td-agent can't start after plugin installation - wrong permissions to plugin files and dirs

[Sloik Konfitur]

Hi

It looks installation of any plugin when using fluent-gem install tool, assigns wrong permissions to plugin files and directories preventing the td-agent process from starting correctly

Fresh installation on RHEL 7.7

[root@rhel admin]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.7 (Maipo)
[root@rhel admin]# ulimit -n
65536
[root@rhel admin]# rpm -i ./td-agent-3.7.1-0.el7.x86_64.rpm
warning: ./td-agent-3.7.1-0.el7.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID ab97acbe: NOKEY
adding \'td-agent\' group if needed...
adding \'td-agent\' user if needed...
Installing default conffile...
prelink detected. Installing /etc/prelink.conf.d/td-agent-ruby.conf ...
Installing logrotate.d config
Configure td-agent to start, when booting up the OS...
[root@rhel admin]#

[root@rhel admin]# systemctl start td-agent
[root@rhel admin]# systemctl status td-agent
● td-agent.service - td-agent: Fluentd based data collector for Treasure Data
   Loaded: loaded (/usr/lib/systemd/system/td-agent.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2020-06-02 11:38:24 UTC; 3s ago
     Docs: https://docs.treasuredata.com/articles/td-agent
  Process: 4890 ExecStart=/opt/td-agent/embedded/bin/fluentd --log $TD_AGENT_LOG_FILE --daemon /var/run/td-agent/td-agent.pid $TD_AGENT_OPTIONS (code=exited, status=0/SUCCESS)
 Main PID: 4901 (fluentd)
   CGroup: /system.slice/td-agent.service
           ├─4901 /opt/td-agent/embedded/bin/ruby /opt/td-agent/embedded/bin/fluentd --log /var/log/td-agent/td-agent.log --daemon /var/run/td-agent/td-agent.pid...
           └─4906 /opt/td-agent/embedded/bin/ruby -Eascii-8bit:ascii-8bit /opt/td-agent/embedded/bin/fluentd --log /var/log/td-agent/td-agent.log --daemon /var/r...

Jun 02 11:38:24 rhel systemd[1]: Starting td-agent: Fluentd based data collector for Treasure Data...
Jun 02 11:38:24 rhel systemd[1]: Started td-agent: Fluentd based data collector for Treasure Data.
[root@rhel admin]#

Now I am installing any plugin, as an example jsonpath with to_regexp. But the same with any other plugins. I tried fluent-plugin-mysql-0.3.4.gem or fluent-plugin-mysql-load-0.0.2.gem

[root@rhel admin]# /opt/td-agent/embedded/bin/fluent-gem install --local jsonpath-1.0.5.gem
Successfully installed to_regexp-0.2.1
Successfully installed jsonpath-1.0.5
Parsing documentation for to_regexp-0.2.1
Installing ri documentation for to_regexp-0.2.1
Parsing documentation for jsonpath-1.0.5
Installing ri documentation for jsonpath-1.0.5
Done installing documentation for to_regexp, jsonpath after 0 seconds
2 gems installed
[root@rhel admin]#

So far, so good. But can't start td-agent jus right after plugin installation.

[root@rhel admin]# systemctl restart td-agent
Job for td-agent.service failed because the control process exited with error code. See "systemctl status td-agent.service" and "journalctl -xe" for details.
[root@rhel admin]#

Looking into the logs (journalctl -xe)

Jun 02 11:42:11 rhel systemd[1]: Stopped td-agent: Fluentd based data collector for Treasure Data.
-- Subject: Unit td-agent.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit td-agent.service has finished shutting down.
Jun 02 11:42:11 rhel systemd[1]: Starting td-agent: Fluentd based data collector for Treasure Data...
-- Subject: Unit td-agent.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit td-agent.service has begun starting up.
Jun 02 11:42:11 rhel fluentd[5748]: /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/stub_specification.rb:116:in `initialize': Permission denied @ rb_sysopen - /opt/td-agent/embedded/lib/ruby/gems/2.4.0/specifications/to_regexp-0.2.1.gemspec (Errno::EACCES)
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/stub_specification.rb:116:in `open'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/stub_specification.rb:116:in `data'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/stub_specification.rb:207:in `valid?'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:751:in `select'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:751:in `gemspec_stubs_in'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:776:in `block in map_stubs'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:773:in `each'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:773:in `flat_map'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:773:in `map_stubs'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:765:in `installed_stubs'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:833:in `stubs'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/specification.rb:1038:in `find_by_path'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems.rb:209:in `try_activate'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:126:in `rescue in require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:39:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/cool.io-1.6.0/lib/cool.io/custom_require.rb:5:in `cool_require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/cool.io-1.6.0/lib/cool.io.rb:9:in `<top (required)>'
Jun 02 11:42:11 rhel systemd[1]: td-agent.service: control process exited, code=exited status=1
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.10.2/lib/fluent/counter/client.rb:17:in `<top (required)>'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.10.2/lib/fluent/counter.rb:17:in `<top (required)>'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.10.2/lib/fluent/supervisor.rb:21:in `<top (required)>'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.10.2/lib/fluent/command/fluentd.rb:19:in `<top (required)>'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb:55:in `require'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems/fluentd-1.10.2/bin/fluentd:8:in `<top (required)>'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/bin/fluentd:23:in `load'
Jun 02 11:42:11 rhel fluentd[5748]: from /opt/td-agent/embedded/bin/fluentd:23:in `<main>'
Jun 02 11:42:11 rhel systemd[1]: Failed to start td-agent: Fluentd based data collector for Treasure Data.
-- Subject: Unit td-agent.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit td-agent.service has failed.

It looks that default permission assigned by the installer are wrong

[root@rhel admin]# ls -ltr /opt/td-agent/embedded/lib/ruby/gems/2.4.0/specifications/
total 396
-rw-rw-r--. 1 root root 1817 Apr 23 19:12 zip-zip-0.3.gemspec
-rw-rw-r--. 1 root root 1989 Apr 23 19:12 yajl-ruby-1.4.1.gemspec
-rw-r--r--. 1 root root 1595 Apr 23 19:12 xmlrpc-0.2.1.gemspec
-rw-rw-r--. 1 root root 1738 Apr 23 19:12 webhdfs-0.9.0.gemspec
-rw-rw-r--. 1 root root 2730 Apr 23 19:12 tzinfo-data-1.2019.3.gemspec
-rw-rw-r--. 1 root root 2676 Apr 23 19:12 tzinfo-2.0.2.gemspec
-rw-rw-r--. 1 root root 1599 Apr 23 19:12 timers-4.3.0.gemspec
-rw-r--r--. 1 root root 2265 Apr 23 19:12 test-unit-3.2.3.gemspec
-rw-rw-r--. 1 root root 2088 Apr 23 19:12 td-logger-0.3.27.gemspec
-rw-rw-r--. 1 root root 2388 Apr 23 19:12 td-client-1.0.7.gemspec
-rw-rw-r--. 1 root root 3393 Apr 23 19:12 td-0.16.8.gemspec
-rw-rw-r--. 1 root root  712 Apr 23 19:12 systemu-2.5.2.gemspec
-rw-rw-r--. 1 root root 3586 Apr 23 19:12 systemd-journal-1.3.3.gemspec
-rw-rw-r--. 1 root root 2184 Apr 23 19:12 strptime-0.2.3.gemspec
-rw-rw-r--. 1 root root 1361 Apr 23 19:12 sigdump-0.2.4.gemspec
-rw-rw-r--. 1 root root 1974 Apr 23 19:12 serverengine-2.2.1.gemspec
-rw-rw-r--. 1 root root 2212 Apr 23 19:12 rubyzip-1.3.0.gemspec
-rw-rw-r--. 1 root root 4282 Apr 23 19:12 ruby-progressbar-1.10.1.gemspec
-rw-rw-r--. 1 root root 5090 Apr 23 19:12 ruby-kafka-1.0.0.gemspec
-rw-rw-r--. 1 root root 2433 Apr 23 19:12 rdkafka-0.7.0.gemspec
-rw-rw-r--. 1 root root 2613 Apr 23 19:12 rake-12.3.3.gemspec
-rw-r--r--. 1 root root 2273 Apr 23 19:12 rake-12.0.0.gemspec
-rw-rw-r--. 1 root root  822 Apr 23 19:12 quantile-0.2.1.gemspec
-rw-rw-r--. 1 root root  974 Apr 23 19:12 public_suffix-4.0.4.gemspec
-rw-rw-r--. 1 root root 2026 Apr 23 19:12 protocol-http2-0.11.6.gemspec
-rw-rw-r--. 1 root root 2211 Apr 23 19:12 protocol-http1-0.10.3.gemspec
-rw-rw-r--. 1 root root 1636 Apr 23 19:12 protocol-http-0.15.1.gemspec
-rw-rw-r--. 1 root root 1570 Apr 23 19:12 protocol-hpack-1.4.2.gemspec
-rw-rw-r--. 1 root root 1118 Apr 23 19:12 prometheus-client-0.9.0.gemspec
-rw-r--r--. 1 root root 1753 Apr 23 19:12 power_assert-0.4.1.gemspec
-rw-rw-r--. 1 root root 1066 Apr 23 19:12 parallel-1.19.1.gemspec
-rw-rw-r--. 1 root root 2892 Apr 23 19:12 oj-3.8.1.gemspec
-rw-rw-r--. 1 root root 3118 Apr 23 19:12 ohai-6.20.0.gemspec
-rw-rw-r--. 1 root root 7931 Apr 23 19:12 nokogiri-1.10.9.gemspec
-rw-rw-r--. 1 root root 1890 Apr 23 19:12 nio4r-2.5.2.gemspec
-rw-r--r--. 1 root root 1261 Apr 23 19:12 net-telnet-0.1.1.gemspec
-rw-rw-r--. 1 root root 1654 Apr 23 19:12 multipart-post-2.1.1.gemspec
-rw-rw-r--. 1 root root 2001 Apr 23 19:12 multi_json-1.14.1.gemspec
-rw-rw-r--. 1 root root 2537 Apr 23 19:12 msgpack-1.3.3.gemspec
-rw-rw-r--. 1 root root 1234 Apr 23 19:12 mixlib-shellout-2.2.7.gemspec
-rw-rw-r--. 1 root root 1926 Apr 23 19:12 mixlib-log-1.7.1.gemspec
-rw-rw-r--. 1 root root 1509 Apr 23 19:12 mixlib-config-2.2.4.gemspec
-rw-rw-r--. 1 root root 1775 Apr 23 19:12 mixlib-cli-1.7.0.gemspec
-rw-r--r--. 1 root root 4916 Apr 23 19:12 minitest-5.10.1.gemspec
-rw-rw-r--. 1 root root 2261 Apr 23 19:12 mini_portile2-2.4.0.gemspec
-rw-rw-r--. 1 root root 1005 Apr 23 19:12 ltsv-0.1.2.gemspec
-rw-rw-r--. 1 root root  716 Apr 23 19:12 jmespath-1.4.0.gemspec
-rw-rw-r--. 1 root root 1458 Apr 23 19:12 ipaddress-0.8.3.gemspec
-rw-rw-r--. 1 root root 2292 Apr 23 19:12 http_parser.rb-0.6.0.gemspec
-rw-rw-r--. 1 root root  781 Apr 23 19:12 httpclient-2.8.2.4.gemspec
-rw-rw-r--. 1 root root 2535 Apr 23 19:12 hirb-0.7.3.gemspec
-rw-rw-r--. 1 root root 2409 Apr 23 19:12 fluent-plugin-webhdfs-1.2.4.gemspec
-rw-rw-r--. 1 root root 2772 Apr 23 19:12 fluent-plugin-td-monitoring-0.2.4.gemspec
-rw-rw-r--. 1 root root 2081 Apr 23 19:12 fluent-plugin-td-1.1.0.gemspec
-rw-rw-r--. 1 root root 2108 Apr 23 19:12 fluent-plugin-systemd-1.0.2.gemspec
-rw-rw-r--. 1 root root 2297 Apr 23 19:12 fluent-plugin-s3-1.3.1.gemspec
-rw-rw-r--. 1 root root 2180 Apr 23 19:12 fluent-plugin-rewrite-tag-filter-2.2.0.gemspec
-rw-rw-r--. 1 root root 1539 Apr 23 19:12 fluent-plugin-record-modifier-2.1.0.gemspec
-rw-rw-r--. 1 root root 2160 Apr 23 19:12 fluent-plugin-prometheus_pushgateway-0.0.2.gemspec
-rw-rw-r--. 1 root root 2096 Apr 23 19:12 fluent-plugin-prometheus-1.7.3.gemspec
-rw-rw-r--. 1 root root 2010 Apr 23 19:12 fluent-plugin-kafka-0.13.0.gemspec
-rw-rw-r--. 1 root root 2708 Apr 23 19:12 fluent-plugin-elasticsearch-4.0.7.gemspec
-rw-rw-r--. 1 root root 2090 Apr 23 19:12 fluent-logger-0.8.2.gemspec
-rw-rw-r--. 1 root root 5419 Apr 23 19:12 fluentd-1.10.2.gemspec
-rw-rw-r--. 1 root root 1872 Apr 23 19:12 fluent-config-regexp-type-1.0.0.gemspec
-rw-rw-r--. 1 root root 2498 Apr 23 19:12 ffi-1.12.2.gemspec
-rw-rw-r--. 1 root root 1485 Apr 23 19:12 faraday-0.17.3.gemspec
-rw-rw-r--. 1 root root 3679 Apr 23 19:12 excon-0.73.0.gemspec
-rw-rw-r--. 1 root root 5317 Apr 23 19:12 elasticsearch-transport-6.8.1.gemspec
-rw-rw-r--. 1 root root 5318 Apr 23 19:12 elasticsearch-api-6.8.1.gemspec
-rw-rw-r--. 1 root root 4422 Apr 23 19:12 elasticsearch-6.8.1.gemspec
-rw-rw-r--. 1 root root 1679 Apr 23 19:12 digest-crc-0.5.1.gemspec
-rw-r--r--. 1 root root 1524 Apr 23 19:12 did_you_mean-1.1.0.gemspec
-rw-rw-r--. 1 root root 1980 Apr 23 19:12 cool.io-1.6.0.gemspec
-rw-rw-r--. 1 root root 1690 Apr 23 19:12 console-1.8.2.gemspec
-rw-rw-r--. 1 root root 1546 Apr 23 19:12 concurrent-ruby-1.1.6.gemspec
-rw-rw-r--. 1 root root 2907 Apr 23 19:12 bundler-1.16.6.gemspec
-rw-rw-r--. 1 root root 1406 Apr 23 19:12 aws-sigv4-1.1.1.gemspec
-rw-rw-r--. 1 root root 1629 Apr 23 19:12 aws-sdk-sqs-1.24.0.gemspec
-rw-rw-r--. 1 root root 1802 Apr 23 19:12 aws-sdk-s3-1.63.0.gemspec
-rw-rw-r--. 1 root root 1614 Apr 23 19:12 aws-sdk-kms-1.30.0.gemspec
-rw-rw-r--. 1 root root 1963 Apr 23 19:12 aws-sdk-core-3.94.0.gemspec
-rw-rw-r--. 1 root root 1019 Apr 23 19:12 aws-partitions-1.297.0.gemspec
-rw-rw-r--. 1 root root 1027 Apr 23 19:12 aws-eventstream-1.1.0.gemspec
-rw-rw-r--. 1 root root 1848 Apr 23 19:12 async-pool-0.2.0.gemspec
-rw-rw-r--. 1 root root 2198 Apr 23 19:12 async-io-1.27.7.gemspec
-rw-rw-r--. 1 root root 3426 Apr 23 19:12 async-http-0.50.8.gemspec
-rw-rw-r--. 1 root root 2509 Apr 23 19:12 async-1.24.2.gemspec
-rw-rw-r--. 1 root root 1723 Apr 23 19:12 addressable-2.7.0.gemspec
drwxrwxr-x. 2 root root  178 Jun  2 11:37 default
-rw-r-----. 1 root root 1337 Jun  2 11:41 to_regexp-0.2.1.gemspec
-rw-r-----. 1 root root 2419 Jun  2 11:41 jsonpath-1.0.5.gemspec
[root@rhel admin]#

The issue is that such wrong permissions are given in many places

[root@rhel gems]# ls -ltr /opt/td-agent/embedded/lib/ruby/gems/2.4.0/gems
...
drwxrwxr-x. 3 root root  150 Jun  2 11:37 mixlib-shellout-2.2.7
drwxrwxr-x. 7 root root  271 Jun  2 11:37 msgpack-1.3.3
drwxrwxr-x. 3 root root   95 Jun  2 11:37 multi_json-1.14.1
drwxrwxr-x. 4 root root  229 Jun  2 11:37 multipart-post-2.1.1
drwxrwxr-x. 4 root root   95 Jun  2 11:37 net-telnet-0.1.1
drwxrwxr-x. 7 root root  282 Jun  2 11:37 nio4r-2.5.2
drwxrwxr-x. 7 root root  157 Jun  2 11:37 nokogiri-1.10.9
drwxrwxr-x. 6 root root  102 Jun  2 11:37 ohai-6.20.0
drwxrwxr-x. 5 root root   73 Jun  2 11:37 oj-3.8.1
drwxrwxr-x. 3 root root   40 Jun  2 11:37 parallel-1.19.1
drwxrwxr-x. 4 root root  125 Jun  2 11:37 power_assert-0.4.1
drwxrwxr-x. 3 root root   34 Jun  2 11:37 prometheus-client-0.9.0
drwxrwxr-x. 4 root root  195 Jun  2 11:37 protocol-hpack-1.4.2
drwxrwxr-x. 3 root root  166 Jun  2 11:37 protocol-http-0.15.1
drwxrwxr-x. 4 root root  183 Jun  2 11:37 protocol-http1-0.10.3
drwxrwxr-x. 4 root root  162 Jun  2 11:37 protocol-http2-0.11.6
drwxrwxr-x. 6 root root 4096 Jun  2 11:37 public_suffix-4.0.4
drwxrwxr-x. 3 root root   49 Jun  2 11:37 quantile-0.2.1
drwxrwxr-x. 6 root root  184 Jun  2 11:37 rake-12.0.0
drwxrwxr-x. 6 root root  211 Jun  2 11:37 rake-12.3.3
drwxrwxr-x. 5 root root  226 Jun  2 11:37 rdkafka-0.7.0
drwxrwxr-x. 3 root root   17 Jun  2 11:37 rdoc-5.0.1
drwxrwxr-x. 8 root root 4096 Jun  2 11:37 ruby-kafka-1.0.0
drwxrwxr-x. 3 root root   69 Jun  2 11:37 ruby-progressbar-1.10.1
drwxrwxr-x. 4 root root   77 Jun  2 11:37 rubyzip-1.3.0
drwxrwxr-x. 5 root root  238 Jun  2 11:37 serverengine-2.2.1
drwxrwxr-x. 3 root root  138 Jun  2 11:37 sigdump-0.2.4
drwxrwxr-x. 5 root root  222 Jun  2 11:37 strptime-0.2.3
drwxrwxr-x. 6 root root  288 Jun  2 11:37 systemd-journal-1.3.3
drwxrwxr-x. 4 root root  118 Jun  2 11:37 systemu-2.5.2
drwxrwxr-x. 8 root root  243 Jun  2 11:37 td-0.16.8
drwxrwxr-x. 5 root root   41 Jun  2 11:37 td-client-1.0.7
drwxrwxr-x. 5 root root  229 Jun  2 11:37 td-logger-0.3.27
drwxrwxr-x. 5 root root  125 Jun  2 11:37 test-unit-3.2.3
drwxrwxr-x. 4 root root  171 Jun  2 11:37 timers-4.3.0
drwxrwxr-x. 3 root root   84 Jun  2 11:37 tzinfo-2.0.2
drwxrwxr-x. 3 root root   89 Jun  2 11:37 tzinfo-data-1.2019.3
drwxrwxr-x. 3 root root  117 Jun  2 11:37 webhdfs-0.9.0
drwxrwxr-x. 4 root root   95 Jun  2 11:37 xmlrpc-0.2.1
drwxrwxr-x. 9 root root  283 Jun  2 11:37 yajl-ruby-1.4.1
drwxrwxr-x. 3 root root   36 Jun  2 11:37 zip-zip-0.3
drwxr-x---. 4 root root  173 Jun  2 11:41 to_regexp-0.2.1
drwxr-x---. 5 root root  242 Jun  2 11:41 jsonpath-1.0.5
[root@rhel gems]#

Any hints appreciated

Thanks

Sloik

[Sloik Konfitur]

So as not to leave things open, it might come in handy for someone in
the future.

The issue was umask settings for the root user.
It looks, that default td-agent rpm installation is using 022 as a
default root umask (755 for directories, 664 for files). My root has
umask=027, it looks that td-agent-gem during gem installation is using
current root umask settings instead of the same used by td-agent
installer. And that actually generated a problem with access to the
installed plugins.

After I changed root's umask to 022, everything went fine.

Thanks
-Sloik