TOS 7 Beta Is Available for Testing

[T1mbo]

Hello everyone

In TOS 7, the root user cannot perform any privileged actions, which imposes certain restrictions when using the new developer mode.

For example, I installed zabbix-agent2 and want to receive SMART data from disks, but I can't figure out how to give root permission to do so. I added root to the admin group, but that didn't help. Does anyone have any ideas?

[RyanYang]

Thank you for bringing this to our attention. We have updated the corresponding post with information regarding TOS 7.

[athurdent]

For example, I installed zabbix-agent2 and want to receive SMART data from disks, but I can't figure out how to give root permission to do so. I added root to the admin group, but that didn't help. Does anyone have any ideas?

zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:

Code: Select all

/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl

[T1mbo]

zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:

Code: Select all

/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl

This will not work for TOS 7 because root cannot run smartctl:

Code: Select all

root@TNAS:/tmp/log$ smartctl -a /dev/sda
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

Read Device Identity failed: Operation not permitted

Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.

[athurdent]

Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.

One has to wonder what kind of developer mode that is supposed to be then.
Would be great if TerraMaster could chime in on how we are supposed to "gain full root access and seamlessly access Ubuntu's vast software repository" ( quote from https://www.terra-master.com/pages/tos7 ) without actual root access?

[athurdent]

Thank you for your feedback, the release note has been to modified to better clear.

Awesome, thank you very much!

[storageninja]

zabbix-agent2, for regular Ubuntu you'd usually do it similar to this:

Code: Select all

/etc/sudoers.d/zabbix
zabbix ALL=(ALL) NOPASSWD:/usr/sbin/smartctl

This will not work for TOS 7 because root cannot run smartctl:

Code: Select all

root@TNAS:/tmp/log$ smartctl -a /dev/sda
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

Read Device Identity failed: Operation not permitted

Similarly, root is not allowed to run dmesg, etc.
So, it turns out that root is not root because it does not have privileges for privileged commands.

Disable: security and privacy control (SPC) protection

That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.

Code: Select all

@TNAS2:~# smartctl -a /dev/nvme0
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Number:                       KINGSTON OM

[T1mbo]

Disable: security and privacy control (SPC) protection

That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.

I have F2-424 and SPC is disabled.
I even enabled and disabled it, but root still has no privileges.

Code: Select all

root@TNAS:/home/user$ dmesg
dmesg: read kernel buffer failed: Operation not permitted

Code: Select all

root@TNAS:/home/user$ smartctl -a /dev/sda -d sat
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

Read Device Identity failed: Operation not permitted

It's funny that everything works fine when running commands as non-root user, but zabbix-agent2 seems to be hardcoded to elevate privileges to root, and this behavior cannot be fixed.


EDIT:
In the end, I found out:
1) root in the system is fake

Code: Select all

root@TNAS:/etc/pam.d$ getent passwd root
root:x:9999:9999:Linux User,:/root:/usr/sbin/nologin

Code: Select all

root@TNAS:/etc/pam.d$ cat /proc/self/status | grep CapEff
CapEff: 0000000000000000

uid 0 is the primary user in the system
Therefore, the smart zabbix-agent2 plugin will not work because sudo is hardcoded there.

[storageninja]

Disable: security and privacy control (SPC) protection

That made my Zabbix-agent run fine afterwards, I got a full NVMe F4-SSD and this works fine for me.

I have F2-424 and SPC is disabled.
I even enabled and disabled it, but root still has no privileges.

Code: Select all

root@TNAS:/home/user$ dmesg
dmesg: read kernel buffer failed: Operation not permitted

Code: Select all

root@TNAS:/home/user$ smartctl -a /dev/sda -d sat
smartctl 7.5 2025-04-30 r5714 [x86_64-linux-6.12.41+] (local build)
Copyright (C) 2002-25, Bruce Allen, Christian Franke, www.smartmontools.org

Read Device Identity failed: Operation not permitted

It's funny that everything works fine when running commands as non-root user, but zabbix-agent2 seems to be hardcoded to elevate privileges to root, and this behavior cannot be fixed.


EDIT:
In the end, I found out:
1) root in the system is fake

Code: Select all

root@TNAS:/etc/pam.d$ getent passwd root
root:x:9999:9999:Linux User,:/root:/usr/sbin/nologin

Code: Select all

root@TNAS:/etc/pam.d$ cat /proc/self/status | grep CapEff
CapEff: 0000000000000000

uid 0 is the primary user in the system
Therefore, the smart zabbix-agent2 plugin will not work because sudo is hardcoded there.

Which catched me, you use zabbix-agent2 I do use zabbix-agent.


This works for me:

Code: Select all

systemctl edit zabbix-agent
[Service]
User=root
Group=root

misterx@TNAS:~# cat /etc/zabbix/zabbix_agentd.conf | grep -i root
### Option: AllowRoot
#	Allow the agent to run as 'root'. If disabled and the agent is started by 'root', the agent
AllowRoot=1
#	Only has effect if run as 'root' and AllowRoot is disabled.
User=root

[T1mbo]

Which catched me, you use zabbix-agent2 I do use zabbix-agent.

This works for me:

Code: Select all

systemctl edit zabbix-agent
[Service]
User=root
Group=root

misterx@TNAS:~# cat /etc/zabbix/zabbix_agentd.conf | grep -i root
### Option: AllowRoot
#	Allow the agent to run as 'root'. If disabled and the agent is started by 'root', the agent
AllowRoot=1
#	Only has effect if run as 'root' and AllowRoot is disabled.
User=root

Yes, I am using version 2 of zabbix-agent, the one written in Go.
I also tried running it under a different user via systemd override, but it didn't work because in the code itself, smartctl is actually called via sudo

I found a solution for myself: I just ran the agent in Docker and collect metrics in it, although the best solution would be to install the first version of zabbix-agent, but in the press release we were promised full root access