Icinga2: Allow to run cli without root

[psteffen]

Hi,

i'm build my icinga installation in a userspace and run it in the same :)

My problem is this code blog: https://github.com/Icinga/icinga2/blob/master/icinga-app/icinga.cpp#L377-L381

When i install the complete icinga installation in the user space, the cli need no access to files there are not located in my user space. So, the binary needs no root access.

Can we remove this block or make a build variable to deactive the uid check?

Best,
Patric

[dgoetz]

👍
I like the idea of checking actual permissions rather than uid as capabilities could also be removed from root.

[psteffen]

My actual solution is so set the uid with fakeroot, but i think it is not the best way, because the binary need no root permissions.

[kobmaki]

@CobbleCity another solution is to modify the source code from the extracted code directory by:

sed -i s/"getuid() != 0"/"getuid() == 0"/g icinga-app/icinga.cpp
sed -i s/"must be run as root"/"must NOT be run as root"/g icinga-app/icinga.cpp

So you shouldn't need the fakeroot.

[psteffen]

@kobmaki patches by myself are a workaround, but not a solution :)

[ip1981]

The question is why does it need root in the first place? I my setups (99.99% automated) icinga2 always runs as an unprivileged user. This "enable feature" feature is just about manipulations with files (isn't it?), icinga2's home directory always has proper owner and permissions. I ended up with fakeroot.

All this situation with root does not look sane.

[widhalmt]

ref/NC/603163

[Al2Klimov]

Please could anyone describe a real-world example of how does Icinga 2 run in a production setup w/o root?

[ip1981]

Please could anyone describe a real-world example of how does Icinga 2 run in a production setup w/o root?

https://github.com/ip1981/nixsap/blob/f030c9a9d1dad41e84e034ff4b8c6ee75d5bf3fe/modules/apps/icinga2.nix#L263 :)

[Al2Klimov]

Had to do with packaging, Docker, Puppet, ... but what the heck is that?

[Al2Klimov]

If this is something like packaging, then it's for none of the officially supported OSes – so please stick with fakeroot (in this case).

[Al2Klimov]

... or include a custom patch in your packager repo.

[dnsmichi]

I will deal with this in a customer project which is tbd.