host_exporters: IPMI tools read a static root-owned FreeIPMI config pinned in sudoers, sudo logs allowed commands

2026-10-25 15:27:06 +00:00
parent 89821b479b
commit 4dc7b23e06
2 changed files with 44 additions and 7 deletions
@@ -10,10 +10,16 @@ host_exporters_ipmi_collectors:
  - bmc
  - sel
  - chassis
+# The tools run as root and parse the FreeIPMI configuration file named by --config-file. The exporter
+# writes that file itself (a named pipe in its /tmp, empty for in-band local mode), so a compromised
+# exporter could set options such as sdr-cache-directory and make root write anywhere. The wrappers
+# therefore replace the path with this static root-owned file, and sudoers admits only that path.
+host_exporters_ipmi_freeipmi_conf: /etc/ipmi-exporter/freeipmi.conf
+
 # FreeIPMI tool behind each collector and the fixed arguments the exporter (1.10) passes before
-# --config-file <temporary file>. sudo admits exactly these, so a compromised exporter cannot
-# run chassis control or clear the SEL. A different exporter version needs matching arguments
-# (ipmi_up stays 0 until then). dcmi is not listed: the S1200RP BMC has no power monitoring.
+# --config-file. sudo admits exactly these, so a compromised exporter cannot run chassis control or
+# clear the SEL. A different exporter version needs matching arguments (ipmi_up stays 0 until then).
+# dcmi is not listed: the S1200RP BMC has no power monitoring.
 host_exporters_ipmi_tools:
  ipmi:
    tool: ipmimonitoring