Change in vdsm[master]: password: Prevent password logging and persisting

danken at redhat.com danken at redhat.com
Tue May 12 07:15:17 UTC 2015


Dan Kenigsberg has posted comments on this change.

Change subject: password: Prevent password logging and persisting
......................................................................


Patch Set 3:

(1 comment)

https://gerrit.ovirt.org/#/c/40707/3/lib/vdsm/libvirtconnection.py
File lib/vdsm/libvirtconnection.py:

Line 79: 
Line 80: 
Line 81: def _read_password():
Line 82:     with open(constants.P_VDSM_LIBVIRT_PASSWD) as passwd_file:
Line 83:         password = passwd_file.readline().rstrip("\n")
> The protection is needed for v2v, passing real password sent from engine to
I forgot about the real passwords of remote foreign libvirts. No need for comment.

This patch a is big, but I like the idea behind it. It may be safer to backport over tailoring another solution for 3.5.

Disabling jsonrpc logs is out of the question - they are too important for debugging. Even disabling all args of certain methods may be detrimental to understand some flows. However, we need SOMETHING in 3.5.
Line 84:     return ProtectedPassword(password)
Line 85: 
Line 86: 
Line 87: def open_connection(uri=None, username=None, passwd=None):


-- 
To view, visit https://gerrit.ovirt.org/40707
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Icc849ad8bdc1b1fd09884e18038427d96e66110f
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Adam Litke <alitke at redhat.com>
Gerrit-Reviewer: Allon Mureinik <amureini at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Federico Simoncelli <fsimonce at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Martin Peřina <mperina at redhat.com>
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: Shahar Havivi <shavivi at redhat.com>
Gerrit-Reviewer: Vinzenz Feenstra <vfeenstr at redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: automation at ovirt.org
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list