Bug#1068732: prometheus-ipmi-exporter: debian path patch breaks local collection with sudo

[Ross Vandegrift]

Hi Daniel,

On Thu, Apr 11, 2024 at 09:41:44AM +0200, Daniel Swarbrick wrote:
> In the upstream bug report, it is suggested that one should "complain to
> [Debian] to get this fixed".

Yea - upstream's tone was not kind.  I hope I didn't come across as
complaining, and apologies if I did.

> Have you tried overriding the --freeipmi.path flag back to an empty string
> (e.g. --freeipmi.path="") so that ipmi_exporter falls back to searching on
> the PATH?

No, that didn't occur to me.  But thanks, that works great!

Ross


signature.asc
Description: PGP signature

Bug#1068732: prometheus-ipmi-exporter: debian path patch breaks local collection with sudo

[Daniel Swarbrick]

In the upstream bug report, it is suggested that one should "complain to 
[Debian] to get this fixed".


I don't see this as a Debian-specific bug however. It would affect any 
distro with freeipmi-utils installed in /usr/sbin and sudo installed in 
/usr/bin, on which the user set a non-empty --freeipmi.path flag - 
because that is merely what the Debian patch does - pre-populate that 
flag value.


As such, I don't see any way for Debian to "fix" this without a much 
more invasive patch, which would effectively require "fixing" the issue 
upstream.


Have you tried overriding the --freeipmi.path flag back to an empty 
string (e.g. --freeipmi.path="") so that ipmi_exporter falls back to 
searching on the PATH?




OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1068732: prometheus-ipmi-exporter: debian path patch breaks local collection with sudo

[Ross Vandegrift]

Package: prometheus-ipmi-exporter
Version: 1.8.0-1
Severity: normal
X-Debbugs-Cc: rvandegr...@debian.org

Hello,

The Debian package for prometheus-ipmi-exporter carries a patch [1] to set
freeipmi.path by default.  Due to a surprising design, this breaks the config
required to run a local exporter as an unprivileged user.

That involves using sudo as follows:
  modules:
default:
  collectors:
- bmc
- ipmi
  collector_cmd:
bmc: sudo
ipmi: sudo
  custom_args:
bmc:
  - bmc-info
ipmi:
  - ipmimonitoring

Surprisingly, freeimpi.path applies to the collect_cmd entires.  So the
exporter prepends /usr/bin to those entires, and fails to find sudo.  Since
there is no way to override this, I don't see any way to run without root.

There's an upstream report of this issue at [2].

Thanks,
Ross


[1] - 
https://salsa.debian.org/go-team/packages/prometheus-ipmi-exporter/-/blob/debian/sid/debian/patches/0001-Set-sane-defaults-for-Debian-systems.patch
[2] - https://github.com/prometheus-community/ipmi_exporter/issues/153


-- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (500, 'testing'), (40, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.8.2 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages prometheus-ipmi-exporter depends on:
ii  adduser  3.137
pn  freeipmi-tools   
ii  init-system-helpers  1.66
ii  libc62.37-15
ii  systemd-sysv 255.4-1

prometheus-ipmi-exporter recommends no packages.

prometheus-ipmi-exporter suggests no packages.