From 8bcf938a7b95536c66a34b043915615df489f243 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Thu, 3 Jun 2021 22:55:21 +0200 Subject: prometheus: fix blackbox exporter icmp probes --- roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'roles/monitoring/prometheus/exporter/blackbox/templates/service.j2') diff --git a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 index c9c5712c..a8a91d0b 100644 --- a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 @@ -8,8 +8,13 @@ ExecStart=/usr/bin/prometheus-blackbox-exporter --web.listen-address="127.0.0.1: ExecReload=/bin/kill -HUP $MAINPID # systemd hardening-options +{% if prometheus_exporter_blackbox_modules | combine(prometheus_exporter_blackbox_modules_extra) | dict2items | selectattr('value.prober', 'eq', 'icmp') | length > 0 %} AmbientCapabilities=CAP_NET_RAW CapabilityBoundingSet=CAP_NET_RAW +{% else %} +AmbientCapabilities= +CapabilityBoundingSet= +{% endif %} DeviceAllow=/dev/null rw DevicePolicy=strict LockPersonality=true @@ -17,7 +22,6 @@ MemoryDenyWriteExecute=true NoNewPrivileges=true PrivateDevices=true PrivateTmp=true -PrivateUsers=true ProtectControlGroups=true ProtectHome=true ProtectKernelModules=true -- cgit v1.2.3