Merge branch 'qralston-qralston-check-log-access'

NEWS

@@ -1,5 +1,9 @@
 This file documents the major additions and syntax changes between releases.
 
+2.4.4 2023-04-??
+	FIXES
+	check_log: improve file readability test to accommodate CAP_DAC_READ_SEARCH and similar (#604)
+
 2.4.3 2022-01-17
 	FIXES
 	check_dig: Improve matching logic when using -a (#652)

THANKS.in

@@ -159,6 +159,7 @@ Ibere Tizio
 IndyMichaelB
 Jacob Lundqvist
 James Fidell
+James Ralston
 Jamie Zawinski
 Jan Lipphaus
 Jan Wagner

plugins-scripts/check_log.sh

@@ -185,12 +185,19 @@ if [ $rc -eq 0 ]; then
 	exit "$STATE_UNKNOWN"
 fi
 
-# If the source log file doesn't exist, exit
+# If the source log file doesn't exist or isn't readable, exit.
+#
+# Note that we deliberately use "dd" to check for read access instead
+# of "[ -r $logfile ]", as the latter can return false-negatives on
+# Linux if the check_log plugin is being run via nrpe with additional
+# capabilities (e.g., CAP_DAC_READ_SEARCH).  In contrast, "dd"
+# actually attempts to open the file, which is a true test of whether
+# the file is readable.
 
 if [ ! -e "$logfile" ]; then
     echo "Log check error: Log file $logfile does not exist!"
     exit "$STATE_UNKNOWN"
-elif [ ! -r "$logfile" ] ; then
+elif ! dd if="$logfile" count=0 1>/dev/null 2>&1; then
     echo "Log check error: Log file $logfile is not readable!"
     exit "$STATE_UNKNOWN"
 fi