mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-08-27 09:06:39 +00:00
Vinícius Ferrão
7fa755719a
The daemon redacted secret attributes on the joined command string. The match failed when a value held a space. The match also failed for a "+=" splice assignment. The validate() path did not quote the arguments, so a multi-word secret value kept its later words in syslog and in the auditlog table. A password that a command receives through an option or a positional operand was not redacted at all. The debug dispatch trace wrote the raw arguments to syslog when site.xcatdebugmode was set. Redact the argument vector before the daemon joins it. Add redact_password_args for this task. The routine masks the value of a secret attribute in any argument, at the start or embedded after another token. An embedded secret assignment masks to the end of the argument, because a shell value may hold quotes and spaces. The routine allows spaces around the operator. It accepts the "=", "+=", ",=", "^=", "!=", "=~" and "!~" operators that chdef, nodech and node selection use. It masks a password option value in each form that Getopt::Long accepts: a separate argument, a compact short option, a bundle of short options with the "?" help letter, a "+" option prefix, a single-letter option with two dashes, a long option, a long option with an equals sign, and an abbreviated long option. The long-name match runs first, so a long option keeps its name and masks its value. A walk over each bundle then finds the first secret letter, so the mask always starts at the option and the result does not depend on hash order. The walk knows which other letters of a command take a value, so a secret letter inside such a value does not redact and the audit text stays correct. The walk also knows which letters take an integer, because the z/VM cpu option consumes only its signed digits and the parser then continues the bundle into the password option. The value stops match letter case, because a bundle keeps short options case sensitive and an unknown capital letter does not absorb the rest. The mkvm secret match ignores letter case, because the z/VM parser keeps the Getopt::Long default for long names. The mkhwconn match keeps letter case, because -p is the hardware control point and -P is the password. The routine knows the password options of bmcdiscover, switchdiscover, mkhwconn, mkvm, createvcluster, lsvcluster and rmvcluster, the rspconfig password assignments, the mkvm clone pw= operand, and the positional password operands of chvm. It masks the site.value argument of tabch and chtab when a selector or a site.key assignment names snmpc. An exact short option that takes a non-secret value stays visible, so the PPC mkvm -p profile is not an abbreviation of --password. The dispatch trace builds its text from the redacted vector. Add snmpc, productkey, prodkey.key, tokenid and token.tokenid to the secret list, with community and pdu.community. The secret list holds only attributes that map to a secret column, so key and sshkeydir stay visible. redact_password keeps a second pass over the joined string. This pass masks an embedded secret assignment to the end of the line, because the argument boundaries are gone after the join. The commands.log response classifier marks a response sensitive when the request was redacted. The argument vector pass sets that signal, so a secret whose name has no "passw" text still marks its response.