Skip to content

Commit c923f2e

Browse files
authored
[Unprivileged] Windows enablement (#4264)
* Work on creating user/group on windows. * Allow install on Windows. * Set correct permissions on install. * Remove the FreeSID causing crash. * Return correct errors for FindGID and FindUID. * Add SeRestorePrivilege. * Set the password for the service. * Un-comment the uninstall on error. * Set the local security policy for the created user. * Fix set password to use a specific struct. * Fix vault and listener permissions. * Update notice. * Fix deps. * Fix lint. * Fix windows lint. * Fix windows lint. * Adjust integration tests for allowing unprivileged on Windows. * Adjust more tests. * Fix test. * Fix user create. * More work on Windows. * Fix test. * More permission adjustments. * skip takeOwnership when not root. * Impove comments. * Fix RunningUnderSupervisor to work running as unprivileged service. * Adjust RunningUnderSupervisor. * Fix re-exec on Windows with unprivileged. * Set DACL correctly on service. * Fix enrollment during install on Windows with unprivileged. * Fix issues from merge. * Fix lint. * Fix windows lint. * Fix reexec_windows subcommand. * Fix install test. * Fix metrics monitoring test. * Switch from privileged to unprivileged in control protocol. * Improve logging on start. * Fix TestMetricsMonitoringCorrectBinaries. * Fix more issues and test. * Some code cleanup. * Fix logging of context cancelled. * Fix restart delay. * Add comment for windows.Token(0), and more context. * Switch to crypto/rand.
1 parent 6f95873 commit c923f2e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+1740
-674
lines changed

NOTICE.txt

+212
Original file line numberDiff line numberDiff line change
@@ -6275,6 +6275,218 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
62756275
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62766276

62776277

6278+
--------------------------------------------------------------------------------
6279+
Dependency : github.com/winlabs/gowin32
6280+
Version: v0.0.0-20221003142512-0d265587d3c9
6281+
Licence type (autodetected): Apache-2.0
6282+
--------------------------------------------------------------------------------
6283+
6284+
Contents of probable licence file $GOMODCACHE/github.com/winlabs/gowin32@v0.0.0-20221003142512-0d265587d3c9/LICENSE:
6285+
6286+

6287+
Apache License
6288+
Version 2.0, January 2004
6289+
http://www.apache.org/licenses/
6290+
6291+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6292+
6293+
1. Definitions.
6294+
6295+
"License" shall mean the terms and conditions for use, reproduction,
6296+
and distribution as defined by Sections 1 through 9 of this document.
6297+
6298+
"Licensor" shall mean the copyright owner or entity authorized by
6299+
the copyright owner that is granting the License.
6300+
6301+
"Legal Entity" shall mean the union of the acting entity and all
6302+
other entities that control, are controlled by, or are under common
6303+
control with that entity. For the purposes of this definition,
6304+
"control" means (i) the power, direct or indirect, to cause the
6305+
direction or management of such entity, whether by contract or
6306+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
6307+
outstanding shares, or (iii) beneficial ownership of such entity.
6308+
6309+
"You" (or "Your") shall mean an individual or Legal Entity
6310+
exercising permissions granted by this License.
6311+
6312+
"Source" form shall mean the preferred form for making modifications,
6313+
including but not limited to software source code, documentation
6314+
source, and configuration files.
6315+
6316+
"Object" form shall mean any form resulting from mechanical
6317+
transformation or translation of a Source form, including but
6318+
not limited to compiled object code, generated documentation,
6319+
and conversions to other media types.
6320+
6321+
"Work" shall mean the work of authorship, whether in Source or
6322+
Object form, made available under the License, as indicated by a
6323+
copyright notice that is included in or attached to the work
6324+
(an example is provided in the Appendix below).
6325+
6326+
"Derivative Works" shall mean any work, whether in Source or Object
6327+
form, that is based on (or derived from) the Work and for which the
6328+
editorial revisions, annotations, elaborations, or other modifications
6329+
represent, as a whole, an original work of authorship. For the purposes
6330+
of this License, Derivative Works shall not include works that remain
6331+
separable from, or merely link (or bind by name) to the interfaces of,
6332+
the Work and Derivative Works thereof.
6333+
6334+
"Contribution" shall mean any work of authorship, including
6335+
the original version of the Work and any modifications or additions
6336+
to that Work or Derivative Works thereof, that is intentionally
6337+
submitted to Licensor for inclusion in the Work by the copyright owner
6338+
or by an individual or Legal Entity authorized to submit on behalf of
6339+
the copyright owner. For the purposes of this definition, "submitted"
6340+
means any form of electronic, verbal, or written communication sent
6341+
to the Licensor or its representatives, including but not limited to
6342+
communication on electronic mailing lists, source code control systems,
6343+
and issue tracking systems that are managed by, or on behalf of, the
6344+
Licensor for the purpose of discussing and improving the Work, but
6345+
excluding communication that is conspicuously marked or otherwise
6346+
designated in writing by the copyright owner as "Not a Contribution."
6347+
6348+
"Contributor" shall mean Licensor and any individual or Legal Entity
6349+
on behalf of whom a Contribution has been received by Licensor and
6350+
subsequently incorporated within the Work.
6351+
6352+
2. Grant of Copyright License. Subject to the terms and conditions of
6353+
this License, each Contributor hereby grants to You a perpetual,
6354+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
6355+
copyright license to reproduce, prepare Derivative Works of,
6356+
publicly display, publicly perform, sublicense, and distribute the
6357+
Work and such Derivative Works in Source or Object form.
6358+
6359+
3. Grant of Patent License. Subject to the terms and conditions of
6360+
this License, each Contributor hereby grants to You a perpetual,
6361+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
6362+
(except as stated in this section) patent license to make, have made,
6363+
use, offer to sell, sell, import, and otherwise transfer the Work,
6364+
where such license applies only to those patent claims licensable
6365+
by such Contributor that are necessarily infringed by their
6366+
Contribution(s) alone or by combination of their Contribution(s)
6367+
with the Work to which such Contribution(s) was submitted. If You
6368+
institute patent litigation against any entity (including a
6369+
cross-claim or counterclaim in a lawsuit) alleging that the Work
6370+
or a Contribution incorporated within the Work constitutes direct
6371+
or contributory patent infringement, then any patent licenses
6372+
granted to You under this License for that Work shall terminate
6373+
as of the date such litigation is filed.
6374+
6375+
4. Redistribution. You may reproduce and distribute copies of the
6376+
Work or Derivative Works thereof in any medium, with or without
6377+
modifications, and in Source or Object form, provided that You
6378+
meet the following conditions:
6379+
6380+
(a) You must give any other recipients of the Work or
6381+
Derivative Works a copy of this License; and
6382+
6383+
(b) You must cause any modified files to carry prominent notices
6384+
stating that You changed the files; and
6385+
6386+
(c) You must retain, in the Source form of any Derivative Works
6387+
that You distribute, all copyright, patent, trademark, and
6388+
attribution notices from the Source form of the Work,
6389+
excluding those notices that do not pertain to any part of
6390+
the Derivative Works; and
6391+
6392+
(d) If the Work includes a "NOTICE" text file as part of its
6393+
distribution, then any Derivative Works that You distribute must
6394+
include a readable copy of the attribution notices contained
6395+
within such NOTICE file, excluding those notices that do not
6396+
pertain to any part of the Derivative Works, in at least one
6397+
of the following places: within a NOTICE text file distributed
6398+
as part of the Derivative Works; within the Source form or
6399+
documentation, if provided along with the Derivative Works; or,
6400+
within a display generated by the Derivative Works, if and
6401+
wherever such third-party notices normally appear. The contents
6402+
of the NOTICE file are for informational purposes only and
6403+
do not modify the License. You may add Your own attribution
6404+
notices within Derivative Works that You distribute, alongside
6405+
or as an addendum to the NOTICE text from the Work, provided
6406+
that such additional attribution notices cannot be construed
6407+
as modifying the License.
6408+
6409+
You may add Your own copyright statement to Your modifications and
6410+
may provide additional or different license terms and conditions
6411+
for use, reproduction, or distribution of Your modifications, or
6412+
for any such Derivative Works as a whole, provided Your use,
6413+
reproduction, and distribution of the Work otherwise complies with
6414+
the conditions stated in this License.
6415+
6416+
5. Submission of Contributions. Unless You explicitly state otherwise,
6417+
any Contribution intentionally submitted for inclusion in the Work
6418+
by You to the Licensor shall be under the terms and conditions of
6419+
this License, without any additional terms or conditions.
6420+
Notwithstanding the above, nothing herein shall supersede or modify
6421+
the terms of any separate license agreement you may have executed
6422+
with Licensor regarding such Contributions.
6423+
6424+
6. Trademarks. This License does not grant permission to use the trade
6425+
names, trademarks, service marks, or product names of the Licensor,
6426+
except as required for reasonable and customary use in describing the
6427+
origin of the Work and reproducing the content of the NOTICE file.
6428+
6429+
7. Disclaimer of Warranty. Unless required by applicable law or
6430+
agreed to in writing, Licensor provides the Work (and each
6431+
Contributor provides its Contributions) on an "AS IS" BASIS,
6432+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
6433+
implied, including, without limitation, any warranties or conditions
6434+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
6435+
PARTICULAR PURPOSE. You are solely responsible for determining the
6436+
appropriateness of using or redistributing the Work and assume any
6437+
risks associated with Your exercise of permissions under this License.
6438+
6439+
8. Limitation of Liability. In no event and under no legal theory,
6440+
whether in tort (including negligence), contract, or otherwise,
6441+
unless required by applicable law (such as deliberate and grossly
6442+
negligent acts) or agreed to in writing, shall any Contributor be
6443+
liable to You for damages, including any direct, indirect, special,
6444+
incidental, or consequential damages of any character arising as a
6445+
result of this License or out of the use or inability to use the
6446+
Work (including but not limited to damages for loss of goodwill,
6447+
work stoppage, computer failure or malfunction, or any and all
6448+
other commercial damages or losses), even if such Contributor
6449+
has been advised of the possibility of such damages.
6450+
6451+
9. Accepting Warranty or Additional Liability. While redistributing
6452+
the Work or Derivative Works thereof, You may choose to offer,
6453+
and charge a fee for, acceptance of support, warranty, indemnity,
6454+
or other liability obligations and/or rights consistent with this
6455+
License. However, in accepting such obligations, You may act only
6456+
on Your own behalf and on Your sole responsibility, not on behalf
6457+
of any other Contributor, and only if You agree to indemnify,
6458+
defend, and hold each Contributor harmless for any liability
6459+
incurred by, or claims asserted against, such Contributor by reason
6460+
of your accepting any such warranty or additional liability.
6461+
6462+
END OF TERMS AND CONDITIONS
6463+
6464+
APPENDIX: How to apply the Apache License to your work.
6465+
6466+
To apply the Apache License to your work, attach the following
6467+
boilerplate notice, with the fields enclosed by brackets "[]"
6468+
replaced with your own identifying information. (Don't include
6469+
the brackets!) The text should be enclosed in the appropriate
6470+
comment syntax for the file format. We also recommend that a
6471+
file or class name and description of purpose be included on the
6472+
same "printed page" as the copyright notice for easier
6473+
identification within third-party archives.
6474+
6475+
Copyright [yyyy] [name of copyright owner]
6476+
6477+
Licensed under the Apache License, Version 2.0 (the "License");
6478+
you may not use this file except in compliance with the License.
6479+
You may obtain a copy of the License at
6480+
6481+
http://www.apache.org/licenses/LICENSE-2.0
6482+
6483+
Unless required by applicable law or agreed to in writing, software
6484+
distributed under the License is distributed on an "AS IS" BASIS,
6485+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
6486+
See the License for the specific language governing permissions and
6487+
limitations under the License.
6488+
6489+
62786490
--------------------------------------------------------------------------------
62796491
Dependency : go.elastic.co/apm
62806492
Version: v1.15.0

control_v2.proto

+2
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,8 @@ message StateAgentInfo {
167167
bool snapshot = 5;
168168
// Current running PID.
169169
int32 pid = 6;
170+
// True when running as unprivileged.
171+
bool unprivileged = 7;
170172
}
171173

172174
// StateResponse is the current state of Elastic Agent.

go.mod

+1
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ require (
5858
github.com/spf13/pflag v1.0.5
5959
github.com/stretchr/testify v1.8.4
6060
github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b
61+
github.com/winlabs/gowin32 v0.0.0-20221003142512-0d265587d3c9
6162
go.elastic.co/apm/module/apmgorilla v1.15.0
6263
go.elastic.co/ecszap v1.0.1
6364
go.elastic.co/go-licence-detector v0.5.0

go.sum

+2
Original file line numberDiff line numberDiff line change
@@ -1846,6 +1846,8 @@ github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1
18461846
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
18471847
github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
18481848
github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
1849+
github.com/winlabs/gowin32 v0.0.0-20221003142512-0d265587d3c9 h1:U8aCPFEMnxAEyj9IonhMVV1gSL4nzelh8uvoXp0hrq0=
1850+
github.com/winlabs/gowin32 v0.0.0-20221003142512-0d265587d3c9/go.mod h1:N51TYkG9JGR5sytj0EoPl31Xg2kuB507lxEmrwSNvfQ=
18491851
github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
18501852
github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
18511853
github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=

internal/pkg/agent/application/info/agent_info.go

+21-5
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@ package info
66

77
import (
88
"context"
9+
"fmt"
910

1011
"github.com/elastic/elastic-agent/internal/pkg/release"
1112
"github.com/elastic/elastic-agent/pkg/core/logger"
13+
"github.com/elastic/elastic-agent/pkg/utils"
1214
)
1315

1416
type Agent interface {
@@ -32,12 +34,16 @@ type Agent interface {
3234

3335
// Version returns the version for this Agent.
3436
Version() string
37+
38+
// Unprivileged returns true when this Agent is running unprivileged.
39+
Unprivileged() bool
3540
}
3641

3742
// AgentInfo is a collection of information about agent.
3843
type AgentInfo struct {
39-
agentID string
40-
logLevel string
44+
agentID string
45+
logLevel string
46+
unprivileged bool
4147

4248
// esHeaders will be injected into the headers field of any elasticsearch
4349
// output created by this agent (see component.toIntermediate).
@@ -55,11 +61,16 @@ func NewAgentInfoWithLog(ctx context.Context, level string, createAgentID bool)
5561
if err != nil {
5662
return nil, err
5763
}
64+
isRoot, err := utils.HasRoot()
65+
if err != nil {
66+
return nil, fmt.Errorf("failed to determine root/Administrator: %w", err)
67+
}
5868

5969
return &AgentInfo{
60-
agentID: agentInfo.ID,
61-
logLevel: agentInfo.LogLevel,
62-
esHeaders: agentInfo.Headers,
70+
agentID: agentInfo.ID,
71+
logLevel: agentInfo.LogLevel,
72+
unprivileged: !isRoot,
73+
esHeaders: agentInfo.Headers,
6374
}, nil
6475
}
6576

@@ -119,3 +130,8 @@ func (*AgentInfo) Snapshot() bool {
119130
func (i *AgentInfo) Headers() map[string]string {
120131
return i.esHeaders
121132
}
133+
134+
// Unprivileged returns true when this Agent is running unprivileged.
135+
func (i *AgentInfo) Unprivileged() bool {
136+
return i.unprivileged
137+
}

0 commit comments

Comments
 (0)