Hello all,
I recently discovered Linux capabilities, in particular the option CAP_DAC_READ_SEARCH from the AmbientCapabilities parameter in services, and realised it was actually implemented on Splunk UF 9.0+.
I was happy to see this included in the service of UFs, but I then found it was not enabled by default on Splunk Enterprise (I was using 9.3.1), so I attempted to create an override for the service, including the aforementioned parameter.
Unfortunately, I was unable to ingest logs for which the user running splunk did not have the permissions. Funnily enough, I tried to set some monitoring on /var/log/messages through the GUI; I was able to see the logs when selecting the sourcetype, but then I got an error "Parameter name: Path is not readable" when submitting the conf. I also get an insufficient permission message in the internal logs when forcing the monitoring of /var/log/messages via an inputs.conf.
I read on an older post that this behaviour comes from the use of an inappropriate function when checking the permissions on the file...
So my questions to the community and Splunk employees are :
- Are capabilities in services supported for Splunk Enterprise? If so, how can I set them up? If not, will they be supported at some point?
- How would you collect logs on a HF or standalone instance, where the user running splunk has no rights on the logs to ingest?
Thanks
