T5657: start zabbix-agent under user zabbix for VRF

[sever-sever]

Change Summary

Add user zabbix to sudoers.d and allow to start zabbix-agent2 service under VRF
Remove the user root from the systemd unit override, as we want to start the service from the user zabbix

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe): Start zabbix-agent under user zabbix

Related Task(s)

• https://vyos.dev/T5657

Related PR(s)

Component(s) name

zabbix-agent

Proposed changes

How to test

set service monitoring zabbix-agent host-name 'r4'
set service monitoring zabbix-agent server '192.0.2.5'
set service monitoring zabbix-agent vrf 'mgmt'

check status

vyos@r4# sudo systemctl status zabbix-agent2
● zabbix-agent2.service - Zabbix Agent 2
     Loaded: loaded (/lib/systemd/system/zabbix-agent2.service; disabled; preset: enabled)
    Drop-In: /run/systemd/system/zabbix-agent2.service.d
             └─10-override.conf
     Active: active (running) since Tue 2024-08-13 11:32:40 EEST; 7min ago
       Docs: man:zabbix_agent2
   Main PID: 9587 (sudo)
      Tasks: 8 (limit: 18718)
     Memory: 16.5M
        CPU: 78ms
     CGroup: /system.slice/zabbix-agent2.service
             ├─9587 sudo ip vrf exec mgmt /usr/sbin/zabbix_agent2 --config /run/zabbix/zabbix-agent2.conf --foreground
             └─vrf
               └─mgmt
                 └─9588 /usr/sbin/zabbix_agent2 --config /run/zabbix/zabbix-agent2.conf --foreground

Aug 13 11:32:40 r4 systemd[1]: Started zabbix-agent2.service - Zabbix Agent 2.
Aug 13 11:32:40 r4 sudo[9587]:   zabbix : PWD=/run/zabbix ; USER=root ; COMMAND=/bin/ip vrf exec mgmt /usr/sbin/zabbix_agent2 --config /run/zabbix/zabbix-agent2.conf --for>
Aug 13 11:32:40 r4 sudo[9587]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=101)
Aug 13 11:32:40 r4 sudo[9588]: Starting Zabbix Agent 2 (6.0.14)
Aug 13 11:32:40 r4 sudo[9588]: Zabbix Agent2 hostname: [r4]
Aug 13 11:32:40 r4 sudo[9588]: Press Ctrl+C to exit.
[edit]
vyos@r4# 

Smoketest result

vyos@r4:~$ /usr/libexec/vyos/tests/smoke/cli/test_service_monitoring_zabbix-agent.py
test_01_zabbix_agent (__main__.TestZabbixAgent.test_01_zabbix_agent) ... ok

----------------------------------------------------------------------
Ran 1 test in 13.926s

OK
vyos@r4:~$ 

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

✅ No issues found in unused-imports check.. Please refer the workflow run

[sever-sever]

Only one bug with this solution when stop the service

Aug 13 14:15:30 r4 systemd[1]: Stopping zabbix-agent2.service - Zabbix Agent 2...
Aug 13 14:15:30 r4 systemd[1]: zabbix-agent2.service: Couldn't add UID/GID reference to unit, proceeding without: Device or resource busy
Aug 13 14:15:30 r4 sh[5010]: --: line 1: kill: (4883) - Operation not permitted
Aug 13 14:15:30 r4 systemd[1]: zabbix-agent2.service: Control process exited, code=exited, status=1/FAILURE
Aug 13 14:15:30 r4 ip[4884]: Zabbix Agent 2 stopped. (6.0.14)
Aug 13 14:15:30 r4 sudo[4883]: pam_unix(sudo:session): session closed for user zabbix
Aug 13 14:15:30 r4 systemd[1]: zabbix-agent2.service: Failed with result 'exit-code'.
Aug 13 14:15:30 r4 systemd[1]: Stopped zabbix-agent2.service - Zabbix Agent 2.
Aug 13 14:15:30 r4 sudo[4970]: pam_unix(sudo:session): session closed for user root
Aug 13 14:15:30 r4 systemd[1]: opt-vyatta-config-tmp-new_config_4611.mount: Deactivated successfully.

[c-po]

Why is sudo required?

[sever-sever]

For VRF

Jul 31 16:47:30 r4 systemd[1]: zabbix-agent2.service: Scheduled restart job, restart counter is at 282.
Jul 31 16:47:30 r4 systemd[1]: Stopped zabbix-agent2.service - Zabbix Agent 2.
Jul 31 16:47:30 r4 systemd[1]: Started zabbix-agent2.service - Zabbix Agent 2.
Jul 31 16:47:30 r4 ip[9020]: mkdir failed for /sys/fs/cgroup/system.slice/zabbix-agent2.service/vrf: Permission denied
Jul 31 16:47:30 r4 ip[9020]: Failed to setup vrf cgroup2 directory
Jul 31 16:47:30 r4 systemd[1]: zabbix-agent2.service: Main process exited, code=exited, status=255/EXCEPTION
Jul 31 16:47:30 r4 systemd[1]: zabbix-agent2.service: Failed with result 'exit-code'.

[c-po]

What about ip vrf exec red runuser -u zabbix /usr/bin/zabbix? Can you try it?