137 lines
5.5 KiB
Diff
137 lines
5.5 KiB
Diff
From eb5112dd597336b566378b3a157e76fe3cbbbfee Mon Sep 17 00:00:00 2001
|
|
From: Thore Sommer <mail@thson.de>
|
|
Date: Mon, 16 Jan 2023 07:26:08 -0300
|
|
Subject: [PATCH 3/3] logging: remove option to log into separate file
|
|
|
|
The implementation had the issue that only the main loggers were added and that
|
|
the permissions were not set strict enough. Users should use the logging
|
|
provided by systemd instead.
|
|
|
|
Signed-off-by: Thore Sommer <mail@thson.de>
|
|
---
|
|
keylime.conf | 10 ----------
|
|
keylime/keylime_logging.py | 31 ------------------------------
|
|
scripts/templates/2.0/registrar.j2 | 9 ---------
|
|
scripts/templates/2.0/verifier.j2 | 9 ---------
|
|
4 files changed, 59 deletions(-)
|
|
|
|
diff --git a/keylime.conf b/keylime.conf
|
|
index d896f9f..043b6a8 100644
|
|
--- a/keylime.conf
|
|
+++ b/keylime.conf
|
|
@@ -342,11 +342,6 @@ tomtou_errors = False
|
|
# signature check before storing them in the database.
|
|
require_allow_list_signatures = False
|
|
|
|
-# Destination for log output, in addition to console. Values can be 'file',
|
|
-# with the file being named after the "service" - cloud_verifier - created under
|
|
-# /var/log/keylime), 'stream' or it can be left empty (which results in
|
|
-# logging to console only, recommended when running inside a container)
|
|
-log_destination = file
|
|
|
|
#=============================================================================
|
|
[tenant]
|
|
@@ -595,11 +590,6 @@ auto_migrate_db = True
|
|
# The file to use for SQLite persistence of provider hypervisor data.
|
|
prov_db_filename = provider_reg_data.sqlite
|
|
|
|
-# Destination for log output, in addition to console. Values can be 'file',
|
|
-# with the file being named after the "service" - registrar - created under
|
|
-# /var/log/keylime), 'stream' or it can be left empty (which results in
|
|
-# logging to console only, recommended when running inside a container)
|
|
-log_destination = file
|
|
|
|
#=============================================================================
|
|
[ca]
|
|
diff --git a/keylime/keylime_logging.py b/keylime/keylime_logging.py
|
|
index bc8a11d..f7c7a8f 100644
|
|
--- a/keylime/keylime_logging.py
|
|
+++ b/keylime/keylime_logging.py
|
|
@@ -1,17 +1,10 @@
|
|
import logging
|
|
-import os
|
|
from logging import Logger
|
|
from logging import config as logging_config
|
|
from typing import Any, Callable, Dict
|
|
|
|
from keylime import config
|
|
|
|
-LOG_TO_FILE = set()
|
|
-LOG_TO_STREAM = set()
|
|
-LOGDIR = os.getenv("KEYLIME_LOGDIR", "/var/log/keylime")
|
|
-# not clear that this works right. console logging may not work
|
|
-LOGSTREAM = os.path.join(LOGDIR, "keylime-stream.log")
|
|
-
|
|
logging_config.fileConfig(config.get_config("logging"))
|
|
|
|
|
|
@@ -50,31 +43,7 @@ def log_http_response(logger: Logger, loglevel: int, response_body: Dict[str, An
|
|
|
|
|
|
def init_logging(loggername: str) -> Logger:
|
|
-
|
|
- if loggername in ("verifier", "registrar"):
|
|
- logdest = config.get(loggername, "log_destination", fallback="")
|
|
- if logdest == "file":
|
|
- LOG_TO_FILE.add(loggername)
|
|
- if logdest == "stream":
|
|
- LOG_TO_STREAM.add(loggername)
|
|
-
|
|
logger = logging.getLogger(f"keylime.{loggername}")
|
|
logging.getLogger("requests").setLevel(logging.WARNING)
|
|
- mainlogger = logging.getLogger("keylime")
|
|
- basic_formatter = logging.Formatter("%(asctime)s %(name)s %(levelname)s %(message)s")
|
|
- if loggername in LOG_TO_FILE:
|
|
- logfilename = os.path.join(LOGDIR, f"{loggername}.log")
|
|
- if not os.path.exists(LOGDIR):
|
|
- os.makedirs(LOGDIR, 0o750)
|
|
- fh = logging.FileHandler(logfilename)
|
|
- fh.setLevel(logger.getEffectiveLevel())
|
|
- fh.setFormatter(basic_formatter)
|
|
- mainlogger.addHandler(fh)
|
|
-
|
|
- if loggername in LOG_TO_STREAM:
|
|
- fh = logging.FileHandler(filename=LOGSTREAM, mode="w")
|
|
- fh.setLevel(logger.getEffectiveLevel())
|
|
- fh.setFormatter(basic_formatter)
|
|
- mainlogger.addHandler(fh)
|
|
|
|
return logger
|
|
diff --git a/scripts/templates/2.0/registrar.j2 b/scripts/templates/2.0/registrar.j2
|
|
index 3d92303..8de7a50 100644
|
|
--- a/scripts/templates/2.0/registrar.j2
|
|
+++ b/scripts/templates/2.0/registrar.j2
|
|
@@ -71,12 +71,3 @@ auto_migrate_db = {{ registrar.auto_migrate_db }}
|
|
|
|
# The file to use for SQLite persistence of provider hypervisor data.
|
|
prov_db_filename: {{ registrar.prov_db_filename }}
|
|
-
|
|
-# Destination for log output, in addition to console. If left empty, the log
|
|
-# output will only be printed to console (recommended for containers to avoid
|
|
-# filling data storage). The accepted values are:
|
|
-# 'file': The log output will also be written to a file named after the
|
|
-# component in '/var/log/keylime/registrar.log'
|
|
-# 'stream': The log output will be written to a common file in
|
|
-# 'var/log/keylime/keylime-stream.log'
|
|
-log_destination = {{ registrar.log_destination }}
|
|
diff --git a/scripts/templates/2.0/verifier.j2 b/scripts/templates/2.0/verifier.j2
|
|
index d1584df..7a66cb1 100644
|
|
--- a/scripts/templates/2.0/verifier.j2
|
|
+++ b/scripts/templates/2.0/verifier.j2
|
|
@@ -196,12 +196,3 @@ zmq_port = {{ verifier.zmq_port }}
|
|
|
|
# Webhook url for revocation notifications.
|
|
webhook_url = {{ verifier.webhook_url }}
|
|
-
|
|
-# Destination for log output, in addition to console. If left empty, the log
|
|
-# output will only be printed to console (recommended for containers to avoid
|
|
-# filling data storage). The accepted values are:
|
|
-# 'file': The log output will also be written to a file named after the
|
|
-# component in '/var/log/keylime/verifier.log'
|
|
-# 'stream': The log output will be written to a common file in
|
|
-# 'var/log/keylime/keylime-stream.log'
|
|
-log_destination = {{ verifier.log_destination }}
|
|
--
|
|
2.38.1
|
|
|