gilles/nano_metrics
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

fix(smart v0.1.17): smart_status optionnel + AmbientCapabilities CAP_SYS_ADMIN

Browse Source 
- SmartJson.smart_status devient Option<SmartStatus> avec #[serde(default)]
  → parsing non-bloquant si le champ est absent (ex: NVME_IOCTL_ADMIN_CMD échoue)
- Service: suppression NoNewPrivileges, ajout AmbientCapabilities=CAP_SYS_ADMIN
  → smartctl hérite la capability via execve (kernel ≥ 5.2)
- Nettoyage logs debug (suppression dump JSON brut)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Gilles Soulier
2026-05-23 14:10:53 +02:00
parent 3c15943e2e
commit 7fb47ffde8
4 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/nanometrics-agent.service
+6 -1
View File
@@ -17,7 +17,12 @@ ConfigurationDirectoryMode=0755
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=yes
NoNewPrivileges=yes
# CAP_SYS_ADMIN est requis par le noyau pour NVME_IOCTL_ADMIN_CMD (lecture SMART NVMe).
# NoNewPrivileges est retiré car il efface les ambient capabilities sur exec (noyau ≥ 5.2),
# ce qui empêcherait smartctl enfant d'hériter la capability.
# CapabilityBoundingSet borne à la seule cap nécessaire.
CapabilityBoundingSet=CAP_SYS_ADMIN
AmbientCapabilities=CAP_SYS_ADMIN
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX