Werk #13131: custom_files: Fix permissions of custom deployed agent plugins
|Title||custom_files: Fix permissions of custom deployed agent plugins|
|Date||Dec 13, 2021|
|Checkmk Editon||Checkmk Enterprise (CEE)|
|Checkmk Version||2.0.0p18 2.1.0i1|
|Compatibility||Compatible - no manual interaction needed|
This Werk fixes a regression that was introduced with Checkmk 2.0.0. Only agent installations that need to call agent plugins with a non-root user are affected.
When deploying custom files with the "Deploy custom files with agent" agent rule, one would expect files placed under pkgname/lib/plugins/ to be deployed as plugin files.
This only partially held true before, because files placed under the plugins subfolder weren't recognized as actual plugins. While lib files are deployed with a permissions of 0640, plugin files are to be deployed with permissions of 0755, which was not done for custom deployed files.
However, as the executable flag of all custom files is maintained during deployment, the plugins are (if placed as executable on the Checkmk site) still executable on the hosts, but without being accessible to non-root users. Hence, it was not possible to use the agent rule "Plugins, local checks and MRPE for non-root users" or other techniques that need to call plugins with a non-root user in combination with custom deployed plugin files.
Files under pkgname/lib/plugins now are deployed permissions of 0755, regardless of the initial permissions when placed at the custom files directory on the site.To the list of all Werks