T9002: grant CAP_NET_RAW to blackbox-exporter when ICMP modules are configured

The blackbox-exporter runs as node_exporter user which cannot create
ICMP sockets due to restricted ping_group_range. Add CAP_NET_RAW
capability to the systemd service when ICMP modules are configured.
In non-VRF mode, use systemd AmbientCapabilities/CapabilityBoundingSet.
In VRF mode, replace runuser with setpriv to preserve the capability
across the UID change.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/conf_mode/service_monitoring_prometheus.py b/src/conf_mode/service_monitoring_prometheus.py
index b02f9f154..79b557329 100755
--- a/src/conf_mode/service_monitoring_prometheus.py
+++ b/src/conf_mode/service_monitoring_prometheus.py
@@ -20,6 +20,8 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import is_node_changed
+from vyos.configdict import node_changed
+from vyos.configdiff import Diff
 from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.utils.process import call
@@ -76,6 +78,12 @@ def get_config(config=None):
     tmp = False
     for node in ['vrf', 'config-file']:
         tmp = tmp or is_node_changed(conf, base + ['blackbox-exporter', node])
+    modules_changed = node_changed(
+        conf,
+        base + ['blackbox-exporter', 'modules'],
+        expand_nodes=Diff.ADD | Diff.DELETE,
+    )
+    tmp = tmp or 'icmp' in modules_changed
     if tmp:
         monitoring.update({'blackbox_exporter_restart_required': {}})