Package: prometheus-node-exporter Version: 1.10.2-1 Severity: wishlist prometheus-node-exporter has a feature where it can read text files from /var/lib/prometheus/node-exporter/*.prom and report them back to a scraper. These files typically are created by collectors and a number of them are included in prometheus-node-exporter-collectors.
The directory /var/lib/prometheus/node-exporter is owned by root:root mode 0755. No user but root can write to this directory. Consequently all collectors must run as root and all collectors included with p-n-e-c that provide systemd units configure to run them as root. This is unfortunate from a security and sandboxing point of view. While the attack surface on collectors may be low, not running them as root would be defense in-depth. I propose changing this to making the directory group-writable to the prometheus group. Then collectors can run unprivileged adding prometheus as a SupplementaryGroup (man 5 systemd.exec). Helmut
