Getting Data In

UF: Why is too much permissions given to Splunk when configured as a systemd service?

GaetanVP
Contributor

Hello Splunkers,

I have followed this documentation in order to configure my Splunk on my UF as a systemd managed service : https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/RunSplunkassystemdservice

 I also followed the step to make Splunk running with a non-root user, and I have check with the following command that it is indeed the case :

 

 

ps -aux | grep -i Splunk

 

 

However, it seems that Splunk is now able to read any files and folders on the machine, even no permissions or ACL were specified for the splunk user I used.  This user does not have any sudo right, so I am wondering what could be the root cause here...

If I disable the systemd service and run Splunk with (as the non root user) :  

 

/opt/splunkforwarder/bin/splunk start

 

Everything is working correctly and the protected files / folder are not monitored by Splunk, as excepted.

I'm out of idea here!

Thanks,

GaetanVP

 

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is a new feature of Splunk that allows UFs to read system logs without running as root.  To disable it, remove the CAP_DAC_READ_SEARCH capability from the systemd unit file. See https://docs.splunk.com/Documentation/Forwarder/9.0.3/Forwarder/Installleastprivileged

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is a new feature of Splunk that allows UFs to read system logs without running as root.  To disable it, remove the CAP_DAC_READ_SEARCH capability from the systemd unit file. See https://docs.splunk.com/Documentation/Forwarder/9.0.3/Forwarder/Installleastprivileged

---
If this reply helps you, Karma would be appreciated.

GaetanVP
Contributor

Wow I've never saw this parameter before... thanks a lot !
Worked as expected when I removed the line.

Regards,

GaetanVP

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...