Branch: refs/heads/2.1.0
Home: https://github.com/tribe29/checkmk
Commit: a957a056d291f483bd5d879189a657e680e84bbb
https://github.com/tribe29/checkmk/commit/a957a056d291f483bd5d879189a657e68…
Author: Mathias Laurin <mathias.laurin(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
A .werks/13911
M livestatus/src/RRDColumn.cc
Log Message:
-----------
13911 FIX Improve RRD logging when path to DB is missing
Calling `rrdtool flushcached --daemon ...` without the required `file`
argument spams the log file with unhelpful messages such as
Error flushing RRD: Usage: rrdtool rrdtool flushcached [--daemon|-d <addr>] <file> [<file> ...]
Change-Id: I044167f3b5a91738fcd51a0610c7f32f69ffa2eb
---
Attempts to flush the DB when the path to the RRD database is
missing would produce the rather unhelpful error
"Error flushing RRD: Usage: rrdtool flushcached [--daemon|-d <addr>] <file> [<file> ...]"
This fix removes the flushing attempt and silences the
corresponding error in the log.
---
SUP-10577
Change-Id: Iee8d308b38fc5107b1defd2de459aac1fec7766c
Branch: refs/heads/master
Home: https://github.com/tribe29/checkmk
Commit: e6347623e4c62d64e2ae0c458158add3ac4978c5
https://github.com/tribe29/checkmk/commit/e6347623e4c62d64e2ae0c458158add3a…
Author: Mathias Laurin <mathias.laurin(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
A .werks/13911
M livestatus/src/RRDColumn.cc
Log Message:
-----------
13911 FIX Improve RRD logging when path to DB is missing
Calling `rrdtool flushcached --daemon ...` without the required `file`
argument spams the log file with unhelpful messages such as
Error flushing RRD: Usage: rrdtool rrdtool flushcached [--daemon|-d <addr>] <file> [<file> ...]
---
Attempts to flush the DB when the path to the RRD database is
missing would produce the rather unhelpful error
"Error flushing RRD: Usage: rrdtool flushcached [--daemon|-d <addr>] <file> [<file> ...]"
This fix removes the flushing attempt and silences the
corresponding error in the log.
---
SUP-10577
Change-Id: Iee8d308b38fc5107b1defd2de459aac1fec7766c
Branch: refs/heads/2.0.0
Home: https://github.com/tribe29/checkmk
Commit: 1a926adae634488532deb6d98aa88dc9b65b4c9b
https://github.com/tribe29/checkmk/commit/1a926adae634488532deb6d98aa88dc9b…
Author: Kenneth Okoh <kenneth.okoh(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
A .werks/14488
M web/htdocs/themes/facelift/scss/_mega_menu.scss
Log Message:
-----------
14488 Mega menu: Expand search bar width
The search bars in the mega menus "Monitor" and "Setup" are set to a higher default width and they now grow with the mega menu's width. Users can now put in longer and more complex search terms without running out of space.
Change-Id: I75f8595855db179315742d38df43717ccd88cd4e
Branch: refs/heads/2.1.0
Home: https://github.com/tribe29/checkmk
Commit: 1b042edb8b95547858ea7d7a6656bda21e01d225
https://github.com/tribe29/checkmk/commit/1b042edb8b95547858ea7d7a6656bda21…
Author: Kenneth Okoh <kenneth.okoh(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
A .werks/14488
M web/htdocs/themes/facelift/scss/_mega_menu.scss
Log Message:
-----------
14488 Mega menu: Expand search bar width
The search bars in the mega menus "Monitor" and "Setup" are set to a higher default width and they now grow with the mega menu's width. Users can now put in longer and more complex search terms without running out of space.
Change-Id: I75f8595855db179315742d38df43717ccd88cd4e
Branch: refs/heads/master
Home: https://github.com/tribe29/checkmk
Commit: 54996bf301a6c9959ec0d00da45e21bf327b6130
https://github.com/tribe29/checkmk/commit/54996bf301a6c9959ec0d00da45e21bf3…
Author: Sven Panne <sven.panne(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
M cmk/base/agent_based/discovery/__init__.py
M cmk/gui/plugins/openapi/endpoints/service_discovery.py
M cmk/utils/type_defs/_misc.py
M cmk/utils/version.py
Log Message:
-----------
Use assert_never() from typing_extensions.
Starting with Python 3.11, assert_never() will be part of the typing module,
but for now we have to rely on typing_extensions.
Change-Id: Ib3c9de316c66285bab3e3d29362bc29961e2b864
Commit: 7db1f52cf62bade70c2ab21fee690b87880f32e6
https://github.com/tribe29/checkmk/commit/7db1f52cf62bade70c2ab21fee690b878…
Author: Moritz Kiemer <moritz.kiemer(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
M tests/agent-plugin-unit/test_mk_logwatch.py
Log Message:
-----------
cleanup tests
Change-Id: Ida294aa2c44cb65888b04675b6953dd777454ffe
Compare: https://github.com/tribe29/checkmk/compare/9c01c81c0623...7db1f52cf62b
Branch: refs/heads/master
Home: https://github.com/tribe29/checkmk
Commit: 9c01c81c0623807a7759da78c2cda67beab1f0f3
https://github.com/tribe29/checkmk/commit/9c01c81c0623807a7759da78c2cda67be…
Author: Lars Michelsen <lm(a)tribe29.com>
Date: 2022-07-13 (Wed, 13 Jul 2022)
Changed paths:
A .werks/14281
M omd/packages/apache-omd/APACHE_TCP_ADDR
M omd/packages/apache-omd/APACHE_TCP_PORT
M omd/packages/omd/hooks/APACHE_MODE
M omd/packages/omd/omd.8
M omd/packages/omd/omdlib/main.py
M omd/packages/omd/omdlib/system_apache.py
A tests/unit/omdlib/test_system_apache.py
Log Message:
-----------
14281 SEC Fix local privilege escalation from site users
Each Checkmk site provides it's HTTP services (UI, APIs) using it's own site
Apache process. Global access to this site Apache is provided via the system
Apache which is opening the 80 and 443 ports for external requests, depending
on your system configuration.
To learn about the site Apache, the system Apache reads a reverse proxy
configuration provided by the site user. This could be used by a site user to
make the system Apache execute code as root user, since the System Apache is
typically started initially with root privileges.
To close this gap, we now need to separate the system Apache configuration from
the site user access.
To eliminate the privilege escalation, you will have to execute the command
<tt>omd update-apache-config [SITE]</tt> once for each of your sites after
the <tt>omd update</tt> command.
Besides the one-time fix, this change has a consequence for the use of <tt>omd
config</tt> and <tt>omd update</tt>. There are two situations where this is
relevant:
a) If you change the options APACHE_TCP_ADDR, APACHE_TCP_PORT or APACHE_MODE
You will have to call <tt>omd update-apache-config [SITE]</tt> as root user after
changing one of the site configuration options APACHE_TCP_ADDR, APACHE_TCP_PORT
or APACHE_MODE. This needs to be done to update and apply the system Apache
configuration. If you don't do this and start your site, your UI may be not
available anymore.
The <tt>omd config</tt> command will output a warning to notify you about this
necessary step in the future.
b) If you execute <tt>omd update</tt> and the proxy configuration changes
The update is performed as site user. Which means that, after this werk, we can
not update and apply the system apache configuration anymore automatically.
To apply the latest apache configuration, the command <tt>omd
update-apache-config [SITE]</tt> needs to be executed after the update.
The <tt>omd update</tt> will automatically detect the need for this additional
step and show you a confirmation dialog before starting the update to notify
you about this necessary step and giving you the chance to interrupt the
procedure in case you don't have the option to execute the command as root
user.
All maintained versions (>=1.6) are subject to this vulnerability. It is likely
that also previous versions were vulnerable. Users of previous versions are
highly recommended to update or consider other mitigations.
We thank Jan-Philipp Litza (PLUTEX GmbH) for reporting this issue!
Change-Id: I03058d515dc4f53b3e998efd7b9e54389bf5656c