T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

The blackbox-exporter runs as node_exporter user which cannot create
ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW
capability to the systemd service when ICMP modules are configured.
In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet.
In VRF mode, replace runuser with setpriv to preserve the capability
across the UID change.

1 files changed, 15 insertions, 1 deletions

diff --git a/data/templates/prometheus/blackbox_exporter.service.j2 b/data/templates/prometheus/blackbox_exporter.service.j2
index 0b846ab73..50e81c5f1 100644
--- a/data/templates/prometheus/blackbox_exporter.service.j2
+++ b/data/templates/prometheus/blackbox_exporter.service.j2
@@ -1,4 +1,14 @@
-{% set vrf_command = 'ip vrf exec ' ~ vrf ~ ' runuser -u node_exporter -- ' if vrf is vyos_defined else '' %}
+{% set icmp_enabled = modules is vyos_defined and modules.icmp is vyos_defined and modules.icmp.name is vyos_defined %}
+{% if vrf is vyos_defined %}
+{%     if icmp_enabled %}
+{# j2lint: disable=operator-enclosed-by-spaces #}
+{%         set vrf_command = 'ip vrf exec ' ~ vrf ~ ' setpriv --reuid=node_exporter --regid=node_exporter --init-groups --inh-caps=+net_raw --ambient-caps=+net_raw -- ' %}
+{%     else %}
+{%         set vrf_command = 'ip vrf exec ' ~ vrf ~ ' runuser -u node_exporter -- ' %}
+{%     endif %}
+{% else %}
+{%     set vrf_command = '' %}
+{% endif %}
 [Unit]
 Description=Blackbox Exporter
 Documentation=https://github.com/prometheus/blackbox_exporter
@@ -8,6 +18,10 @@ After=network.target
 {% if vrf is not vyos_defined %}
 User=node_exporter
 {% endif %}
+{% if vrf is not vyos_defined and icmp_enabled %}
+AmbientCapabilities=CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_RAW
+{% endif %}
 ExecStart={{ vrf_command }}/usr/sbin/blackbox_exporter \
 {% if listen_address is vyos_defined %}
 {%     for address in listen_address %}