Skip to content

Commit 5847d77

Browse files
authored
skip allow_superuser in Windows OS (elastic#16629)
As user id is always zero in Windows, this commit excluded the checking of running as root in Windows.
1 parent 113585d commit 5847d77

3 files changed

Lines changed: 42 additions & 30 deletions

File tree

config/logstash.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,7 @@
320320
#
321321
# ------------ Other Settings --------------
322322
#
323-
# Allow or block running Logstash as superuser (default: true)
323+
# Allow or block running Logstash as superuser (default: true). Windows are excluded from the checking
324324
# allow_superuser: false
325325
#
326326
# Where to find custom plugins

logstash-core/lib/logstash/runner.rb

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,8 @@ def execute
454454
end # def self.main
455455

456456
def running_as_superuser
457+
return if LogStash::Environment.windows? # windows euid always returns 0, skip checking
458+
457459
if Process.euid() == 0
458460
if setting("allow_superuser")
459461
logger.warn("NOTICE: Allowing Logstash to run as superuser is heavily discouraged as it poses a security risk. " +

logstash-core/spec/logstash/runner_spec.rb

Lines changed: 39 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -574,41 +574,51 @@
574574
let(:deprecation_logger_stub) { double("DeprecationLogger").as_null_object }
575575
before(:each) { allow(runner).to receive(:deprecation_logger).and_return(deprecation_logger_stub) }
576576

577-
context "unintentionally running logstash as superuser" do
578-
before do
579-
expect(Process).to receive(:euid).and_return(0)
577+
if LogStash::Environment.windows?
578+
context "unintentionally running logstash as superuser" do
579+
it "runs successfully" do
580+
LogStash::SETTINGS.set("allow_superuser", false)
581+
expect(logger).not_to receive(:fatal)
582+
expect { subject.run(args) }.not_to raise_error
583+
end
580584
end
581-
it "fails with bad exit" do
582-
LogStash::SETTINGS.set("allow_superuser", false)
583-
expect(logger).to receive(:fatal) do |msg, hash|
584-
expect(msg).to eq("An unexpected error occurred!")
585-
expect(hash[:error].to_s).to match("Logstash cannot be run as superuser.")
585+
else
586+
context "unintentionally running logstash as superuser" do
587+
before do
588+
expect(Process).to receive(:euid).and_return(0)
589+
end
590+
it "fails with bad exit" do
591+
LogStash::SETTINGS.set("allow_superuser", false)
592+
expect(logger).to receive(:fatal) do |msg, hash|
593+
expect(msg).to eq("An unexpected error occurred!")
594+
expect(hash[:error].to_s).to match("Logstash cannot be run as superuser.")
595+
end
596+
expect(subject.run(args)).to eq(1)
586597
end
587-
expect(subject.run(args)).to eq(1)
588598
end
589-
end
590599

591-
context "intentionally running logstash as superuser " do
592-
before do
593-
expect(Process).to receive(:euid).and_return(0)
594-
end
595-
it "runs successfully with warning message" do
596-
LogStash::SETTINGS.set("allow_superuser", true)
597-
expect(logger).not_to receive(:fatal)
598-
expect(logger).to receive(:warn).with(/NOTICE: Allowing Logstash to run as superuser is heavily discouraged as it poses a security risk./)
599-
expect { subject.run(args) }.not_to raise_error
600+
context "intentionally running logstash as superuser " do
601+
before do
602+
expect(Process).to receive(:euid).and_return(0)
603+
end
604+
it "runs successfully with warning message" do
605+
LogStash::SETTINGS.set("allow_superuser", true)
606+
expect(logger).not_to receive(:fatal)
607+
expect(logger).to receive(:warn).with(/NOTICE: Allowing Logstash to run as superuser is heavily discouraged as it poses a security risk./)
608+
expect { subject.run(args) }.not_to raise_error
609+
end
600610
end
601-
end
602611

603-
context "running logstash as non-root " do
604-
before do
605-
expect(Process).to receive(:euid).and_return(100)
606-
end
607-
it "runs successfully without any messages" do
608-
LogStash::SETTINGS.set("allow_superuser", false)
609-
expect(logger).not_to receive(:fatal)
610-
expect(logger).not_to receive(:warn).with(/NOTICE: Allowing Logstash to run as superuser is heavily discouraged as it poses a security risk./)
611-
expect { subject.run(args) }.not_to raise_error
612+
context "running logstash as non-root " do
613+
before do
614+
expect(Process).to receive(:euid).and_return(100)
615+
end
616+
it "runs successfully without any messages" do
617+
LogStash::SETTINGS.set("allow_superuser", false)
618+
expect(logger).not_to receive(:fatal)
619+
expect(logger).not_to receive(:warn).with(/NOTICE: Allowing Logstash to run as superuser is heavily discouraged as it poses a security risk./)
620+
expect { subject.run(args) }.not_to raise_error
621+
end
612622
end
613623
end
614624
end

0 commit comments

Comments
 (0)