Bug 2018228

This looks like we'll need a new unbound plugin entirely. The current collections are coming from other plugins that just so happen to have wide enough copy specs that the unbound files get scooped up as well, rather than specifically.

Beyond `/etc/unbound`, is there anything else for the service that we should collect? Any command output? Is there any sensitive data in any of the files under /etc/unbound that we'll want to obfuscate or skip copying (plaintext passwords, private keys, etc)?

We probably want to take care to get configs but not to take keys, so this
might mean being selective about what we actually get from /etc/unbound.

There are two packages, but we *probably* don't want anything from 
unbound-libs. I'm listing a couple things under "probably ignoring" just in
case there ends up actually being something we want from them. Depending on
what we do with other things that have keys, though, we might want to grab
more and exclude anything ending in ".key". We probably want to follow the
same sort of pattern we do for other things, whatever that might be.

unbound 
    files
        /etc/sysconfig/unbound
        /etc/unbound/unbound.conf
        /usr/lib/tmpfiles.d/unbound.conf
    directories
        /etc/unbound/conf.d/ and below
        /etc/unbound/local.d/ and below
    probably ignoring
        /etc/unbound/keys.d/ and below

unbound-libs
    files
        none
    directories
        none
    probably ignoring
        /var/lib/unbound and below

Thanks. Until we start to collect /etc/unbound itself, the keys.d subdir wont be collected (and simialrly for the /var/lib/unbound).

I raised https://github.com/sosreport/sos/pull/2789 in upstream. Assuming that will be merged before sos-4.3, where we rebase to in 8.7 / 9.1. Thus these RHEL releases should have the plugin included.

Hello,
as our QE might not have available systems for testing the fix, would you be able to verify the fix once available (as a candidate package for 8.7)?

(In reply to Pavel Moravec from comment #4)
===
> would you be able to verify the fix once available (as a candidate package for 8.7)?
===

Of course!  Thank you for asking.

Hello,
could you please use the build from https://people.redhat.com/pmoravec/sos-4.2-15/sos-4.2-15.el8.noarch.rpm to verify?

Thanks in advance.

(In reply to Pavel Moravec from comment #6)
> Hello,
> could you please use the build from
> https://people.redhat.com/pmoravec/sos-4.2-15/sos-4.2-15.el8.noarch.rpm to
> verify?
> 
> Thanks in advance.

I apologize for a wrong version: please use the build from https://people.redhat.com/pmoravec/sos-4.3-1/ instead.

Thanks again for your patience in me testing.  It has been a busy ~2 weeks.

I installed the RHEL 9 development build from 2022-04-05 to a virtual machine and its unbound RPM.  I then installed the sos RPM from the above people.redhat.com URL.



# rpm -q sos
sos-4.3-1.el9.noarch

# sosreport 
Please note the 'sosreport' command has been deprecated in favor of the new 'sos' command, E.G. 'sos report'.
Redirecting to 'sos report '
sosreport (version 4.3)
This command will collect diagnostic and configuration information from
this Red Hat Enterprise Linux system and installed applications.
An archive containing the collected information will be generated in
/var/tmp/sos.dohijmim and may be provided to a Red Hat support
representative.
Any information provided to Red Hat will be treated in accordance with
the published support policies at:
        Distribution Website : https://www.redhat.com/
        Commercial Support   : https://www.access.redhat.com/
The generated archive may contain data considered sensitive and its
content should be reviewed by the originating organization before being
passed to any third party.
No changes will be made to system configuration.
Press ENTER to continue, or CTRL-C to quit.
Optionally, please enter the case id that you are generating this report for []: BZ2018228
 Setting up archive ...
 Setting up plugins ...
[plugin:networking] skipped command 'ip -s macsec show': required kmods missing: macsec.   Use '--allow-system-changes' to enable collection.
[plugin:networking] skipped command 'ss -peaonmi': required kmods missing: xsk_diag.   Use '--allow-system-changes' to enable collection.
[plugin:sssd] skipped command 'sssctl config-check': required services missing: sssd.  
[plugin:sssd] skipped command 'sssctl domain-list': required services missing: sssd.  
[plugin:systemd] skipped command 'systemd-resolve --status': required services missing: systemd-resolved.  
[plugin:systemd] skipped command 'systemd-resolve --statistics': required services missing: systemd-resolved.  
 Running plugins. Please wait ...
  Finishing plugins              [Running: subscription_manager]                          ]r]
  Finished running plugins                                                               
Creating compressed archive...
Your sosreport has been generated and saved in:
	/var/tmp/sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih.tar.xz
 Size	8.75MiB
 Owner	root
 sha256	a10f02692e352fd1f9f5921b4f953d05dc2918b18b8d540233ac4fd0bf42dbea
Please send this file to your support representative.

# tar -tJf /var/tmp/sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih.tar.xz | grep -i unbound
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/sysconfig/unbound
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/systemd/system/timers.target.wants/unbound-anchor.timer
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/conf.d/
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/conf.d/example.com.conf
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/local.d/
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/local.d/block-example.com.conf
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/etc/unbound/unbound.conf
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/usr/lib/systemd/system/unbound-anchor.service
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/usr/lib/systemd/system/unbound-anchor.timer
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/usr/lib/systemd/system/unbound-keygen.service
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/usr/lib/systemd/system/unbound.service
sosreport-rhel9-bz2065560-BZ2018228-2022-04-07-lijpiih/usr/lib/tmpfiles.d/unbound.conf



As you can see from the above, the sosreport command captured:
  /etc/sysconfig/unbound
  /etc/unbound/conf.d  contents
  /etc/unbound/local.d  contents
  /etc/unbound/unbound.conf
...which were the files I was specifically interested in.

I do not know if the "plugin:networking" warnings for macsec and xsk_diag kmods warnings as well as the "required services missing" warnings for sssd and systemd-resolved are something to be concerned about, or not.  But since they do not affect the capture of the unbound information, I'm not worried about them in relation to this Bugzilla ticket.

Doh!  I don't know why I tested on RHEL 9 when this BZ is clearly for RHEL 8.  RHEL 8 looks good, too:



# rpm -q sos
sos-4.3-1.el8.noarch

# sosreport
Please note the 'sosreport' command has been deprecated in favor of the new 'sos' command, E.G. 'sos report'.
Redirecting to 'sos report '
sosreport (version 4.3)
This command will collect diagnostic and configuration information from
this Red Hat Enterprise Linux system and installed applications.
An archive containing the collected information will be generated in
/var/tmp/sos.rdzti3_f and may be provided to a Red Hat support
representative.
Any information provided to Red Hat will be treated in accordance with
the published support policies at:
        Distribution Website : https://www.redhat.com/
        Commercial Support   : https://www.access.redhat.com/
The generated archive may contain data considered sensitive and its
content should be reviewed by the originating organization before being
passed to any third party.
No changes will be made to system configuration.
Press ENTER to continue, or CTRL-C to quit.
Optionally, please enter the case id that you are generating this report for []: BZ2018228
 Setting up archive ...
 Setting up plugins ...
[plugin:networking] skipped command 'ip -s macsec show': required kmods missing: macsec.   Use '--allow-system-changes' to enable collection.
[plugin:networking] skipped command 'ss -peaonmi': required kmods missing: udp_diag, tcp_diag, unix_diag, af_packet_diag, xsk_diag, inet_diag, netlink_diag.   Use '--allow-system-changes' to enable collection.
[plugin:systemd] skipped command 'resolvectl status': required services missing: systemd-resolved.  
[plugin:systemd] skipped command 'resolvectl statistics': required services missing: systemd-resolved.  
 Running plugins. Please wait ...
  Finishing plugins              [Running: dracut]                                        
  Finished running plugins                                                               
Creating compressed archive...
Your sosreport has been generated and saved in:
	/var/tmp/sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv.tar.xz
 Size	13.76MiB
 Owner	root
 sha256	c8e541d9eabf262baaaecd7016639c97eb0582ef53020dd4e3db7a36e4ae82f8
Please send this file to your support representative.

# tar -tJf /var/tmp/sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv.tar.xz | grep -i unbound
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/sysconfig/unbound
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/systemd/system/timers.target.wants/unbound-anchor.timer
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/unbound.conf
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/local.d/
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/local.d/block-example.com.conf
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/conf.d/
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/etc/unbound/conf.d/example.com.conf
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/usr/lib/tmpfiles.d/unbound.conf
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/usr/lib/systemd/system/unbound.service
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/usr/lib/systemd/system/unbound-keygen.service
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/usr/lib/systemd/system/unbound-anchor.timer
sosreport-rhel85-20220126-BZ2018228-2022-04-07-lyunflv/usr/lib/systemd/system/unbound-anchor.service

Thanks a lot for the testing of both this and the rhel9 BZ2065560 one as well.

The "skipped command" is intentional behaviour - some commands (i.e. 'ss -peaonmi') require some resources (here several kernel modules to be loaded) that sos detected as not present/loaded/running. So running such a command would load that kernel modules or start a service or similar - something sos report should not do, to alter the system in either way.

There is --allow-system-changes option that skips this feature, in case one doesn't care about potential system changes.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sos bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7732

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days