Comments (7)
Removing this is a no-go since prometheus process should use this flag as per systemd security best practices. I would be more comfortable trying to solve your case than making this feature go away or making it optional.
Also as this is a systemd service, there is a quick and dirty workaround to force different service parameters without modifying service file itself. You need to:
- Create
/etc/systemd/system/<service_name>.service.d/<some_name>.conf
(ex./etc/systemd/system/prometheus.service.d/override.conf
) - Put there parameters which you would like to override, in this case:
PrivateDevices=false
NoNewPrivileges=false
That said we are also using Ubuntu 16.04 our demo-site and never got into that problem.
# systemd --version
systemd 229
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN
# prometheus --version
prometheus, version 2.7.1 (branch: HEAD, revision: 62e591f928ddf6b3468308b7ac1de1c63aa7fcf3)
build user: root@f9f82868fc43
build date: 20190131-11:16:59
go version: go1.11.5
# uname -a
Linux demo 4.4.0-141-generic #167-Ubuntu SMP Wed Dec 5 10:40:15 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
Could you post output of uname -a
command?
from ansible-prometheus.
Of course nobody is asking that line to be removed.
I'm running on Joyent Triton so it's Illumos Solaris acting like Linux. But I'm happy to troubleshoot this further.
Linux 0cb983c4-e077-426b-8932-ed131b0e9ca1 4.3.0 BrandZ virtual linux x86_64 x86_64 x86_64 GNU/Linux
I looked at the systemd docs a bit. Maybe I need to make sure all the files it accesses are owned by the prometheus
user?
from ansible-prometheus.
Now I see what is the problem. 😄 Disguising as linux can sometimes lead to strange behaviors (like this one), especially when some application (systemd) is relying on kernel features. I assume kernel you are using is not supporting calling prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
.
This is an issue of Joyen Triton and I would advise to notify them about it as systemd 240 is supposed to set NoNewPrivileges for all long running services by default.
from ansible-prometheus.
Sure, they're aware. Thanks for the advice.
Now how do I get this working? Is there an easy way to override that one template within a role? or do I need to fork it?
from ansible-prometheus.
You need to create additional directory and file as I described in #184 (comment). Best would be to create it before running this role.
So sth like this:
- hosts: all
become: true
pre_tasks:
- name: Create prometheus service directory tree
file:
path: "/etc/systemd/system/prometheus.service.d"
state: directory
- name: Create prometheus service parameters override
copy:
dest: "/etc/systemd/system/prometheus.service.d/override.conf"
content: |
[Service]
PrivateDevices=false
NoNewPrivileges=false
roles:
- cloudalchemy.prometheus
from ansible-prometheus.
Thanks!
from ansible-prometheus.
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
from ansible-prometheus.
Related Issues (20)
- RestrictSUIDSGID not supported in Debian buster HOT 1
- Multiple targets in scrape_configs HOT 2
- Restrict binary access HOT 2
- Cannot start prometheus if prometheus_db_dir is under /home
- checksum failed because is not the good line selected in sha256sums.txt (when install prometheus) HOT 1
- prometheus_config_dir/consoles and prometheus_config_dir/console_libraries are inaccessible HOT 1
- Role fails on 'Fail when file_sd targets are not defined in scrape_configs' while using consul_sd HOT 1
- Stance on default alert rules HOT 1
- Deprecation warning about `include` HOT 1
- Ability to specify oauth2 configuration HOT 1
- child process. Crashing instead. - Checksums HOT 4
- Download URL HOT 1
- Can't see consul_sd_configs on prometheus.yml HOT 1
- v4.0.0 seems to have disappeared from galaxy HOT 10
- Selinux packages for Oracle Linux 8 HOT 1
- Installing from distribution repo HOT 1
- relabel_configs in prometheus_scrape_configs HOT 1
- Updating prometheus_web_config doesn't reload prometheus HOT 2
- Add AlmaLinux variable file HOT 3
- Is ansible-prometheus abandoned? No commits have been made since January 2022 (now October 2022) HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ansible-prometheus.