mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-08-25 00:43:34 +00:00
4686efd8c8
The unified agent's Linux installer only offered the root profile, and the docs called non-root unsupported. That default is the most-cited reason security-conscious evaluators reject Pulse without trying it. install.sh gains --least-privilege: the service runs as a dedicated nologin pulse-agent system user with every existing hardening directive, no LXC-attach ambient capabilities, docker-group membership for socket reads, and refusal (not silent root fallback) on appliance platforms, non-systemd init systems, and --enable-commands. Optional --grant-smart and --grant-pct restore the only two collectors that need elevation through visudo-validated exact-command sudoers rules and root-owned wrappers the agent reaches via new absolute-path-only PULSE_SMARTCTL_PATH / PULSE_PCT_PATH overrides; the pct grant covers pct list and pct df only and can never widen into pct exec. --update preserves the profile and its grants by reading the installed unit. The agent now authors a privilege block in its report (effective root, service user, active helpers), carried through models into the fleet doctor as a descriptive field: Agent Doctor shows the profile and its helpers instead of presenting intentionally absent collectors as a fault, and a least-privilege agent can never be marked unhealthy on that evidence alone. |
||
|---|---|---|
| .. | ||
| agents | ||
| aicontracts | ||
| audit | ||
| auth | ||
| cloudauth | ||
| db | ||
| discovery | ||
| diskinventory | ||
| edition | ||
| extensions | ||
| fsfilters | ||
| licensing | ||
| metrics | ||
| pbs | ||
| pmg | ||
| proxmox | ||
| pulsecli | ||
| reporting | ||
| securityutil | ||
| server | ||
| tlsutil | ||