Read RabbitMQ's Erlang cookie and act as a local node administrator.
rmq.cluster_statusrmq.node_health_checkrmq.list_nodesrmq.list_vhostsrmq.list_usersrmq.list_policiesrmq.list_parametersrmq.list_queuesrmq.list_exchangesrmq.list_bindingsrmq.list_connectionsrmq.list_channelsrmq.list_consumersrmq.purge_queuermq.close_connectionrmq.sync_queuermq.start_apprmq.stop_app
Run the Emisar service as root with RabbitMQ's live cookie
sudo install -d -m 0755 /etc/systemd/system/emisar.service.d printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-rabbitmq-host-access.conf >/dev/null sudo systemctl daemon-reload sudo systemctl restart emisar
test "$(systemctl show emisar --property=User --value)" = root sudo env HOME=/var/lib/rabbitmq rabbitmq-diagnostics -q ping
Impact: Every Emisar action on this runner executes as root. Root can use the live Erlang cookie selected by the pack to administer the local node, including operations outside this pack.