update rootless collector instructions replacing sudo-shim approach with IPC via unix socket#947
update rootless collector instructions replacing sudo-shim approach with IPC via unix socket#947defron wants to merge 3 commits into
Conversation
…ith IPC via unix socket Also move user creation instructions to podman install as they are no longer needed by the rootless collector Also fix podman section heading (was nested under Docker, should be at the same level as Manual Installation (without-Docker)) Thoroughly tested on both a Debian-compatible and RHEL-compatible distro
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #947 +/- ##
=======================================
Coverage 21.41% 21.41%
=======================================
Files 57 57
Lines 3208 3208
=======================================
Hits 687 687
Misses 2479 2479
Partials 42 42
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| # don't send json, so it won't be processed by scrutiny | ||
| # but make the error informative for logs | ||
| send_smartctl_shim_error() { | ||
| local MSG="$1" ARGS="$2" EXIT_CODE="${3:-3}" |
There was a problem hiding this comment.
I found 3 to be the best exit code in my testing for proxy/socket-related errors.
While yes, smartctl exit codes are a bit-mask. exit code 1 and exit code 2 should be mutually exclusive: 1 is for a command-line parsing error and 2 is for a device access error. If 1 happens, then smartctl never gets to actually check device access, and if 2 happens, then the command-line parsed successfully.
| PARSE_STATUS=$? | ||
|
|
||
| # Invalid JSON (smartctl-proxy error) or smartctl error that shouldn't be reported up as json | ||
| if [[ ($PARSE_STATUS -gt 0) || ($EXIT_STATUS -gt 0 && $EXIT_STATUS -lt 4) ]]; then |
There was a problem hiding this comment.
also in my testing, I had a case where --xall would fail with status_code=4 due to:
"error_recovery_control_supported": false
when using an external drive passed through to a VM (I used PCI-E passthru) due to the USB SATA adapter not supporting it.
The rest of the drive data was valid so 4+ needs to be processed by scrutiny for useful information. I don't feel there's a need to do bitmasking given that, though I am open to discussing if you feel there's an advantage to that
| 6. create inside there a proxy script. See below examples using a bash script and python script | ||
|
|
||
|
|
||
| <details><summary>Click to expand: smartctl-proxy.sh</summary> |
There was a problem hiding this comment.
both of the sections for the proxy script examples collapse, didn't know github supported this until I was looking for a good way to deal with the example proxy code embeddings
You can see it in action here: https://github.com/defron/scrutiny/blob/chore/rootless-unix-socket-proxy-docs/docs/INSTALL_MANUAL.md#creating-a-restricted-systemd-service-using-smartctl-proxy-via-unix-socket-advanced
|
@defron - thanks again for this. I'm way behind on taking a look; trying to get some long-overdue bug fixes in before moving on to enhancements |
|
@kaysond no worries! Life happens and this is just docs for the most part. On the plus side, I've been running this setup on two servers since creating this PR with no issues so far |
3 participants
update rootless collector instructions replacing sudo-shim approach with IPC via unix socket
Also move user creation instructions to podman install as they are no longer needed by the rootless collector
Also fix podman section heading (was nested under Docker, should be at the same level as Manual Installation (without-Docker))
Thoroughly tested on both a Debian-compatible and RHEL-compatible distro