Bug 1964499 - Clean doesnt obfuscate FQDNs from dnf.log and yum_-C_repolist_--verbose
Summary: Clean doesnt obfuscate FQDNs from dnf.log and yum_-C_repolist_--verbose
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sos
Version: 8.4
Hardware: Unspecified
OS: Linux
Target Milestone: beta
: ---
Assignee: Pavel Moravec
QA Contact: Miroslav Hradílek
Depends On:
TreeView+ depends on / blocked
Reported: 2021-05-25 15:53 UTC by Stephen Hobbs
Modified: 2021-11-10 07:44 UTC (History)
7 users (show)

Fixed In Version: sos-4.1-3.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2021-11-09 19:36:31 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github sosreport sos pull 2464 0 None closed [cleaner] Only skip packaging-based files for the IP parser 2021-05-25 20:28:27 UTC
Red Hat Product Errata RHEA-2021:4388 0 None None None 2021-11-09 19:36:56 UTC

Description Stephen Hobbs 2021-05-25 15:53:21 UTC
Description of problem:
The clean option fails to obfuscate fqdns in /var/log/dnf* & sos_commands/yum/yum_-C_repolist_--verbose  (in the URLS for repositories), e.g.

2021-04-18T10:52:27Z INFO Downloading: https://yum-master-lab1.elab.EXAMPLE.com:443/mirrorlist/mirrorlist.pl?repo=rhel-8-for-x86_64-appstream-e4s-rpms&environment=lab&release=8&patchlevel=sap

Version-Release number of selected component (if applicable): sos 4.0

Additional info:
Should be resolved by https://github.com/sosreport/sos/commit/b27140a9126ea82efb517d60bf1b8455aaf4f5a6 already in the Master branch.

Comment 2 Pavel Moravec 2021-05-25 20:28:32 UTC
That upstream commit / PR does not fix this issue, in fact even current master branch is affected the same:

rm -rf master.zip sos-master
curl -L -O https://github.com/sosreport/sos/archive/master.zip
unzip master.zip
cd sos-master
python3 bin/sos report -o yum,dnf --batch --build --clean
Your sosreport build tree has been generated in:

grep -e EXAMPLE -e avocado-project ${d}/sos_commands/yum/yum_-C_repolist_--verbose ${d}/var/log/dnf.log
/var/tmp/sosreport-host0-2021-05-25-euojkga/sos_commands/yum/yum_-C_repolist_--verbose:Repo-baseurl       : https://avocado-project.org/data/repos/epel-8-noarch/
/var/tmp/sosreport-host0-2021-05-25-euojkga/var/log/dnf.log:2021-04-18T10:52:27Z INFO Downloading: https://yum-master-lab1.elab.EXAMPLE.com:443/mirrorlist/mirrorlist.pl?repo=rhel-8-for-x86_64-appstream-e4s-rpms&environment=lab&release=8&patchlevel=sap

And verbose log shows both the files were obfuscated..

As there is no known fix now, preliminary accepting to 8.6 "only".

Comment 3 Jake Hunsaker 2021-05-25 20:34:32 UTC
@pavel - isn't that FQDN not being scrubbed because it doesn't match the host's domain and nothing is being passed via --domains?

Comment 4 Jake Hunsaker 2021-05-26 00:21:49 UTC
From current master:

$ sudo yum -C repolist --verbose
Loaded plugins: builddep, changelog, config-manager, copr, debug, debuginfo-install, download, generate_completion_cache, groups-manager, needs-restarting, playground, repoclosure, repodiff, repograph, repomanage, reposync, system-upgrade


Repo-id            : fedora
Repo-name          : Fedora 34 - x86_64
Repo-metalink      : https://mirrors.fedoraproject.org/metalink?repo=fedora-34&arch=x86_64

$ sudo ./bin/sos report -o yum --clean --domains fedoraproject.org --batch


Your sosreport has been generated and saved in:

$ less sos_commands/yum/yum_-C_repolist_--verbose


Repo-id            : fedora
Repo-name          : Fedora 34 - x86_64
Repo-metalink      : https://host3.obfuscateddomain1.org/metalink?repo=fedora-34&arch=x86_64
  Updated          : Tue May 25 20:15:32 2021

Comment 5 Pavel Moravec 2021-05-26 07:15:17 UTC
I should think twice before writing the next time :) Indeed, I forgot we (by purpose) do not clean all domains. And I can confirm the commit/PR does fix the reported problem.

Reproducer for QE:

echo "2021-04-18T10:52:27Z INFO Downloading: https://yum-master-lab1.elab.example.com:443/mirrorlist/mirrorlist.pl?repo=rhel-8-for-x86_64-appstream-e4s-rpms&environment=lab&release=8&patchlevel=sap" >> /var/log/dnf.log

echo "2021-04-18T10:52:27Z INFO Downloading: https://$(hostname -f):443/mirrorlist/mirrorlist.pl?repo=rhel-8-for-x86_64-appstream-e4s-rpms&environment=lab&release=8&patchlevel=sap" >> /var/log/dnf.log

dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -y

sos report -o yum,dnf --batch --build --clean --domains fedoraproject.org,example.com

d=/var/tmp/$(ls -tr /var/tmp | grep -v private_map | grep sos | tail -n1)    # to point to the latest /var/tmp/sosreport* dir, the built one

grep -e fedoraproject.org -e example.com -e $(hostname -f) ${d}/sos_commands/yum/yum_-C_repolist_--verbose ${d}/var/log/dnf.log

The grep now returns:

/var/tmp/sosreport-host0-2021-05-26-booajgp/sos_commands/yum/yum_-C_repolist_--verbose:Repo-metalink      : https://mirrors.fedoraproject.org/metalink?repo=epel-8&arch=x86_64&infra=$infra&content=$contentdir
/var/tmp/sosreport-host0-2021-05-26-booajgp/sos_commands/yum/yum_-C_repolist_--verbose:Repo-metalink      : https://mirrors.fedoraproject.org/metalink?repo=epel-modular-8&arch=x86_64&infra=$infra&content=$contentdir
/var/tmp/sosreport-host0-2021-05-26-booajgp/var/log/dnf.log:2021-04-18T10:52:27Z INFO Downloading: https://yum-master-lab1.elab.example.com:443/mirrorlist/mirrorlist.pl?repo=rhel-8-for-x86_64-appstream-e4s-rpms&environment=lab&release=8&patchlevel=sap
/var/tmp/sosreport-host0-2021-05-26-booajgp/var/log/dnf.log:2021-05-26T07:04:25Z DDEBUG Command: dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -y 
/var/tmp/sosreport-host0-2021-05-26-booajgp/var/log/dnf.log:2021-05-26T07:04:25Z DDEBUG Extra commands: ['install', 'https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm', '-y']

Gladly not the hostname itself.

Applying the commit/PR, grep is empty.

We might add it to 8.5, esp. if the reporter can test the fix on provided candidate build/package - would that be possible to verify the fix once RPM ready?

Comment 6 Stephen Hobbs 2021-05-26 12:23:47 UTC

Yes, I can get the customer to test any build candidates.  Please let me know when the RPMs are available.

Thank you for working on this so quickly.

Comment 13 errata-xmlrpc 2021-11-09 19:36:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sos bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.