Merge ~jsimpso/prometheus-snap:master into prometheus-snap:master

[James Simpson]

Improvements to file permissions for non-root user

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Barry Price (barryprice)]

LGTM +1

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 91ba2f7aba62a4e1aeeffbd7f1683515c668f091

diff --git a/snap_config_wrapper b/snap_config_wrapper
index 7505fd5..a3a85ae 100755
--- a/snap_config_wrapper
+++ b/snap_config_wrapper
@@ -6,6 +6,8 @@
 SNAP_DATA_DIRS=""
 SNAP_DATA_FILES="prometheus.yml daemon_arguments"
 SNAP_DB_DIR="${SNAP_COMMON}/tsdb"
+OWNER_USER="snap_daemon"
+OWNER_GROUP="root"
 
 # Snaps can't manage ownership of SNAP_COMMON directly, so we'll move the DB
 # to a subdir of SNAP_COMMON -- https://forum.snapcraft.io/t/system-usernames/13386/12
@@ -14,20 +16,17 @@ if [ ! -d "${SNAP_DB_DIR}" ]; then
     # If we're making the dir for the first time, move any existing content into it
     find "${SNAP_COMMON}" -maxdepth 1 -mindepth 1 -not -name tsdb -exec mv -t "${SNAP_DB_DIR}" {} +
 fi
-chmod 775 "${SNAP_DB_DIR}"
-find "${SNAP_DB_DIR}" -type d -exec chmod 775 {} \;
-find "${SNAP_DB_DIR}" -type f -exec chmod 664 {} \;
-chown -R snap_daemon: "${SNAP_DB_DIR}"
+
+find "${SNAP_DB_DIR}" -type d \( ! -user "${OWNER_USER}" -o ! -group "${OWNER_GROUP}" \) -exec chmod 775 {} \; -exec chown "${OWNER_USER}:${OWNER_GROUP}" {} \;
+find "${SNAP_DB_DIR}" -type f \( ! -user "${OWNER_USER}" -o ! -group "${OWNER_GROUP}" \) -exec chmod 664 {} \; -exec chown "${OWNER_USER}:${OWNER_GROUP}" {} \;
 
 for DIR in ${SNAP_DATA_DIRS}
 do
     if [ ! -d "${SNAP_DATA}/${DIR}" ]; then
         mkdir "${SNAP_DATA}/${DIR}"
     fi
-    chmod 775 "${SNAP_DATA}/${DIR}"
-    find "${SNAP_DATA}/${DIR}" -type d -exec chmod 775 {} \;
-    find "${SNAP_DATA}/${DIR}" -type f -exec chmod 664 {} \;
-    chown -R snap_daemon: "${SNAP_DATA}/${DIR}"
+    find "${SNAP_DATA}/${DIR}" -type d \( ! -user "${OWNER_USER}" -o ! -group "${OWNER_GROUP}" \) -exec chmod 775 {} \; -exec chown "${OWNER_USER}:${OWNER_GROUP}" {} \;
+    find "${SNAP_DATA}/${DIR}" -type f \( ! -user "${OWNER_USER}" -o ! -group "${OWNER_GROUP}" \) -exec chmod 664 {} \; -exec chown "${OWNER_USER}:${OWNER_GROUP}" {} \;
 done
 
 for FILE in ${SNAP_DATA_FILES}
@@ -35,8 +34,12 @@ do
     if [ ! -f "${SNAP_DATA}/${FILE}" ]; then
         cp "${SNAP}/etc/prometheus/${FILE}.example" "${SNAP_DATA}/${FILE}"
     fi
-        chmod 664 "${SNAP_DATA}/${FILE}"
-        chown snap_daemon: "${SNAP_DATA}/${FILE}"
+        file_user=$(stat "${SNAP_DATA}/${FILE}" --format '%U')
+        file_group=$(stat "${SNAP_DATA}/${FILE}" --format '%G')
+        if [ "${file_user}" != "${OWNER_USER}" ] || [ "${file_group}" != "${OWNER_GROUP}" ]; then
+           chmod 664 "${SNAP_DATA}/${FILE}" && chown "${OWNER_USER}:${OWNER_GROUP}" "${SNAP_DATA}/${FILE}"
+        fi
+
 done
 
 ulimit -n 65536