Use sensitive attribute on execute & file resource

Use sensitive attribute on execute and file resources that may expose
sensitive data. This avoids keys and secrets appearing on chef-client
logs.

diff --git a/providers/client.rb b/providers/client.rb
index 21b44c4f7d82aea0cbcea4ac482aab081e669e07..87312218522d358c7c64dc64ecff8fefd1a9ed79 100644 (file)
--- a/providers/client.rb
+++ b/providers/client.rb
@@ -33,12 +33,12 @@ action :add do
   key = @new_resource.key || get_key(keyname)
 
   # update the key in the file
-  file filename do
+  file filename do # ~FC009
     content file_content(keyname, key, as_keyring)
     owner owner
     group group
     mode mode
-    # sensitive true if Chef::Resource::File.method_defined? :sensitive # ~FC009
+    sensitive true if Chef::Resource::File.method_defined? :sensitive
   end
 
 end
@@ -112,8 +112,8 @@ def create_entity(keyname)
   Chef::Log.debug "Client #{keyname} created"
 
   # remove temporary keyring file
-  file tmp_keyring do
+  file tmp_keyring do # ~FC009
     action :delete
-    # sensitive true if Chef::Resource::File.method_defined? :sensitive # ~FC009
+    sensitive true if Chef::Resource::File.method_defined? :sensitive
   end
 end

diff --git a/recipes/mon.rb b/recipes/mon.rb
index 7e0cc1d0594bf01581dbf96a223ec310af7a225d..fb910299689e651ddec9c1a096ce775623d3ff19 100644 (file)
--- a/recipes/mon.rb
+++ b/recipes/mon.rb
@@ -42,17 +42,19 @@ cluster = 'ceph'
 
 keyring = "#{Chef::Config[:file_cache_path]}/#{cluster}-#{node['hostname']}.mon.keyring"
 
-execute 'format mon-secret as keyring' do
+execute 'format mon-secret as keyring' do # ~FC009
   command lazy { "ceph-authtool '#{keyring}' --create-keyring --name=mon. --add-key='#{mon_secret}' --cap mon 'allow *'" }
   creates keyring
   only_if { mon_secret }
+  sensitive true if Chef::Resource::Execute.method_defined? :sensitive
 end
 
-execute 'generate mon-secret as keyring' do
+execute 'generate mon-secret as keyring' do # ~FC009
   command "ceph-authtool '#{keyring}' --create-keyring --name=mon. --gen-key --cap mon 'allow *'"
   creates keyring
   not_if { mon_secret }
   notifies :create, 'ruby_block[save mon_secret]', :immediately
+  sensitive true if Chef::Resource::Execute.method_defined? :sensitive
 end
 
 ruby_block 'save mon_secret' do

diff --git a/recipes/osd.rb b/recipes/osd.rb
index a0ff278bc4306939035a0692f14e6a6d34fe3f6c..8cf410030dbe6cbce64ed0746eb6c6f3f9506394 100644 (file)
--- a/recipes/osd.rb
+++ b/recipes/osd.rb
@@ -54,10 +54,11 @@ end
 # TODO: cluster name
 cluster = 'ceph'
 
-execute 'format bootstrap-osd as keyring' do
+execute 'format bootstrap-osd as keyring' do # ~FC009
   command lazy { "ceph-authtool '/var/lib/ceph/bootstrap-osd/#{cluster}.keyring' --create-keyring --name=client.bootstrap-osd --add-key='#{osd_secret}'" }
   creates "/var/lib/ceph/bootstrap-osd/#{cluster}.keyring"
   only_if { osd_secret }
+  sensitive true if Chef::Resource::Execute.method_defined? :sensitive
 end
 
 if crowbar?