Review fluentbitextension from security perspective

[tigrannajaryan]

fluentbitextension allows executing flientbit executable and accepts the command line to execute.

This is potentially a security problem, especially coupled with upcoming remote configuration capabilities. We need to make sure the Collector cannot be compelled to execute arbitrary code.

[tigrannajaryan]

See also related #6722

[tigrannajaryan]

This is similar to what I posted in #6722

@open-telemetry/collector-contrib-approvers I think we have a dangerous functionality in fluentbitextension. It allows executing arbitrary commands with arbitrary parameters.

Some possible ways we can reduce the risks:

• Disallow executing arbitrary commands. Limit them to a certain directory location and/or filename pattern, which can match only Fluentbit executable.
• Disallow passing command line parameters. Is this necessary for Fluentbit?

A more radical approach if we do not think the above is sufficient:

• Remove the component from the default build. If someone needs it they can custom-build a Collector and take the responsibility for the consequences. We have native log collection capabilities in the Collector so Fluentbit extension may not be as useful as it was in the past anymore.

[jpkrohling]

This specially sensitive after the log4j CVE. I'll take a look at this extension and provide my feedback soon.

[Aneurysm9]

This is similar to what I posted in #6697

@tigrannajaryan is this the right link? I don't see anything related there.

[tigrannajaryan]

This is similar to what I posted in #6697

@tigrannajaryan is this the right link? I don't see anything related there.

Wrong link. It should be #6722

[jpkrohling]

As discussed during the SIG meeting yesterday, the code owners are expected to present a design for making this component secure. If none is provided by 0.46.0, we'll place this component behind a feature gate, eventually removing it.

@bogdandrutu also mentioned that, for the short-term, it might make sense to add a log entry when this component is constructed, stating that this component is under security review and that it should be used with caution.

@dmitryax mentioned that he might work on this if the code owners aren't available.