I am on a completely default Debian Buster installation. I have installed munin-node, which reports itself as version 2.0.49.
I have a custom plugin in
/etc/munin/plugins. It is a shell script that simply cats a value from a file a user's home directory:
netcat localhost 4949 to interact with the munin node.
If I issue a
list command then my plugin is included along with all the defaults, so munin-node does recognize that the plugin exists and is executable, etc. But when I try to run the plugin by issuing a
fetch command, I get a permission-denied error when the plugin tries to open the file in the user's home directory. To reiterate; the plugin itself executes, but fails to read the file in the home directory.
It works on Debian 9 (Jessie), where munin-node reports itself as version 2.0.33-1.
If I hack the plugin to print a hardcoded value, it works.
The file in the user's home directory has permissions
-rw-r--r--. The home directory itself has permissions
munin-runthe plugin from the command line as root, it works correctly.
If I move
usr/share/munin/pluginsthen it works.
Google suggests that if a plugin works with
munin-runand not with
munin-nodethen SELinux is likely to blame. I am not running SELinux, AFAIK.
service munin-node stopand run
munin-nodemanually on the command line as root, it works correctly.
htopshows that the plugin is run as root. I can add an entry to
/etc/munin/plugin.conf.dand have it run as the user whose home directory it is, but that has no effect. (By which I mean; I can see that the plugin is now running as that user, but it still gets a permission-denied error).
I believe there is something about the way the service is started by Debian's
/etc/init.d/munin-node scripts that is causing this. Possibly AppArmour?