topic Execute script on forwarder with privileges in Getting Data In

Execute script on forwarder with privileges

JohnDuatres — Mon, 27 Mar 2023 09:49:18 GMT

Hello, team

I've made script, which uses the sudo command. I've deployed it on my forwarders, and I get the error:

message from "/opt/splunkforwarder/etc/apps/app/bin/script.sh" sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

My forwarders boot from splunk user (if change boot to root - script works). Splunk user is in sudoers, it have rights to execute sudo commands, but as far as I understand script must be executed with root user, not anyone else even if it have sudo privileges.

/usr/bin/sudo - nosuid option not set, and file system isn't NFS.

Tried to make owner of script root, and give to it setuid, but still not works.

Any ideas? How to make script be executable by splunk user?

Re: Execute script on forwarder with privileges

Tom_Lundie — Mon, 27 Mar 2023 10:29:14 GMT

Can you share the output of:

ls -l /bin/sudo

Sudo needs to have the suid permission set to run as root. Could this have been unset?

Whilst you're there (as the Splunk user), does your sudo command execute properly when ran directly on the CLI (instead of via the scripted input).

Also can you share some more details about the OS please?

Re: Execute script on forwarder with privileges

JohnDuatres — Mon, 27 Mar 2023 10:42:22 GMT

root@astra:/opt/splunkforwarder/etc/apps/app/bin# ls -l /usr/bin/sudo
---s--x--x 1 root root 141528 jan 23 2021 /usr/bin/sudo

setuid is set

Whilst you're there (as the Splunk user), does your sudo command execute properly when ran directly on the CLI (instead of via the scripted input). - yes it works, if i'm using su splunk, and execute script manually

Also can you share some more details about the OS please? - it's Astra Linux OS, but same problem I see on RHEL

Re: Execute script on forwarder with privileges

PickleRick — Mon, 27 Mar 2023 11:12:51 GMT

If you're not running this within some docker container, the culprit might be SELinux.

Is SELinux on?

Re: Execute script on forwarder with privileges

JohnDuatres — Mon, 27 Mar 2023 11:25:18 GMT

no, commands sestatus and getenforce shows that no such commands

Re: Execute script on forwarder with privileges

JohnDuatres — Mon, 27 Mar 2023 14:50:04 GMT

looks like I found the reason of problem

it was set parameter NoNewPrivileges=Yes

in forwarder systemd service