On 2026-09-02 17:01, Atanas Vladimirov wrote:
> On 2026-08-28 17:34, Atanas Vladimirov wrote:
>> Hello,
>>
>> The example doas.conf(5) rules in the README permit _telegraf to run
>> unbound-control(8) as _unbound and nsd-control(8) as _nsd. The
>> plugins only replaced sudo with doas and invoked
>>
>> doas /usr/sbin/unbound-control stats_noreset
>> doas /usr/sbin/nsd-control stats_noreset
>>
>> doas(1) defaults to root unless -u is given, so those rules never match
>> and the plugins fail with exit status 1.
>>
>> Pass -u _unbound / -u _nsd so the commands match the README.
>>
>> ok?
>
> Ping?
Morning,
Adding Lucas Raab in CC in case he missed it :)
By the way the other way around is to update the README and drop the
-u _unbound / -u _nsd from the doas examples.
Best wishes,
Atanas
>
>>
>> Index: Makefile
>> ===================================================================
>> RCS file: /cvs/ports/sysutils/telegraf/Makefile,v
>> diff -u -p -r1.47 Makefile
>> --- Makefile 20 Jul 2026 22:44:35 -0000 1.47
>> +++ Makefile 28 Aug 2026 14:31:39 -0000
>> @@ -14,6 +14,8 @@ MAINTAINER = Lucas Raab <tuftedocelot@fa
>>
>> CATEGORIES = sysutils
>>
>> +REVISION = 0
>> +
>> # MIT
>> PERMIT_PACKAGE = Yes
>>
>> Index: patches/patch-plugins_inputs_nsd_nsd_go
>> ===================================================================
>> RCS file:
>> /cvs/ports/sysutils/telegraf/patches/patch-plugins_inputs_nsd_nsd_go,v
>> diff -u -p -r1.3 patch-plugins_inputs_nsd_nsd_go
>> --- patches/patch-plugins_inputs_nsd_nsd_go 6 Mar 2025 01:58:54 -0000
>> 1.3
>> +++ patches/patch-plugins_inputs_nsd_nsd_go 28 Aug 2026 14:31:40 -0000
>> @@ -1,11 +1,13 @@
>> Index: plugins/inputs/nsd/nsd.go
>> --- plugins/inputs/nsd/nsd.go.orig
>> +++ plugins/inputs/nsd/nsd.go
>> -@@ -120,7 +120,7 @@ func nsdRunner(cmdName string, timeout config.Duration
>> +@@ -119,8 +119,8 @@ func nsdRunner(cmdName string, timeout config.Duration
>> + cmd := exec.Command(cmdName, cmdArgs...)
>>
>> if useSudo {
>> - cmdArgs = append([]string{cmdName}, cmdArgs...)
>> +- cmdArgs = append([]string{cmdName}, cmdArgs...)
>> - cmd = exec.Command("sudo", cmdArgs...)
>> ++ cmdArgs = append([]string{"-u", "_nsd", cmdName}, cmdArgs...)
>> + cmd = exec.Command("doas", cmdArgs...)
>> }
>>
>> Index: patches/patch-plugins_inputs_unbound_unbound_go
>> ===================================================================
>> RCS file:
>> /cvs/ports/sysutils/telegraf/patches/patch-plugins_inputs_unbound_unbound_go,v
>> diff -u -p -r1.5 patch-plugins_inputs_unbound_unbound_go
>> --- patches/patch-plugins_inputs_unbound_unbound_go 10 Jul 2025 03:38:13
>> -0000 1.5
>> +++ patches/patch-plugins_inputs_unbound_unbound_go 28 Aug 2026 14:31:40
>> -0000
>> @@ -1,11 +1,13 @@
>> Index: plugins/inputs/unbound/unbound.go
>> --- plugins/inputs/unbound/unbound.go.orig
>> +++ plugins/inputs/unbound/unbound.go
>> -@@ -159,7 +159,7 @@ func unboundRunner(unbound Unbound) (*bytes.Buffer, er
>> +@@ -158,8 +158,8 @@ func unboundRunner(unbound Unbound) (*bytes.Buffer, er
>> + cmd := exec.Command(unbound.Binary, cmdArgs...)
>>
>> if unbound.UseSudo {
>> - cmdArgs = append([]string{unbound.Binary}, cmdArgs...)
>> +- cmdArgs = append([]string{unbound.Binary}, cmdArgs...)
>> - cmd = exec.Command("sudo", cmdArgs...)
>> ++ cmdArgs = append([]string{"-u", "_unbound", unbound.Binary},
>> cmdArgs...)
>> + cmd = exec.Command("doas", cmdArgs...)
>> }
>>
>> Index: pkg/README
>> ===================================================================
>> RCS file: /cvs/ports/sysutils/telegraf/pkg/README,v
>> diff -u -p -r1.2 README
>> --- pkg/README 20 Jul 2026 22:44:35 -0000 1.2
>> +++ pkg/README 28 Aug 2026 14:31:40 -0000
>> @@ -13,9 +13,12 @@ install and configure sudo:
>> * OpenSMTPD
>> * Unbound
>>
>> -Below are some example doas.conf(5) lines which could be used. If you
>> -have a nonstandard configuration of those daemons, adjustments to the
>> -location of binaries and arguments may be needed.
>> +Below are some example doas.conf(5) lines which could be used.
>> +Set use_sudo = true in the plugin configuration so telegraf invokes
>> +doas(1). If you have a nonstandard configuration of those daemons,
>> +adjustments to the location of binaries and arguments may be needed.
>> +The Unbound and NSD plugins run the control commands as _unbound
>> +and _nsd.
>>
>> permit nopass _telegraf as _unbound cmd /usr/sbin/unbound-control \
>> args stats_noreset
