Skip to content

Conversation

@leth
Copy link
Contributor

@leth leth commented Mar 12, 2023

In prometheus/node_exporter#2632 we figured out that O_NOATIME was increasing the privileges needed!

From the open man page

O_NOATIME (since Linux 2.6.8)
              Do not update the file last access time (st_atime in the
              inode) when the file is [read(2)](https://man7.org/linux/man-pages/man2/read.2.html).

              This flag can be employed only if one of the following
              conditions is true:

              *  The effective UID of the process matches the owner UID
                 of the file.

              *  The calling process has the CAP_FOWNER capability in
                 its user namespace and the owner UID of the file has a
                 mapping in the namespace.

@leth leth force-pushed the run-as-non-root branch from 1c25f7b to 1d77559 Compare March 12, 2023 21:07
@dennwc dennwc self-assigned this Mar 12, 2023
Copy link
Owner

@dennwc dennwc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thank you!

@dennwc dennwc merged commit a1f570b into dennwc:master Mar 12, 2023
@leth leth deleted the run-as-non-root branch March 12, 2023 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants