chown: unknown user/group root:wazuh

[AishVinod]

I am trying to integrate custom-urlhaus with wazuh deployed on kubernetes using this documentation https://wazuh.com/blog/detecting-malicious-urls-using-wazuh-and-urlhaus/

For kubernetes setup I have mounted custom-urlhaus.py into /var/ossec/integrations/custom-urlhaus.py. However in order to execute the scripts below permisisons and ownership is mandatory :

chmod 750 /var/ossec/integrations/custom-urlhaus.py
chown root:wazuh /var/ossec/integrations/custom-urlhaus.py

Once I mount the files into pod, by default I see permission as below :

-rw-r--r-- 1 root 101 5441 custom-urlhaus.py

I suppose group 101 is coming from below configuration is master-sts file :

securityContext:
fsGroup: 101

I tried adding initcontainer to execute the required script :

initContainers:
- name: volume-mount-hack
image: busybox
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 100m
memory: 256Mi
command:
- sh
- '-c'
- 'chmod 750 /var/ossec/integrations/custom-urlhaus.py && chown root:wazuh /var/ossec/integrations/custom-urlhaus.py'

However I see inticontainer is failing with below errors :

chmod: /var/ossec/integrations/custom-urlhaus.py: Read-only file system
chown: unknown user/group root:wazuh

Any help on how to update the needed permissions in cluster files would be appreciated.

[saraiva82]

I am seeing some issues with this with my integration as well. All files in the container are root:wazuh owned. if you run a ps in the container
same

and
there does not seem to be a user 101 either

closest is some dude name games lol. now the wazuh user is 999 so wouldn't it make more sense to set that
securityContext: to
fsGroup: 999 instead?
anyways Im trying it out and see if my cluster still works after

[AishVinod]

@saraiva82 Any luck on the same? I am still struggling for the same

[saraiva82]

Hey @AishVinod,
so far the permissions issues seem to have resolved themselves

and now when i use wazuh-logtester to debug my log I do not see the permissions errors that I was getting on my integrations and rules. So I think it resolved the issue even though im troubleshooting my log but now i think is a decoder thing and not this.