[inputs.win_services] could not open service - Error for services with restricted priviledges

[Soumyadeep9009]

Use Case

We are using input win_services plugin to monitor key Windows services. Although we use Local System to configure telegraf services, it is not detecting the status of few key OS services like Dnscache, RpcSs, gpsvc.
We have noticed in the code that it requires SERVICE_ALL_ACCESS for the required services to monitor the status else it sends the following error:
2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "Dnscache": Access is denied.
2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "gpsvc": Access is denied.
2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "RpcSs": Access is denied.

In enterpise organization it is likely that such services will have restricted permissions even for local system account, therefore, I am wondering if SERVICE_ALL_ACCESS isn't an overkill.

Referring the below section in the code : https://cs.opensource.google/go/x/sys/+/refs/tags/v0.8.0:windows/svc/mgr/mgr.go

// OpenService retrieves access to service name, so it can
// be interrogated and controlled.
func (m *Mgr) OpenService(name string) (*Service, error) {
h, err := windows.OpenService(m.Handle, syscall.StringToUTF16Ptr(name), windows.SERVICE_ALL_ACCESS)
if err != nil {
return nil, err
}
return &Service{Name: name, Handle: h}, nil
}

Can this be modified/updated to make it work with the bare minimum priviledge of SERVICE_QUERY_STATUS

Expected behavior

Expected to populate the metrices for those services Dnscache, RpcSs, gpsvc

Actual behavior

2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "Dnscache": Access is denied.
2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "gpsvc": Access is denied.
2023-06-02T11:07:00Z D! [inputs.win_services] could not open service: "RpcSs": Access is denied.

Additional info

No response

[powersj]

Can this be modified/updated to make it work with the bare minimum priviledge of SERVICE_QUERY_STATUS

That code you linked to is Go code, not telegraf. I have previously asked upstream about the permissions here: golang/go#48777 and was told they would not make the change to allow other permissions.

I did create a POC to allow using windows.GENERIC_READ permissions. This was essentially a fork of the upstream code, but we decided against taking that in as it was not code we wanted to maintain.

I'm inclined to close this as won't fix.

[tguenneguez]

golang/go#60573

If ok, after it will be possible to change in plugin telegraf :
srv, err := scmgr.OpenService(serviceName)
with
srv, err := scmgr.OpenService(serviceName, windows.SERVICE_QUERY_STATUS)

[tguenneguez]

@powersj
I doesn't understand the reply :
That would unfortunately be compatibility-breaking.

Why does it speak about api ?

[powersj]

You have changed the function parameter count and as such broken everyone currently using that function, hence compatibility-breaking.

[telegraf-tiger]

Hello! I am closing this issue due to inactivity. I hope you were able to resolve your problem, if not please try posting this question in our Community Slack or Community Page. Thank you!

[tguenneguez]

Hello
Sorry for long time to reply.
I'm not good for Go code.
Isn't possible to defined facultative args to a fonctionne ?
Thanks
Thomas

[srebhan]

@tguenneguez sorry for the late reply. WE as in the sense of Telegraf developers are the wrong guys to discuss this with. This is an upstream issue in the Golang library as @powersj outlined. If you can convince the Go developers to e.g. add a second function e.g.

func (m *Mgr) OpenServiceWithPermissions(name string, perm uint32) (*Service, error) {
    h, err := windows.OpenService(m.Handle, syscall.StringToUTF16Ptr(name), perm)
    if err != nil {
        return nil, err
    }
    return &Service{Name: name, Handle: h}, nil
}

we are happy to use that function!

[srebhan]

@tguenneguez and @Soumyadeep9009 I've pushed PR #14073 as a workaround and tested listing the services in sample.conf as a normal user by reducing the rights to GENERIC_READ. Please test the binary in the PR available once CI finished the test successfully and let me know if this solves your issue!?!

[iatalay]

Hello @srebhan
We had the same problem in our environment. I tried on 2 different windows servers and now telegraf is able to collect services status from the services it is getting "access is denied" error. This PR seems solved the issue.
Thanks

[srebhan]

@iatalay thanks for testing!!!

[Soumyadeep9009]

Yes this works. We can now close this thread.

[srebhan]

@Soumyadeep9009 please keep the issue open as it will automatically closed as soon as the corresponding PR is merged. Until then it helps people to find the PR and thus getting a workaround until the PR is merged. :-)