Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[report] Prevent obfuscating tmpDir path before tarbal move #3065

Conversation

pmoravec
Copy link
Contributor

When moving sos tarball from a private directory to /var/tmp, apply filename obfuscation just to the file and not the tmpDir path itself.

Resolves: #3065

Signed-off-by: Pavel Moravec pmoravec@redhat.com


Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines

  • Is the commit message split over multiple lines and hard-wrapped at 72 characters?
  • Is the subject and message clear and concise?
  • Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
  • Does the commit contain a Signed-off-by: First Lastname email@example.com?
  • Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?

When moving sos tarball from a private directory to /var/tmp, apply
filename obfuscation just to the file and not the tmpDir path itself.

Resolves: sosreport#3065

Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
@pmoravec
Copy link
Contributor Author

Reproducer:

python3 bin/sos report --clean --keywords tmp -o system,host --batch --disable-parsers=ip,mac,username
..
Error moving archive file: /var/tmp/sos.rmyfph6e/sosreport-host0-2022-11-13-lkvrnxp.tar.xz

The reason is final_name = cleaner.obfuscate_string(... is applied to full name including the /var/tmp path.

Here it is bit artificial reproducer, but when ones uses custom --tmp-dir to a sensitive location, it becomes a real issue.

@packit-as-a-service
Copy link

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

  • sudo yum install -y dnf-plugins-core on RHEL 8
  • sudo dnf install -y dnf-plugins-core on Fedora
  • dnf copr enable packit/sosreport-sos-3065
  • And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

Copy link
Member

@TurboTurtle TurboTurtle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, nice catch.

@TurboTurtle TurboTurtle merged commit 2556e64 into sosreport:main Nov 14, 2022
28 checks passed
pmoravec added a commit to pmoravec/sos that referenced this pull request Nov 15, 2022
Likewise sosreport#3065, we should not obfuscate path to directory when --build
option is used.

Resolves: sosreport#3071
Relates: sosreport#3065

Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
TurboTurtle pushed a commit that referenced this pull request Nov 21, 2022
Likewise #3065, we should not obfuscate path to directory when --build
option is used.

Resolves: #3071
Relates: #3065

Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
@pmoravec pmoravec deleted the sos-pmoravec-dont-obfuscate-tmpdir-before-rename branch December 29, 2022 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants