Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[iscsi] Add /var/lib/iscsi/send_targets to the obfuscation list #3950

Merged
merged 1 commit into from
Mar 10, 2025

Conversation

jcastill
Copy link
Member

@jcastill jcastill commented Mar 4, 2025

Obfuscate discovery and node seesion passwords that can be found in other files inside /var/lib/iscsi directory.

Related: RHEL-81187


Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines

  • Is the commit message split over multiple lines and hard-wrapped at 72 characters?
  • Is the subject and message clear and concise?
  • Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
  • Does the commit contain a Signed-off-by: First Lastname [email protected]?
  • Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?
  • Are all passwords or private data gathered by this PR obfuscated?

Obfuscate discovery and node seesion passwords that can be found
in other files inside /var/lib/iscsi directory.

Related: RHEL-81187

Signed-off-by: Jose Castillo <[email protected]>
Copy link

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

  • sudo yum install -y dnf-plugins-core on RHEL 8
  • sudo dnf install -y dnf-plugins-core on Fedora
  • dnf copr enable packit/sosreport-sos-3950
  • And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

'/var/lib/iscsi/nodes/*/*/*', nodesessionpwd, repl)
'/var/lib/iscsi/', nodesessionpwd, repl)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This means much more files are obfuscated than required - is that intentional? Well I guess it can't harm, maybe it can prolong the execution redundantly..?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's intentional, to try to cover every file for the directories there. The passwords can be in the nodes/ directory or in send_targets/ at the same level, and passowrds can be in both of them. There may be other directories in /var/lib/iscsi/ so I thought it may be better to be on the safe side.
Do you know if this kind of change causes lots of delays when obfuscating? Do you think it would be better to specify the two dirs that we know contain passwords instead?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No problem with this preventive approach, then.

@arif-ali arif-ali merged commit 0e05d12 into sosreport:main Mar 10, 2025
42 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants