From dc623ed9620635a08708d8e62dab252f7be7bcee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= <aurelien@bompard.org>
Date: Fri, 2 Jun 2023 08:15:12 +0200
Subject: [PATCH] Collectd improvements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Increase the service stop timeout to give collectd time to flush the
  values to RRD files on the disk. It currently takes ~1m30s, setting
  the timeout to 5m
- add the unix socket plugin and configure the CGI to make use of it to
  request a flush of the RRD values when a graph is generated
- add SELinux permissions to allow those two to talk to each other

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
---
 .../base/files/selinux/fi-collectd.mod        | Bin 4112 -> 4479 bytes
 .../base/files/selinux/fi-collectd.pp         | Bin 4128 -> 4495 bytes
 .../base/files/selinux/fi-collectd.te         |  11 +++++++++-
 roles/collectd/server/files/collection.conf   |   2 +-
 .../server/files/service.timeout.conf         |   3 +++
 roles/collectd/server/files/unixsock.conf     |   7 +++++++
 roles/collectd/server/tasks/main.yml          |  19 ++++++++++++++++++
 7 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 roles/collectd/server/files/service.timeout.conf
 create mode 100644 roles/collectd/server/files/unixsock.conf

diff --git a/roles/collectd/base/files/selinux/fi-collectd.mod b/roles/collectd/base/files/selinux/fi-collectd.mod
index e349334f388077a2a84b3c0e47e96686d248957f..591c3685b8f7ab0e7b07a4f571aee645f4305665 100644
GIT binary patch
delta 469
zcmX|7OG^S#6!toE=i!WwX_VwZ7SSeX6FqimxljUaVT)FiOhTf}h)ucm4}`(DidNC4
zMM2=AMT_VcxabE&&_08pMGL!kd@K&<JLi1o^<Ab0i;ous&zg=a;)ZD;5RjSKCvMAu
z68s5ASv0l~%0d!LLX^f>mhx!UcI)+u?Hya^<)+m<b1Y9`HN$6?ge@ZZ=uU``C`U%4
z>Drc4@hs0^JQ*LtDv9`<6){FsA03JrqHv^DohoDUt8~1I1ri=IsY<6<PUO+d<bqSX
zS#694Ypi7AfbNhOj-*{|OD2BlJ!-Ov7b%CHoWdW?VofnI2<6dN=J6$G@uZq4DmO4g
zNoeW=+RVSHd3-Xz$#^*}iR)0Fq>+*4cqeHyv<z1(p{DIq!p=&wjY-@}3G{;^dQ^wZ
zwiXoyrErwxbi8ZpWPopd1AF>3I(nkp(t|<j>x=~<p5kN1#<iaOI8wRWi4;hjYcQz{
Jzemr=`~$qkf35%k

delta 333
zcmX9(JxIe~6zta|U%vcDrC3P7qKlJ@4sLC&Lo4Fs9<``MBndSwZe1KJNN;geDvBT|
zba8WX>f-Lu(ZR*Ry}s1p-rc)99=yroRq5rDDLj|Uar9XSh5WB&)0V*{2;4|sA&Jk@
zqwqXP+6Sj$Ge`v`R+a$LI+LgBOR|}rDJN;g%^*5VgVdp(f|9(#%xULDo@MG(UCUL*
zGi8KPNKJ*BdSBULMrPWb{Z`OwNB<WzvV6QN8_dNAui=^dIOb0nm_?LzfmhkZn6F`E
zW_}%Ws*l*HqbCb=)gl71iBIz0#4Rdf0bT78cfvzWZ(vXJ@Ibt*doYX!dc-mD5Aleb
l7#q8|uw6{dDl4OEZP85l{BU69^Yre$vo!p6Dh%5*tAC+fV2l6&

diff --git a/roles/collectd/base/files/selinux/fi-collectd.pp b/roles/collectd/base/files/selinux/fi-collectd.pp
index 72f1e69abff402443075a1dc21cabee933ff1b12..c61021eb186475c67d53f9f4ab5c37979ad0763e 100644
GIT binary patch
delta 466
zcmX|7Jxjw-6zyyB^3j(xu@zfPz=Gf;f}kR}w6>sGs)B>y5F{;Fkha#ULkHa)m7ZCu
zqo^Qs@gF!ih`*qNKR|@;^}Y0CxZHE^J@@N8WNzo*?g>7bfhSTkX(SR+xdq3y%PP{*
zzG?GlY%!cl4pt<aCU};LC>7LBPRc>E<X;>${Kk3JZ)&_|h0Kz)PLvS6OL1ZgWYrtB
zz^|5@e$(PS6@StaiHDpGIYIOgRpcDe1Y(tHg)_xf2EOGYF^5d5(<z>lMKm+H;4ElV
z>Z8Gomt2(TCP|>K<guf;P?Z<7R2N^$HhO9XOer9*xv-em*5@!#3;57o_}U{DV-6hs
z6?feK=pOpqZ^b+uFbB^uk7Ti@%!)>G&Cvp`*gjfpmlA$emM?VBRnl!qMvodu@twY=
zp=8=^$-pmLB?Az14Tr`wI!3yCV??7g6dB7>G9!kJO$a@Ca3pcJ6EBja5MWXnzK))i
F`v;BjdvpK*

delta 333
zcmX9(Jxc>Y6wF@sHk;e~QV;_dPzbgnXpv5%7Kw!)Xek^T6b|I>I4@Cb;y(yDmJ$4D
z6f6QKTH4xKS*5YJNF!L-xEqUkGjC>i@Vb@j>HZbbSuU4jxFv1OXy2ACHw9OMqo4OC
z;^;U%3{L&HwSN>e{glhZQVH(zRYFJVCvOv5DJM>%rXL=pe(K1cjyXC@%u(lzj+4Sj
z-P0OjN{Jv0WK)+-1FpVKgmUfnUg9UM@c%?nT4j9b%f!VeTfr+U<AgmTGfUVoINqp>
zAzQ$}RDK<mLKz)VM~`xJ3nfH+6<^YO=Qr5oQ|J~S@WefA8x6!o4=<9dh6hhH(39K|
rjSJynz)TFq4lZpMj#VRz*s|8-JZF<xW@(yy_t~jrzs?fD?%4bve&b=U

diff --git a/roles/collectd/base/files/selinux/fi-collectd.te b/roles/collectd/base/files/selinux/fi-collectd.te
index 630d7fa6e4..248c2a3218 100644
--- a/roles/collectd/base/files/selinux/fi-collectd.te
+++ b/roles/collectd/base/files/selinux/fi-collectd.te
@@ -4,6 +4,8 @@ require {
     type shell_exec_t;
     type bin_t;
     type collectd_t;
+    type collectd_script_t;
+    type collectd_var_run_t;
     type configfs_t;
     type hostname_exec_t;
     type init_t;
@@ -16,7 +18,7 @@ require {
     type initrc_t;
     type proc_net_t;
 
-    class capability { kill setuid dac_read_search sys_ptrace setgid dac_override };
+    class capability { kill setuid dac_read_search sys_ptrace setgid dac_override chown };
     class dir { getattr read };
     class file { execute read write getattr execute_no_trans ioctl open };
     class lnk_file read;
@@ -42,3 +44,10 @@ allow collectd_t anon_inodefs_t:file { write read };
 allow collectd_t initrc_t:unix_stream_socket connectto;
 allow collectd_t proc_net_t:lnk_file read;
 allow collectd_t self:netlink_generic_socket { create bind getattr };
+# allow chown for the unix socket
+# https://bugzilla.redhat.com/show_bug.cgi?id=1304029#c9
+allow collectd_t self:capability chown;
+
+# Allow the CGI to request a flush of the RRDs through collectd's unix socket
+#============= collectd_script_t ==============
+allow collectd_script_t collectd_var_run_t:sock_file write;
diff --git a/roles/collectd/server/files/collection.conf b/roles/collectd/server/files/collection.conf
index 8ace02ded5..f82addab37 100644
--- a/roles/collectd/server/files/collection.conf
+++ b/roles/collectd/server/files/collection.conf
@@ -1,6 +1,6 @@
 #DataDir "/var/lib/collectd/rrd"
 GraphWidth 400
-#UnixSockAddr "/var/run/collectd-unixsock"
+UnixSockAddr "/var/run/collectd-unixsock"
 <Type apache_bytes>
   DataSources value
   DSName "value Bytes/s"
diff --git a/roles/collectd/server/files/service.timeout.conf b/roles/collectd/server/files/service.timeout.conf
new file mode 100644
index 0000000000..2259924df7
--- /dev/null
+++ b/roles/collectd/server/files/service.timeout.conf
@@ -0,0 +1,3 @@
+# Give collectd the time to flush data to rrd files on disk
+[Service]
+TimeoutStopSec=5m
diff --git a/roles/collectd/server/files/unixsock.conf b/roles/collectd/server/files/unixsock.conf
new file mode 100644
index 0000000000..6a275abb13
--- /dev/null
+++ b/roles/collectd/server/files/unixsock.conf
@@ -0,0 +1,7 @@
+LoadPlugin unixsock
+<Plugin unixsock>
+        SocketFile "/var/run/collectd-unixsock"
+        SocketGroup "apache"
+        SocketPerms "0660"
+        DeleteSocket true
+</Plugin>
diff --git a/roles/collectd/server/tasks/main.yml b/roles/collectd/server/tasks/main.yml
index af84619da1..2b273f40f4 100644
--- a/roles/collectd/server/tasks/main.yml
+++ b/roles/collectd/server/tasks/main.yml
@@ -50,6 +50,7 @@
   loop:
   - rrdtool.conf
   - fmn.conf
+  - unixsock.conf
   notify:
   - restart collectd
   tags:
@@ -85,3 +86,21 @@
   tags:
   - config
   - collectd/server
+
+- name: create the service configuration directory
+  file:
+    path: /etc/systemd/system/collectd.service.d
+    type: directory
+  tags:
+  - config
+  - collectd/server
+
+- name: override the timeout for stopping collectd
+  copy:
+    src: service.timeout.conf
+    dest: /etc/systemd/system/collectd.service.d/timeout.conf
+  notify:
+  - reload systemd
+  tags:
+  - config
+  - collectd/server