CAP_SYS_ADMIN does not allow loki.source.file to read /var/log/messages owned by root:root

[Nachtfalkeaw]

What's wrong?

I am running alloy 1.5.1. because I want to use beyla.ebpf I use capabilities. One of these capabilities is CAP_SYS_ADMIN (https://man7.org/linux/man-pages/man7/capabilities.7.html)

This capability - I think - should allow more or less root privileges. However with this capability alloy running as grafana:grafana it is not possible to use loki.source.file to read /var/log/messages owned by root:root.

Error:
Nov 26 23:10:43 hostname alloy[2798317]: ts=2024-11-26T22:10:43.200409405Z level=error msg="failed to start tailer" component_path=/ component_id=loki.source.file.varlog_messages error="open /var/log/messages: permission denied" filename=/var/log/messages

Steps to reproduce

1. create a separate user and group grafana:grafana which is not root.
2. try to tail a log file e.g. /var/log/messages which is owned by root:root and can not be read by "other".
3. set capability CAP_SYS_ADMIN to alloy

System information

RHEL 8

Software version

Grafana 1.5.1

Configuration

loki.source.file

Logs

Error:
`Nov 26 23:10:43 hostname alloy[2798317]: ts=2024-11-26T22:10:43.200409405Z level=error msg="failed to start tailer" component_path=/ component_id=loki.source.file.varlog_messages error="open /var/log/messages: permission denied" filename=/var/log/messages`

[Nachtfalkeaw]

##2535

[Nachtfalkeaw]

@mariomac and @grcevski
I know this is an older version of beyla in alloy 1.5.1 than the single binary however you may have a look which capabilities are needed with latest 2.x.y beyla, update the docs and make sure that the alloy integration of beyla can use these capabilities or maybe these capabilities can be used by other components within alloy.

[grcevski]

Thanks for reporting, we'll investigate this.

[rafaelroquetto]

@Nachtfalkeaw just to confirm, as I am going to have a look at this, how are you granting CAP_SYS_ADMIN to alloy?