Linux setcap : fatal error:invalid argument Note must be a regular (non-symlink) file

Question

我的linux是CentOS7。

当我以非 root 用户运行 Elastic Beats-Auditbeat 时，它显示此错误:

ERROR   instance/beat.go:877    Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted
Exiting: 1 error: 1 error: failed to create audit client: failed to get audit status: operation not permitted` 

所以我用这个命令检查进程缺少的能力

strace ./auditbeat -c 1 本地主机 2>&1 | grep EPERM 它显示:

epoll_ctl(4, EPOLL_CTL_ADD, 3, {EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, {u32=66785192, u64=140471267168168}}) = -1 EPERM (Operation not permitted)
epoll_ctl(4, EPOLL_CTL_DEL, 3, {0, {u32=0, u64=0}}) = -1 EPERM (Operation not permitted)

我发现缺少的能力是CAP_BLOCK_SUSPEND doc .

但是当我运行命令时 setcap cap_block_suspend=ep auditbeat 它显示:

fatal error: Invalid argument
usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]

Note <filename> must be a regular (non-symlink) file.

而 auditbeat 只是一个常规文件:

[usr@linuxhost auditbeat-7.2.0-linux-x86_64]$ stat auditbeat
File: ‘auditbeat’
Size: 70418699        Blocks: 137544     IO Block: 4096   regular file
Device: pasef/17006b   Inode: 410084318   Links: 1
Access: (0755/-rwxr-xr-x)  Uid: ( 1004/  usr  )   Gid: ( 1004/  usr  )
Access: 2019-08- 0:39:29.160306947 +000
Modify: 2019-06-20 23:04:01.000000000 +000
Change: 2019-08- 0:39:06.226434256 +000
Birth: -

我该如何解决？

谢谢。

Answer 1

我遇到了同样的问题。我的问题发生是因为我正在使用的文件位于已安装的文件系统中。我通过将文件复制到/tmp，在/tmp 文件上运行 setcap，然后创建一个从/tmp 回到原始位置的符号链接(symbolic link)来解决这个问题。