[v3] Can not get mountinfo on android #1159
Comments
|
We face the same issue with Telegraf, see influxdata/telegraf#10357 We applied the CIS Hardening rules by running https://github.com/dev-sec/ansible-collection-hardening In the troubleshouting section of the disk plugin (https://github.com/influxdata/telegraf/tree/master/plugins/inputs/disk#troubleshooting) there is described to test this: So using /proc/self instead of /proc/1 would solve the problem. As this project is used as upstream project, this block some functionality of Telegraf as well. |
|
#1270 created. Could you check by using that PR? |
|
I ran: Which upgraded the gopsutil dependency to the branch with the fix. I have put up a PR here, which should have some artifacts attached to it shortly that you can then try out. |
|
#1270 has been merged. Thank you for confirming! |
|
@shirou |
|
gopsutil releases are monthly @cbos https://github.com/shirou/gopsutil#tag-semantics |
The changes to gopsutil for reading /proc/1/mountinfo affected applications running under restricted environments that disallows access to /proc/1/mountinfo. shirou#1159 was filed for android but other restricted environments are also affected (eg, snaps)). The fix for shirou#1159 addressed the application behavior to work under confinement for non-android as well. However, depending on the system, the attempt to read /proc/1/mountinfo could cause a sandbox denial in the logs which can be quite noisy if using gopsutil as part of a monitoring solution that polls often. This introduces the SELF_MOUNTINFO to force reading from /proc/self instead of first trying /proc/1. When unset or set to anything other than '1', retain the current behavior with fallback. This allows people to set SELF_MOUNTINFO=1 when gopsutil is running under these restricted environments.
The changes to gopsutil for reading /proc/1/mountinfo affected applications running under restricted environments that disallows access to /proc/1/mountinfo. shirou#1159 was filed for android but other restricted environments are also affected (eg, snaps)). The fix for shirou#1159 addressed the application behavior to work under confinement for non-android as well. However, depending on the system, the attempt to read /proc/1/mountinfo could cause a sandbox denial in the logs which can be quite noisy if using gopsutil as part of a monitoring solution that polls often. This introduces HOST_PROC_MOUNTINFO to force reading from the parent dir of the specified path instead of first trying /proc/1. When unset, retain the current behavior with fallback. This allows people, for example, to set HOST_PROC_MOUNTINFO=/proc/self/mountinfo when gopsutil is running under these restricted environments. This change updates the private readMountFile() to use a root path instead of a root subpath, and adjusts PartitionsWithContext() to set the root path to /proc/1 initially and falling back to /proc/self. When HOST_PROC_MOUNTINFO is not empty, set the root path to the parent directory of HOST_PROC_MOUNTINFO.
Describe the bug
#1133 changes getting mountinfo source from
/proc/self/mountinfoto/proc/1/mountinfoin order to adapt container. However, from this report by @tmm1(thank you!) , Android can not read/proc/1/mountinfobecause ofPermission denied.Expected behavior
success to get mountinfo.
Environment (please complete the following information):
/etc/os-releaseand the result ofuname -a]android
Additional context
Perhaps, we should add "fallback" to use
/proc/self/mountinfoif error happened.The text was updated successfully, but these errors were encountered: