feat(secrets): Add unprotected secret implementation

[srebhan]

• Updated associated README.md.
• Wrote appropriate unit tests.
• Pull request title or commits are in conventional commit format

resolves #13804
resolves #13806
resolves #13807
superseeds #13812

This PR introduces an unprotected secret implementation that allows to run Telegraf in environments where the locked-page-limit is low and cannot be changed or where locked pages are not available. To switch to the not recommended unprotected more, you need to start Telegraf with the new --unprotected command-line flag. We issue a warning when running unprotected.

[srebhan]

@redbaron can you please test the binary and also give this a review!?

[redbaron]

Will do. I'll need to rebase out patches on top of this one to be able to run it on our systems. I'll come back with results sometime next week.

[srebhan]

@redbaron any news for the testing?

[powersj]

@redbaron wanted to check in and see if you have had a chance to give this a try?

[FlashSystems]

I've applied this PR as a patch to the current master branch and tried to use the resulting binary within a systemd-nspawn container. The container does not have the CAP_IPC_LOCK capability. My first test was generating config via telegraf -sample-config -unprotected. It crashed right away with the following error message:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x555e96e0d0f4]

goroutine 1 [running]:
github.com/awnumar/memguard/core.Purge.func1(0xc0001d1c70)
        github.com/awnumar/memguard@v0.22.3/core/exit.go:23 +0x34
github.com/awnumar/memguard/core.Purge()
        github.com/awnumar/memguard@v0.22.3/core/exit.go:51 +0x1e
github.com/awnumar/memguard/core.Panic(...)
        github.com/awnumar/memguard@v0.22.3/core/exit.go:85
github.com/awnumar/memguard/core.NewBuffer(0x20)
        github.com/awnumar/memguard@v0.22.3/core/buffer.go:73 +0x51c
github.com/awnumar/memguard/core.NewCoffer()
        github.com/awnumar/memguard@v0.22.3/core/coffer.go:30 +0x2d
github.com/awnumar/memguard/core.init.0()
        github.com/awnumar/memguard@v0.22.3/core/enclave.go:15 +0x29

[srebhan]

@FlashSystems thanks for the test. Will try to fix it and let you know. Would you be willing to give this another try?

[FlashSystems]

@FlashSystems thanks for the test. Will try to fix it and let you know. Would you be willing to give this another try?

Sure. Just let me know when I should give it another try.

[srebhan]

Following the code, I think there is currently nothing we can do about this. The minimum requirement even without locked secrets is a 3-page locked memory region and the ability to lock and protect memory regions. :-(
This is due to the fact that the used memguard library creates its key during import (in the init() function) and Golang not supporting conditional imports...

Would that be a no-go for you @FlashSystems? The only solution would be a build-time flag but given the amount of variants we support this would probably mean a custom-build on your side...

[Hipska]

To me it looks like a good alternative to be able to build a telegraf with unprotected secrets by yourself..

[FlashSystems]

Would that be a no-go for you @FlashSystems? The only solution would be a build-time flag but given the amount of variants we support this would probably mean a custom-build on your side...

OK, I understand the problem. But looking at the Bug-Reports at the top of this PR, I doubt that having a build time parameter is the right solution for all of these use cases. I think that distributions might have a hard time distinguishing at build time if telegraf is run on native hardware or within a container that has CAP_IPC_LOCK removed.

My specific use case is building the Arch Linux telegraf package within a clean chroot. This build process uses a systemd-nspawn container without the CAP_IPC_LOCK privilege. The build process calls the created telegraf binary to create the default configuration included within the package. This triggers the problem. For this use case having a build time option is no solution, because the final package should be built with protected secrets support but when just calling telegraf -sample-config -unprotected secrets support is unnecessary.

[jtroy]

Hi all,

I've been following this with interest as I'm trying to get the latest telegraf built for AIX. AIX only permits mlock() for processes running with root capabilities. After patching memguard's memcall dependency to support AIX and applying these patches, I'm seeing the same panic as @FlashSystems (except when running as root, of course). My use-case is to build, package and run telegraf for AIX in a way that mirrors Linux reasonably closely, so running as a non-root user is important to me. I don't mean to hijack this, just add another voice and volunteer to test.

[srebhan]

Upstream issue created to propose the removal of init() initialization: awnumar/memguard#155

[srebhan]

@redbaron, @FlashSystems and @jtroy can you please test this PR again?!? This includes awnumar/memguard#156 which might fix our issue with memguard initializing on import...

[FlashSystems]

I've tested the new revision of this PR and it works. I can now build the package within a systemd-nspawn container. It even works without using the -unprotected switch, because generating the default config is not accessing any secrets.
Thank you @srebhan, for taking this issue upstream to the memguard project.

[srebhan]

@redbaron any feedback from your side?

[powersj]

@srebhan, can you update this PR with the latest from upstream (and resolve the conflict)? Then we can request one more round of testing? Thanks!

[srebhan]

@FlashSystems, @jtroy, @redbaron can you please test the latest version of this PR once the binary is available!? The required memguard PR #156 changed a bit and I want to make sure we are still fine...

[FlashSystems]

@srebhan: I did a quick test and rebuild the package in the systemd-nspawn container. Generating the configuration file still works fine👍

[telegraf-tiger]

Download PR build artifacts for linux_amd64.tar.gz, darwin_amd64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

☺️ This pull request doesn't significantly change the Telegraf binary size (less than 1%)

📦 Click here to get additional PR build artifacts

Artifact URLs

DEB	RPM	TAR GZ	ZIP
amd64.deb	aarch64.rpm	darwin_amd64.tar.gz	windows_amd64.zip
arm64.deb	armel.rpm	darwin_arm64.tar.gz	windows_arm64.zip
armel.deb	armv6hl.rpm	freebsd_amd64.tar.gz	windows_i386.zip
armhf.deb	i386.rpm	freebsd_armv7.tar.gz
i386.deb	ppc64le.rpm	freebsd_i386.tar.gz
mips.deb	riscv64.rpm	linux_amd64.tar.gz
mipsel.deb	s390x.rpm	linux_arm64.tar.gz
ppc64el.deb	x86_64.rpm	linux_armel.tar.gz
riscv64.deb		linux_armhf.tar.gz
s390x.deb		linux_i386.tar.gz
		linux_mips.tar.gz
		linux_mipsel.tar.gz
		linux_ppc64le.tar.gz
		linux_riscv64.tar.gz
		linux_s390x.tar.gz