From 9dbbec11b0101af93f895ac97c7c0742dce1e5b5 Mon Sep 17 00:00:00 2001 From: Trevor Benson Date: Wed, 18 Jun 2025 10:14:55 -0700 Subject: [PATCH 1/4] Obfuscate even if at a root level. Signed-off-by: Trevor Benson --- sos/report/plugins/saltmaster.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sos/report/plugins/saltmaster.py b/sos/report/plugins/saltmaster.py index 6edd3fbdf1..2bff6c4992 100644 --- a/sos/report/plugins/saltmaster.py +++ b/sos/report/plugins/saltmaster.py @@ -64,7 +64,7 @@ def add_pillar_roots(self): self.add_copy_spec(all_pillar_roots) def postproc(self): - regexp = r'(^\s+.*(pass|secret|(? Date: Wed, 18 Jun 2025 10:16:58 -0700 Subject: [PATCH 2/4] Obfuscate any api or encryption keys, but honor existing negative lookbehind. Signed-off-by: Trevor Benson --- sos/report/plugins/saltmaster.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sos/report/plugins/saltmaster.py b/sos/report/plugins/saltmaster.py index 2bff6c4992..4888854853 100644 --- a/sos/report/plugins/saltmaster.py +++ b/sos/report/plugins/saltmaster.py @@ -64,7 +64,10 @@ def add_pillar_roots(self): self.add_copy_spec(all_pillar_roots) def postproc(self): - regexp = r'(^\s*.*(pass|secret|(? Date: Wed, 18 Jun 2025 10:18:33 -0700 Subject: [PATCH 3/4] Obfuscate pillar roots regardless of path Signed-off-by: Trevor Benson --- sos/report/plugins/saltmaster.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sos/report/plugins/saltmaster.py b/sos/report/plugins/saltmaster.py index 4888854853..11346c47e9 100644 --- a/sos/report/plugins/saltmaster.py +++ b/sos/report/plugins/saltmaster.py @@ -20,6 +20,10 @@ class SaltMaster(Plugin, IndependentPlugin): packages = ('salt-master', 'salt-api',) + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.collected_pillar_roots = [] + def setup(self): if self.get_option("all_logs"): self.add_copy_spec("/var/log/salt") @@ -61,6 +65,7 @@ def add_pillar_roots(self): cfg_pillar_roots = [] all_pillar_roots.extend(cfg_pillar_roots) + self.collected_pillar_roots = all_pillar_roots self.add_copy_spec(all_pillar_roots) def postproc(self): @@ -69,6 +74,13 @@ def postproc(self): r'api_?key|encryption_?key).*:\ ).+' ) subst = r'\1******' + self.do_path_regex_sub("/etc/salt/*", regexp, subst) + for pillar_root in self.collected_pillar_roots: + normalized_root = pillar_root if pillar_root.endswith('/') else ( + f"{pillar_root}/" + ) + self.do_path_regex_sub(f"{normalized_root}*", regexp, subst) + # vim: set et ts=4 sw=4 : From f852ace8919c8ba2f99ee440e83880e53d7942c1 Mon Sep 17 00:00:00 2001 From: Trevor Benson Date: Thu, 19 Jun 2025 10:33:07 -0700 Subject: [PATCH 4/4] Initialize collected_pillar_roots in setup() review suggestion Signed-off-by: Trevor Benson --- sos/report/plugins/saltmaster.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sos/report/plugins/saltmaster.py b/sos/report/plugins/saltmaster.py index 11346c47e9..110a60990d 100644 --- a/sos/report/plugins/saltmaster.py +++ b/sos/report/plugins/saltmaster.py @@ -20,11 +20,9 @@ class SaltMaster(Plugin, IndependentPlugin): packages = ('salt-master', 'salt-api',) - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) + def setup(self): self.collected_pillar_roots = [] - def setup(self): if self.get_option("all_logs"): self.add_copy_spec("/var/log/salt") else: