Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set permissions on the Grafana Agent [Flow] folder... #6540

Merged
merged 9 commits into from
Feb 29, 2024
Merged

Set permissions on the Grafana Agent [Flow] folder... #6540

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2735625
Set permissions on the folder when installing via the windows instal…
erikbaranowski Feb 27, 2024
5e2c68f
Merge branch 'main' into windows-installer-security-fix
erikbaranowski Feb 27, 2024
4b4e649
Update CHANGELOG.md
erikbaranowski Feb 27, 2024
187664c
Merge branch 'main' into windows-installer-security-fix
erikbaranowski Feb 28, 2024
3bef120
Update the build image with the nsis plugin instead of installing it …
erikbaranowski Feb 29, 2024
098b6bc
Merge branch 'windows-installer-security-fix' of https://github.com/g…
erikbaranowski Feb 29, 2024
25ebb1b
Update build image version
erikbaranowski Feb 29, 2024
8d91657
Merge branch 'main' into windows-installer-security-fix
erikbaranowski Feb 29, 2024
df586be
remote build image changes from this PR
erikbaranowski Feb 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
118 changes: 59 additions & 59 deletions .drone/drone.yml
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ Main (unreleased)

### Bugfixes

- Set permissions on the `Grafana Agent [Flow]` folder when installing via the
windows installer rather than relying on the parent folder permissions. (@erikbaranowski)

- Fix an issues where the logging config block would trigger an error when trying to send logs to components that were not running. (@wildum)

- Fix an issue where a custom component might be wired to a local declare instead of an import declare when they have the same label. (@wildum)
Expand Down
2 changes: 1 addition & 1 deletion cmd/grafana-agent-operator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# default when running `docker buildx build` or when DOCKER_BUILDKIT=1 is set
# in environment variables.

FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.32.0 as build
FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.33.0 as build
ARG BUILDPLATFORM
ARG TARGETPLATFORM
ARG TARGETOS
Expand Down
2 changes: 1 addition & 1 deletion cmd/grafana-agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# default when running `docker buildx build` or when DOCKER_BUILDKIT=1 is set
# in environment variables.

FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.32.0 as build
FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.33.0 as build
ARG BUILDPLATFORM
ARG TARGETPLATFORM
ARG TARGETOS
Expand Down
2 changes: 1 addition & 1 deletion cmd/grafana-agent/Dockerfile.windows
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM grafana/agent-build-image:0.32.0-windows as builder
FROM grafana/agent-build-image:0.33.0-windows as builder
ARG VERSION
ARG RELEASE_BUILD=1

Expand Down
2 changes: 1 addition & 1 deletion cmd/grafana-agentctl/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# default when running `docker buildx build` or when DOCKER_BUILDKIT=1 is set
# in environment variables.

FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.32.0 as build
FROM --platform=$BUILDPLATFORM grafana/agent-build-image:0.33.0 as build
ARG BUILDPLATFORM
ARG TARGETPLATFORM
ARG TARGETOS
Expand Down
2 changes: 1 addition & 1 deletion cmd/grafana-agentctl/Dockerfile.windows
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM grafana/agent-build-image:0.32.0-windows as builder
FROM grafana/agent-build-image:0.33.0-windows as builder
ARG VERSION
ARG RELEASE_BUILD=1

Expand Down
15 changes: 15 additions & 0 deletions packaging/grafana-agent-flow/windows/install_script.nsis
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,8 @@ Section "install"
# Auto-restart agent on failure. Reset failure counter after 60 seconds without failure
nsExec::ExecToLog `sc failure "Grafana Agent Flow" reset= 60 actions= restart/5000 reboot= "Grafana Agent Flow has failed. Restarting in 5 seconds"`
Pop $0

Call SetFolderPermissions
SectionEnd

Function CreateConfig
Expand Down Expand Up @@ -164,6 +166,19 @@ Function InitializeRegistry
Return
FunctionEnd

Function SetFolderPermissions
# Set permissions on the install directory
SetOutPath $INSTDIR
AccessControl::DisableFileInheritance $INSTDIR
AccessControl::SetFileOwner $INSTDIR "Administrators"
AccessControl::ClearOnFile $INSTDIR "Administrators" "FullAccess"
AccessControl::SetOnFile $INSTDIR "SYSTEM" "FullAccess"
AccessControl::GrantOnFile $INSTDIR "Everyone" "ListDirectory"
AccessControl::GrantOnFile $INSTDIR "Everyone" "GenericExecute"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GenericExecute sounds scary?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also hate that GrantOnFile is both file and directory, made me look up the docs on this.

AccessControl::GrantOnFile $INSTDIR "Everyone" "GenericRead"
AccessControl::GrantOnFile $INSTDIR "Everyone" "ReadAttributes"
FunctionEnd

# Automatically called when uninstalling.
Function un.onInit
SetShellVarContext all
Expand Down
15 changes: 15 additions & 0 deletions packaging/grafana-agent/windows/install_script.nsis
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,8 @@ Function Install
# Auto-restart agent on failure. Reset failure counter after 60 seconds without failure
nsExec::ExecToLog `sc failure "Grafana Agent" reset= 60 actions= restart/5000 reboot= "Grafana Agent has failed. Restarting in 5 seconds"`
Pop $0

Call SetFolderPermissions
FunctionEnd

Function WriteConfig
Expand Down Expand Up @@ -189,6 +191,19 @@ Function WriteConfig
Return
FunctionEnd

Function SetFolderPermissions
# Set permissions on the install directory
SetOutPath $INSTDIR
AccessControl::DisableFileInheritance $INSTDIR
AccessControl::SetFileOwner $INSTDIR "Administrators"
AccessControl::ClearOnFile $INSTDIR "Administrators" "FullAccess"
AccessControl::SetOnFile $INSTDIR "SYSTEM" "FullAccess"
AccessControl::GrantOnFile $INSTDIR "Everyone" "ListDirectory"
AccessControl::GrantOnFile $INSTDIR "Everyone" "GenericExecute"
AccessControl::GrantOnFile $INSTDIR "Everyone" "GenericRead"
AccessControl::GrantOnFile $INSTDIR "Everyone" "ReadAttributes"
FunctionEnd

# Uninstaller
Function un.onInit
SetShellVarContext all
Expand Down
2 changes: 1 addition & 1 deletion tools/make/build-container.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
# variable names should be passed through to the container.

USE_CONTAINER ?= 0
BUILD_IMAGE_VERSION ?= 0.32.0
BUILD_IMAGE_VERSION ?= 0.33.0
BUILD_IMAGE ?= grafana/agent-build-image:$(BUILD_IMAGE_VERSION)
DOCKER_OPTS ?= -it

Expand Down
4 changes: 2 additions & 2 deletions tools/make/packaging.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,7 +400,7 @@ ifeq ($(USE_CONTAINER),1)
else
cp ./dist/grafana-agent-windows-amd64.exe ./packaging/grafana-agent/windows
cp LICENSE ./packaging/grafana-agent/windows
# quotes around mkdir are manadory. ref: https://github.com/grafana/agent/pull/5664#discussion_r1378796371
# quotes around mkdir are mandatory. ref: https://github.com/grafana/agent/pull/5664#discussion_r1378796371
"mkdir" -p dist
makensis -V4 -DVERSION=$(VERSION) -DOUT="../../../dist/grafana-agent-installer.exe" ./packaging/grafana-agent/windows/install_script.nsis
endif
Expand All @@ -410,7 +410,7 @@ dist-agent-flow-installer: dist.temp/grafana-agent-flow-windows-amd64.exe dist.t
ifeq ($(USE_CONTAINER),1)
$(RERUN_IN_CONTAINER)
else
# quotes around mkdir are manadory. ref: https://github.com/grafana/agent/pull/5664#discussion_r1378796371
# quotes around mkdir are mandatory. ref: https://github.com/grafana/agent/pull/5664#discussion_r1378796371
"mkdir" -p dist
makensis -V4 -DVERSION=$(VERSION) -DOUT="../../../dist/grafana-agent-flow-installer.exe" ./packaging/grafana-agent-flow/windows/install_script.nsis
endif
Loading