Archive

What capabilities and permissions get applied to the nobody user?

Splunk Employee
Splunk Employee

I'm seeing searches running with user 'nobody' what quota will be applied?
I can't seem to apply any role to nobody?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

So the user is basically the non-user, the absence of user, not-any-user.

This is a discussion linked to the permission system on Splunk Knowledge Objects, these object can be pretty much anything: savedsearches, views, users, macros…

Now you will notice that nobody is usually the owner of some resources when installing an app.

find /opt/splunk/etc/ -type f -name *.meta | xargs egrep nobody | uniq
./splunk/etc/apps/Splunk_TA_nix/metadata/local.meta:owner = nobody
./splunk/etc/apps/sample_app/metadata/default.meta:owner = nobody
./splunk/etc/apps/threatstream/metadata/default.meta:owner = nobody
./splunk/etc/apps/maps/metadata/default.meta:owner = nobody

In the scenario of savedsearches running, when that search owned by 'nobody' is run, no user specific quotas will be applied, instead only the default quotas will be applied.

authorize.conf default file as a good example. ( $SPLUNK_HOME/etc/system/default/authorize.conf )

There we list capabilities and roles (default ones of course - not to be ever modified!)

Roles are mapped one to many to capabilities.
Users inherits capabilities through role assignment.
For the 'nobody' user, a role can't be assigned then the default settings will apply, in the specific context of searches:

[default] 
cumulativeRTSrchJobsQuota = 100 
cumulativeSrchJobsQuota = 50 
rtSrchJobsQuota = 6 
schedule_rtsearch = enabled 
srchDiskQuota = 100 
srchJobsQuota = 3 
srchMaxTime = 100days 

p.s. info above based on 6.x - should apply to some extent to earlier version too

View solution in original post

Splunk Employee
Splunk Employee

So the user is basically the non-user, the absence of user, not-any-user.

This is a discussion linked to the permission system on Splunk Knowledge Objects, these object can be pretty much anything: savedsearches, views, users, macros…

Now you will notice that nobody is usually the owner of some resources when installing an app.

find /opt/splunk/etc/ -type f -name *.meta | xargs egrep nobody | uniq
./splunk/etc/apps/Splunk_TA_nix/metadata/local.meta:owner = nobody
./splunk/etc/apps/sample_app/metadata/default.meta:owner = nobody
./splunk/etc/apps/threatstream/metadata/default.meta:owner = nobody
./splunk/etc/apps/maps/metadata/default.meta:owner = nobody

In the scenario of savedsearches running, when that search owned by 'nobody' is run, no user specific quotas will be applied, instead only the default quotas will be applied.

authorize.conf default file as a good example. ( $SPLUNK_HOME/etc/system/default/authorize.conf )

There we list capabilities and roles (default ones of course - not to be ever modified!)

Roles are mapped one to many to capabilities.
Users inherits capabilities through role assignment.
For the 'nobody' user, a role can't be assigned then the default settings will apply, in the specific context of searches:

[default] 
cumulativeRTSrchJobsQuota = 100 
cumulativeSrchJobsQuota = 50 
rtSrchJobsQuota = 6 
schedule_rtsearch = enabled 
srchDiskQuota = 100 
srchJobsQuota = 3 
srchMaxTime = 100days 

p.s. info above based on 6.x - should apply to some extent to earlier version too

View solution in original post