Merge ~jsimpso/prometheus-snap:master into prometheus-snap:master

[James Simpson]

Run daemon as non-root user

[James Simpson (jsimpso)]

ps output here showing that prometheus is now launched from the wrapper as "snap_daemon" rather than root:

jsimpso@kif:~$ sudo pgrep prometheus -a
1891 /bin/sh /snap/prometheus-alertmanager/50/bin/prometheus-alertmanager.wrapper
2062437 /bin/sh /snap/prometheus/x7/bin/prometheus.wrapper
2062642 /snap/prometheus/x7/bin/prometheus --config.file /var/snap/prometheus/x7/prometheus.yml --storage.tsdb.path=/var/snap/prometheus/common/tsdb
jsimpso@kif:~$ sudo ps aux | grep [2]062642
snap_da+ 2062642 0.1 0.2 938440 75548 ? Sl 11:17 0:00 /snap/prometheus/x7/bin/prometheus --config.file /var/snap/prometheus/x7/prometheus.yml --storage.tsdb.path=/var/snap/prometheus/common/tsdb

jsimpso@kif:~$ systemctl is-active snap.prometheus.prometheus.service
active

[Paul Collins (pjdc)]

I haven't done a snap_daemon migration like this myself, but LGTM if it works, except for the diff comment below.

review: Approve

[Paul Collins (pjdc)]

review: Approve (lgtm)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change must be approved by a member of one of the following teams:
Setting status to needs review.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change must be approved by a member of one of the following teams:
Setting status to needs review.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 7a784c92e20418d81b1f66bcb7fa173b8bda7c40

diff --git a/snap_config_wrapper b/snap_config_wrapper
index 21cf64b..db8c5e6 100755
--- a/snap_config_wrapper
+++ b/snap_config_wrapper
@@ -1,11 +1,50 @@
 #!/bin/sh
 
-test -e "${SNAP_DATA}/prometheus.yml" || cp "${SNAP}/etc/prometheus/prometheus.yml.example" "${SNAP_DATA}/prometheus.yml"
-test -e "${SNAP_DATA}/daemon_arguments" || cp "${SNAP}/etc/prometheus/daemon_arguments.example" "${SNAP_DATA}/daemon_arguments"
-test -d "${SNAP_DATA}/promreg" || mkdir "${SNAP_DATA}/promreg"
+# Manage file ownership/permissions, allowing daemon to drop privileges
+# https://snapcraft.io/docs/system-usernames
+
+SNAP_DATA_DIRS="promreg"
+SNAP_DATA_FILES="prometheus.yml daemon_arguments"
+SNAP_DB_DIR="${SNAP_COMMON}/tsdb"
+
+# Snaps can't manage ownership of SNAP_COMMON directly, so we'll move the DB
+# to a subdir of SNAP_COMMON -- https://forum.snapcraft.io/t/system-usernames/13386/12
+if [ ! -d "${SNAP_DB_DIR}" ]; then
+    mkdir "${SNAP_DB_DIR}"
+    # If we're making the dir for the first time, move any existing content into it
+    find "${SNAP_COMMON}" -maxdepth 1 -mindepth 1 -not -name tsdb -exec mv -t "${SNAP_DB_DIR}" {} +
+fi
+chmod 775 "${SNAP_DB_DIR}"
+find "${SNAP_DB_DIR}" -type d -exec chmod 775 {} \;
+find "${SNAP_DB_DIR}" -type f -exec chmod 664 {} \;
+chown -R snap_daemon: "${SNAP_DB_DIR}"
+
+for DIR in ${SNAP_DATA_DIRS}
+do
+    if [ ! -d "${SNAP_DATA}/${DIR}" ]; then
+        mkdir "${SNAP_DATA}/${DIR}"
+    fi
+    chmod 775 "${SNAP_DATA}/${DIR}"
+    find "${SNAP_DATA}/${DIR}" -type d -exec chmod 775 {} \;
+    find "${SNAP_DATA}/${DIR}" -type f -exec chmod 664 {} \;
+    chown -R snap_daemon: "${SNAP_DATA}/${DIR}"
+done
+
+for FILE in ${SNAP_DATA_FILES}
+do
+    if [ ! -f "${SNAP_DATA}/${FILE}" ]; then
+        cp "${SNAP}/etc/prometheus/${FILE}.example" "${SNAP_DATA}/${FILE}"
+    fi
+        chmod 664 "${SNAP_DATA}/${FILE}"
+        chown snap_daemon: "${SNAP_DATA}/${FILE}"
+done
 
 ulimit -n 65536
 . "${SNAP_DATA}"/daemon_arguments
 
-COMMAND="${SNAP}/bin/prometheus ${ARGS} --config.file ${SNAP_DATA}/prometheus.yml --storage.tsdb.path=${SNAP_COMMON}"
-eval "${COMMAND}"
\ No newline at end of file
+COMMAND="${SNAP}/bin/prometheus ${ARGS} --config.file ${SNAP_DATA}/prometheus.yml --storage.tsdb.path=${SNAP_COMMON}/tsdb"
+# Drop privileges with setpriv and run as snap_daemon
+# https://snapcraft.io/docs/system-usernames
+DROP_PRIVS="${SNAP}/usr/bin/setpriv --clear-groups --reuid snap_daemon --regid snap_daemon --"
+
+exec ${DROP_PRIVS} ${COMMAND}
\ No newline at end of file
diff --git a/snapcraft.yaml b/snapcraft.yaml
index 3d6ee02..f772004 100644
--- a/snapcraft.yaml
+++ b/snapcraft.yaml
@@ -21,6 +21,9 @@ architectures:
   # - build-on: ppc64el
   # - build-on: s390x
 
+system-usernames:
+  snap_daemon: shared
+
 apps:
   prometheus:
     command: 'bin/prometheus.wrapper'
@@ -55,6 +58,9 @@ parts:
       cp -p "$SNAPCRAFT_PART_BUILD/promtool" "$SNAPCRAFT_PART_INSTALL/bin/"
       cp -p "$SNAPCRAFT_PART_BUILD/prometheus" "$SNAPCRAFT_PART_INSTALL/bin/"
       cp -p "$SNAPCRAFT_PART_SRC/documentation/examples/prometheus.yml" "$SNAPCRAFT_PART_INSTALL/etc/prometheus/prometheus.yml.example"
+    # util-linux required to drop privileges
+    # https://snapcraft.io/docs/system-usernames
+    stage-packages: [util-linux]
   snap-wrappers:
     plugin: dump
     source: .