE | WARN | (pkg/collector/py/datadog_agent.go:148 in LogMessage) | (disk.py:107) | Unable to get disk metrics for /run/user/1000/gvfs: [Errno 13] Permission denied: '/run/user/1000/gvfs'

I would agree that datadog shouldn't be run as root but the only solution that has worked for me thus far is modifying upstream to run datadog via root.

Without taking a look at the details, you may want to take a look at the parameters in systemd.exec(5)

I'm afraid that you're misunderstanding my point: the module creates a new user named datadog. But this shouldn't be done IMHO if you declare a user which is not named datadog.

I understand your point. The module creates a datadog user. Therefore it would be unwise to use the module and then set the User/Group to some other user i.e. root.

Then it comes down to getting the datadog user to access the /run/user/1000/gvfs which is owned by my user named myorg.

how about adding the datadog group as member to the gvfs group?

dasJ · 2020-08-05T21:19:34Z

nixos/modules/services/monitoring/datadog-agent.nix

@@ -231,7 +250,7 @@ in {
      datadog-agent = makeService {
        description = "Datadog agent monitor";
        preStart = ''
-          chown -R datadog: /etc/datadog-agent
+          chown -R ${cfg.permissions.User}: /etc/datadog-agent


Does datadog need to write to this directory? If not, you could replace this line with serviceConfig.ConfigurationDirectory = "datadog-agent" and drop the (deprecated) serviceConfig.PermissionsStartOnly

dasJ · 2020-08-05T21:25:31Z

Also, it might be easier to just do

{
  services.datadog-agent = { /* whatever */ };
  systemd.services.datadog-agent.serviceConfig = {
    # Either this (but results in an unused datadog user)
    User = "root";
    Group = "root";
    # Or this
    SupplementaryGroups = [ "myorg" ];
    # Or maybe this?
    InaccessiblePaths = [ "/run/user" ];
  };
}

This works because the module system merges all definitions (the one from your config and from this module) of systemd.services.datadog-agent.

flokli · 2020-09-25T10:04:24Z

I think adding to SupplementaryGroups from inside the datadog module, if certain checks requiring it is fine. @maxgitt, WDYT?

stale · 2021-03-26T11:27:15Z

I marked this as stale due to inactivity. → More info

the permissions for the datadog-agent need to be modifiable

a824c2d

ofborg bot added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 labels Jun 27, 2020

dasJ requested changes Jun 28, 2020

View reviewed changes

Ma27 reviewed Jun 28, 2020

View reviewed changes

submodules document themselves

0d8e933

maxgitt requested review from Ma27 and dasJ June 30, 2020 22:09

dasJ reviewed Aug 5, 2020

View reviewed changes

stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Mar 26, 2021

Janik-Haag added the 12. first-time contribution label Jun 12, 2023

stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 12, 2023

wegank added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Mar 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

the permissions for the datadog-agent need to be modifiable #91649

the permissions for the datadog-agent need to be modifiable #91649

maxgitt commented Jun 27, 2020 •

edited

dasJ Jun 28, 2020

maxgitt Jun 29, 2020

Ma27 Jun 28, 2020

maxgitt Jun 29, 2020 •

edited

Ma27 Jun 29, 2020

maxgitt Jun 29, 2020 •

edited

maxgitt Jun 30, 2020

Ma27 Jun 30, 2020

maxgitt Jun 30, 2020

Ma27 Aug 5, 2020

dasJ Aug 5, 2020

dasJ commented Aug 5, 2020

flokli commented Sep 25, 2020 •

edited

stale bot commented Mar 26, 2021

the permissions for the datadog-agent need to be modifiable #91649

Are you sure you want to change the base?

the permissions for the datadog-agent need to be modifiable #91649

Conversation

maxgitt commented Jun 27, 2020 • edited

Motivation for this change

Things done

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxgitt Jun 29, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxgitt Jun 29, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dasJ commented Aug 5, 2020

flokli commented Sep 25, 2020 • edited

stale bot commented Mar 26, 2021

maxgitt commented Jun 27, 2020 •

edited

maxgitt Jun 29, 2020 •

edited

maxgitt Jun 29, 2020 •

edited

flokli commented Sep 25, 2020 •

edited