diff options
| -rw-r--r-- | doc/server/info.txt | 4 | ||||
| -rw-r--r-- | man/bcfg2.conf.5 | 4 | ||||
| -rw-r--r-- | schemas/info.xsd | 1 | ||||
| -rw-r--r-- | src/lib/Client/Tools/POSIX.py | 14 | ||||
| -rw-r--r-- | src/lib/Options.py | 3 | ||||
| -rw-r--r-- | src/lib/Server/Plugin.py | 6 | ||||
| -rw-r--r-- | src/lib/Server/Plugins/SSHbase.py | 6 |
7 files changed, 29 insertions, 9 deletions
diff --git a/doc/server/info.txt b/doc/server/info.txt index 7f466528f..0d273c2b6 100644 --- a/doc/server/info.txt +++ b/doc/server/info.txt @@ -44,6 +44,10 @@ possible fields in an info file are: | | | 'inherit' | (or inherits from the files on | | | | | disk if set to inherit) | | +------------+-------------------+----------------------------------+---------+ +| sensitive: | true | false | The contents of sensitive | false | +| | | entries aren't included in | | +| | | reports | | ++------------+-------------------+----------------------------------+---------+ A sample info file for CGI script on a web server might look like:: diff --git a/man/bcfg2.conf.5 b/man/bcfg2.conf.5 index 7cd04a0b7..def850b67 100644 --- a/man/bcfg2.conf.5 +++ b/man/bcfg2.conf.5 @@ -285,6 +285,10 @@ Global permissions for Paths (defaults to 644) .B paranoid Global paranoid settings for Paths (defaults to false) +.TP +.B sensitive +Global sensitive settings for Paths (defaults to false) + .SH CLIENT OPTIONS These options only affect client functionality, specified in the diff --git a/schemas/info.xsd b/schemas/info.xsd index 2ff1d937e..169310ab6 100644 --- a/schemas/info.xsd +++ b/schemas/info.xsd @@ -15,6 +15,7 @@ <xsd:attribute name='owner' type='xsd:string'/> <xsd:attribute name='perms' type='xsd:string'/> <xsd:attribute name='paranoid' type='xsd:boolean'/> + <xsd:attribute name='sensitive' type='xsd:boolean'/> </xsd:complexType> <xsd:complexType name='GroupType'> diff --git a/src/lib/Client/Tools/POSIX.py b/src/lib/Client/Tools/POSIX.py index faec2e251..f16b714ff 100644 --- a/src/lib/Client/Tools/POSIX.py +++ b/src/lib/Client/Tools/POSIX.py @@ -148,7 +148,8 @@ class POSIX(Bcfg2.Client.Tools.Tool): entry.set('perms', str(oct(ondisk[ST_MODE])[-4:])) try: content = open(entry.get('name')).read() - entry.set('current_bfile', binascii.b2a_base64(content)) + if (entry.get('sensitive') not in ['true', 'True']): + entry.set('current_bfile', binascii.b2a_base64(content)) except IOError: error = sys.exc_info()[1] self.logger.error("Failed to read %s: %s" % (error.filename, @@ -482,7 +483,8 @@ class POSIX(Bcfg2.Client.Tools.Tool): contentStatus = content == tempdata if not contentStatus: if tbin or not isString(content, self.setup['encoding']): - entry.set('current_bfile', binascii.b2a_base64(content)) + if (entry.get('sensitive') not in ['true', 'True']): + entry.set('current_bfile', binascii.b2a_base64(content)) nqtext = entry.get('qtext', '') nqtext += '\nBinary file, no printable diff' else: @@ -504,8 +506,9 @@ class POSIX(Bcfg2.Client.Tools.Tool): do_diff = False break if do_diff: - diff = '\n'.join(rawdiff) - entry.set("current_bdiff", binascii.b2a_base64(diff)) + if (entry.get('sensitive') not in ['true', 'True']): + diff = '\n'.join(rawdiff) + entry.set("current_bdiff", binascii.b2a_base64(diff)) # entry.set("current_diff", diff) udiff = '\n'.join([x for x in \ difflib.unified_diff(content.split('\n'), \ @@ -521,7 +524,8 @@ class POSIX(Bcfg2.Client.Tools.Tool): nqtext += '\n' nqtext += dudiff else: - entry.set('current_bfile', binascii.b2a_base64(content)) + if (entry.get('sensitive') not in ['true', 'True']): + entry.set('current_bfile', binascii.b2a_base64(content)) nqtext = entry.get('qtext', '') nqtext += '\nDiff took too long to compute, no printable diff' entry.set('qtext', nqtext) diff --git a/src/lib/Options.py b/src/lib/Options.py index 619b16787..6b3110107 100644 --- a/src/lib/Options.py +++ b/src/lib/Options.py @@ -242,6 +242,9 @@ MDATA_PERMS = Option('Default Path permissions', MDATA_PARANOID = Option('Default Path paranoid setting', 'false', cf=('mdata', 'paranoid'), odesc='Path paranoid setting') +MDATA_SENSITIVE = Option('Default Path sensitive setting', + 'false', cf=('mdata', 'sensitive'), + odesc='Path sensitive setting') # Server options SERVER_REPOSITORY = Option('Server repository path', '/var/lib/bcfg2', diff --git a/src/lib/Server/Plugin.py b/src/lib/Server/Plugin.py index f1d9ce75f..3841e637d 100644 --- a/src/lib/Server/Plugin.py +++ b/src/lib/Server/Plugin.py @@ -30,7 +30,8 @@ opts = {'owner': Bcfg2.Options.MDATA_OWNER, 'group': Bcfg2.Options.MDATA_GROUP, 'important': Bcfg2.Options.MDATA_IMPORTANT, 'perms': Bcfg2.Options.MDATA_PERMS, - 'paranoid': Bcfg2.Options.MDATA_PARANOID} + 'paranoid': Bcfg2.Options.MDATA_PARANOID, + 'sensitive': Bcfg2.Options.MDATA_SENSITIVE} mdata_setup = Bcfg2.Options.OptionParser(opts) mdata_setup.parse([]) del mdata_setup['args'] @@ -46,7 +47,8 @@ info_regex = re.compile( \ 'mtime:(\s)*(?P<mtime>\w+)|' + 'owner:(\s)*(?P<owner>\S+)|' + 'paranoid:(\s)*(?P<paranoid>\S+)|' + - 'perms:(\s)*(?P<perms>\w+)|') + 'perms:(\s)*(?P<perms>\w+)|' + + 'sensitive:(\s)*(?P<sensitive>\S+)|') class PluginInitError(Exception): diff --git a/src/lib/Server/Plugins/SSHbase.py b/src/lib/Server/Plugins/SSHbase.py index 4a33c0cb0..b15275815 100644 --- a/src/lib/Server/Plugins/SSHbase.py +++ b/src/lib/Server/Plugins/SSHbase.py @@ -230,10 +230,12 @@ class SSHbase(Bcfg2.Server.Plugin.Plugin, keydata = self.entries[filename].data permdata = {'owner': 'root', 'group': 'root', - 'type': 'file', - 'perms': '0600'} + 'type': 'file'} if entry.get('name')[-4:] == '.pub': permdata['perms'] = '0644' + else: + permdata['perms'] = '0600' + permdata['sensitive'] = 'true' [entry.attrib.__setitem__(key, permdata[key]) for key in permdata] if "ssh_host_key.H_" == filename[:15]: entry.attrib['encoding'] = 'base64' |