splunk 6.1.X boot-start: running with group root (CentOS 6.5) - how force another group?

[tugnet]

hi!

Since splunk 6.1.1 we encounter a problem because boot-start creates an init-script which causes the splunk process to run as user splunk - but group 0 (root) - but the files to be indexed are only available to the group splunk.

Is there a way to force the splunk-process to run as splunk:splunk?

something like

SPLUNK_OS_GROUP=splunk

(which doesn't work) in etc/splunk-launch.conf ?

regards,

philipp

[grijhwani]

This is actually a generic unix/Linux admin question. Init scripts run as root. What the parameters of the splunk user are is totally irrelevant to a default init script.

You have two options:

1. hack /etc/init.d/splunk to execute the splunk binary as the splunk user (look up su -c)
2. set the SGID bit on the splunk executable, and while you're at it the SUID bit too (chmod ug+s ~splunk/bin/splunk), and make sure it is properly owned as splunk:splunk.

Mind you allowing it to continue running as root should not pose any problem in itself. Although normally frowned on for service processes, if you are looking to index system logs at all it is going to need root privelege unless you have been clever with log priveleges, and that can be an equally big minefield.

[tugnet]

hi!

it has. but nontheless, the group the splunk process runs as is root (splunk:root). And that's not cool 😕

[musskopf]

Check the user Splunk, just run on Linux:
id splunk
and confirm the user has gid=splunk as primary group.