UF: Why is too much permissions given to Splunk when configured as a systemd service?

[GaetanVP]

Hello Splunkers,

I have followed this documentation in order to configure my Splunk on my UF as a systemd managed service : https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/RunSplunkassystemdservice

 I also followed the step to make Splunk running with a non-root user, and I have check with the following command that it is indeed the case :

ps -aux | grep -i Splunk

However, it seems that Splunk is now able to read any files and folders on the machine, even no permissions or ACL were specified for the splunk user I used.  This user does not have any sudo right, so I am wondering what could be the root cause here...

If I disable the systemd service and run Splunk with (as the non root user) :  

/opt/splunkforwarder/bin/splunk start

Everything is working correctly and the protected files / folder are not monitored by Splunk, as excepted.

I'm out of idea here!

Thanks,

GaetanVP

[richgalloway · Accepted solution]

This is a new feature of Splunk that allows UFs to read system logs without running as root.  To disable it, remove the CAP_DAC_READ_SEARCH capability from the systemd unit file. See https://docs.splunk.com/Documentation/Forwarder/9.0.3/Forwarder/Installleastprivileged

[GaetanVP]

Wow I've never saw this parameter before... thanks a lot !
Worked as expected when I removed the line.

Regards,

GaetanVP