Files
Thomas Vincent 898d8c692c fix(privileges): drop root before input and retain owned ICMP sockets (#639)
Open and own the required ICMP sockets before permanently dropping
setuid root, then parse input without elevated identity. Close-on-exec
socket ownership, shared IPv4/IPv6 dispatch and fault-injected
identity/capability calls are covered. The owned fixture tests check
deny/allow behavior without contacting external devices.

Step 2/14 of the complete C17/native-correctness series. Base: the
preceding series branch; merge/review in order so this PR shows only its
own step.

Earlier validation, before this review follow-up, in isolated copied
snapshots on Linux arm64:

- Clean GCC build and make check: 13 passed, 1 existing prerequisite
skips, 0 failures.
- ASan/UBSan: 12 passed, 2 existing privilege/allocator-interposition
prerequisite skips, 0 failures; no sanitizer findings.
- Production source/profile integrity verification against disposable
MariaDB and loopback SNMP fixtures passed.
- Release archive extracted into a separate source tree and built/tested
out of tree; fuzz checks passed.

Earlier local profiles retain source hashes for the copied validation
tree; GitHub checks validate the published commit. No production
database/device, host installation or live privilege change is part of
validation. Existing prerequisite skips were retained; no test or
finding was suppressed to obtain a pass.


Series navigation: [Series
index](https://github.com/Cacti/spine/pull/638); [previous
step](https://github.com/Cacti/spine/pull/638). [Next
step](https://github.com/Cacti/spine/pull/640).

Review follow-up (2026-10-09): Restacked on the corrected preceding
branches. The SNMP status fix is introduced in #638, the
reindex/completion fixes in #640, and focused regression coverage in
#650.

Restacked tip validation: isolated Linux arm64 build and make check
passed (18 passed, 1 setuid prerequisite skip, no failures).
GitHub checks validate the updated published commits; earlier
profile/archive/sanitizer evidence above belongs to the previous
revisions.

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
2026-10-10 21:08:52 -04:00

161 lines
5.4 KiB
Plaintext

Spine is a high speed poller replacement for cmd.php. It is almost 100%
compatible with the legacy cmd.php processor and provides much more
flexibility, speed and concurrency than cmd.php.
Make sure that you have the proper development environment to compile Spine.
This includes compilers, header files and things such as libtool. If you
have questions please consult the forums and/or online documentation.
Development
===========
DEVELOP branch should generally be considered UNSTABLE, use with caution!
-----------------------------------------------------------------------------
Unix Installation
=================
These instructions assume the default install location for spine
of /usr/local/spine. If you choose to use another prefix, make
sure you update the commands as required for that new path.
To compile and install Spine using MySQL versions 5.5 or higher
please do the following:
1. Run the bootstrap process to automatically create the configure script
./bootstrap
2. Run the configure process to detect what is available on the system
./configure
3. Build spine
make
4. Optionally, install spine to the default location (/usr/local/spine/bin/)
but do note that if you manually copy to another folder, change the paths
below to reflect the correct folder you want spine to run from:
make install
chown root:root /usr/local/spine/bin/spine
chmod u+s /usr/local/spine/bin/spine
Spine is setuid root only so that it can send ICMP pings. Before it
reads any option or file it opens its raw ICMP sockets, or with
--enable-lcap keeps only CAP_NET_RAW, and then drops root for good. If
it cannot get ICMP that way it still drops root and keeps polling: ICMP
pings use datagram sockets where net.ipv4.ping_group_range allows them,
and otherwise fall back to UDP with a warning. Spine exits only if it
cannot confirm that root is gone. When root itself runs spine, for
example from root's crontab, it keeps root as before. Without the
setuid bit, ICMP works where net.ipv4.ping_group_range covers the poller
user, or where the binary has CAP_NET_RAW (setcap cap_net_raw+ep).
To compile and install Spine using MySQL versions previous to 5.5 please add
the additional --with-reentrant option to the ./configure command above but
please be aware that Cacti no longer officially supports MySQL prior to 5.5.
Windows Installation
====================
CYGWIN Prerequisite
-------------------
1. Download Cygwin for Window from https://www.cygwin.com/
2. Install Cygwin by executing the downloaded setup program
3. Select _Install from Internet_
4. Select Root Directory: _C:\cygwin_
5. Select a mirror which is close to your location
6. Once on the package selection section make sure to select the following (TIP: use the search!):
* autoconf
* automake
* dos2unix
* gcc-core
* gcc-debuginfo
* gzip
* help2man
* libmariadb-devel (preferred) or libmysqlclient
* libtool
* m4
* make
* net-snmp-devel
* libssl-devel
* wget
7. Wait for installation to complete, coffee time!
8. Move the cygwin setup to the C:\cygwin\ folder for future usage.
Compile Spine
-------------
1. Open Cygwin shell prompt (C:\Cygwin\cygwin.bat) and brace yourself to use unix commands on Windows.
2. Download the Spine source to the current directory:
http://www.cacti.net/spine_download.php
3. Extract Spine into C:\Cygwin\usr\src\<spineversion>:
tar xzvf cacti-spine-*.tar.gz
4. Change into the Spine directory:
cd /usr/src/cacti-spine-*
5. Run bootstrap to prepare Spine for compilation:
./bootstrap
6. Follow the instruction which bootstrap outputs.
7. Update the spine.conf file for your installation of Cacti. You can optionally
move it to a better location if you choose to do so, make sure to copy the
spine.conf as well.
8. Ensure that Spine runs well by running with:
/usr/local/spine/spine -R -S -V 3
9. Update Cacti 'Paths' Setting to point to the Spine binary and update the
'Poller Type' to Spine. For the spine binary on Windows x64, and using default
locations, that would be:
C:\cygwin64\usr\local\spine\bin\spine.exe
10. If all is good Spine will be run from the poller in place of cmd.php.
--------------------------------------------------------------------------------------
Known Issues
============
1. On Windows, Microsoft does not support a TCP Socket send timeout. Therefore,
if you are using TCP ping on Windows, spine will not perform a second or subsequent
retries to connect and the host will be assumed down on the first failure.
If this is a problem it is suggested to use another Availability/Reachability
method, or moving to Linux/UNIX.
2. Spine takes quite a few MySQL connections. The number of connections is calculated
as follows:
* main poller take one connection
* all threads take one connection each
* all script servers take one connection each
Therefore, if you have 4 processes, with 10 threads each, and 5 script servers each
your spine will take approximately:
total connections = 4 * ( 1 + 10 + 5 ) = 64
3. On older MySQL versions, different libraries had to be used to make MySQL thread
safe. MySQL versions 5.0 and 5.1 require this flag. If you are using these version
of MySQL, you must use the --with-reentrant configure flag.
-----------------------------------------------
Copyright (c) 2004-2026 - The Cacti Group, Inc.