rpms/sos
7
0
Fork 1
Code Issues Pull Requests Releases Activity

import CS sos-4.10.0-4.el10

Browse Source
This commit is contained in:
eabdullin 2025-10-27 09:00:18 +00:00
parent dc6d72a18d
commit ad0ff793d6
8 changed files with 331 additions and 89 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@ -1,2 +1,2 @@
sos-4.7.2.tar.gz
sos-audit-0.3.tgz
sos-4.10.0.tar.gz
sos-audit-0.3-1.tgz

101
0001-cleaner-Make-cleaner-s-obfuscate_file-properly-worki.patch Normal file
View File

@ -0,0 +1,101 @@
From 3efc8888852225396ebb4f0f9ae95edf4e5badfa Mon Sep 17 00:00:00 2001
From: Pavel Moravec <pmoravec@redhat.com>
Date: Wed, 20 Aug 2025 20:07:05 +0200
Subject: [PATCH] [cleaner] Make cleaner's obfuscate_file properly working
The fix is three-fold:
- obfuscate_file must clean file content and not filename
- cleaner's main_archive must be populated by parsers first
- obfuscate_file dont need short_name as it is always called with
implicit value of short_name that cleaner will strip itself
Closes: #4109
Closes: #4110
Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
---
sos/cleaner/__init__.py | 7 ++++---
sos/collector/__init__.py | 9 +++------
sos/report/__init__.py | 9 +++------
3 files changed, 10 insertions(+), 15 deletions(-)
diff --git a/sos/cleaner/__init__.py b/sos/cleaner/__init__.py
index 4a1470b5..dcd60c66 100644
--- a/sos/cleaner/__init__.py
+++ b/sos/cleaner/__init__.py
@@ -537,7 +537,7 @@ third party.
logfile.write(line)
if archive:
- self.obfuscate_file(log_name, short_name="sos_logs/cleaner.log")
+ self.obfuscate_file(log_name)
self.archive.add_file(log_name, dest="sos_logs/cleaner.log")
def get_new_checksum(self, archive_path):
@@ -678,6 +678,7 @@ third party.
for prepper in self.get_preppers():
for archive in self.report_paths:
self._prepare_archive_with_prepper(archive, prepper)
+ self.main_archive.set_parsers(self.parsers)
def obfuscate_report(self, archive): # pylint: disable=too-many-branches
"""Individually handle each archive or directory we've discovered by
@@ -784,8 +785,8 @@ third party.
self.ui_log.info("Exception while processing "
f"{archive.archive_name}: {err}")
- def obfuscate_file(self, filename, short_name):
- self.main_archive.obfuscate_filename(filename, short_name)
+ def obfuscate_file(self, filename):
+ self.main_archive.obfuscate_arc_files([filename])
def obfuscate_symlinks(self, archive):
"""Iterate over symlinks in the archive and obfuscate their names.
diff --git a/sos/collector/__init__.py b/sos/collector/__init__.py
index 7a414501..e6b55f20 100644
--- a/sos/collector/__init__.py
+++ b/sos/collector/__init__.py
@@ -1405,16 +1405,13 @@ this utility or remote systems that it connects to.
if do_clean:
_dir = os.path.join(self.tmpdir, self.archive._name)
cleaner.obfuscate_file(
- os.path.join(_dir, 'sos_logs', 'sos.log'),
- short_name='sos.log'
+ os.path.join(_dir, 'sos_logs', 'sos.log')
)
cleaner.obfuscate_file(
- os.path.join(_dir, 'sos_logs', 'ui.log'),
- short_name='ui.log'
+ os.path.join(_dir, 'sos_logs', 'ui.log')
)
cleaner.obfuscate_file(
- os.path.join(_dir, 'sos_reports', 'manifest.json'),
- short_name='manifest.json'
+ os.path.join(_dir, 'sos_reports', 'manifest.json')
)
arc_name = self.archive.finalize(method=None)
diff --git a/sos/report/__init__.py b/sos/report/__init__.py
index 074afcff..9fb94d6a 100644
--- a/sos/report/__init__.py
+++ b/sos/report/__init__.py
@@ -1571,13 +1571,10 @@ class SoSReport(SoSComponent):
# Now, separately clean the log files that cleaner also wrote to
if do_clean:
_dir = os.path.join(self.tmpdir, self.archive._name)
- cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'sos.log'),
- short_name='sos.log')
- cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'ui.log'),
- short_name='ui.log')
+ cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'sos.log'))
+ cleaner.obfuscate_file(os.path.join(_dir, 'sos_logs', 'ui.log'))
cleaner.obfuscate_file(
- os.path.join(_dir, 'sos_reports', 'manifest.json'),
- short_name='manifest.json'
+ os.path.join(_dir, 'sos_reports', 'manifest.json')
)
# Now, just (optionally) pack the report and print work outcome; let
--
2.49.0

72
0002-openstack_nova-Improve-scrubbing.patch Normal file
View File

@ -0,0 +1,72 @@
From 6378a4ee9fa3eeaf384bd87fc87e24a0c5608658 Mon Sep 17 00:00:00 2001
From: Pavel Moravec <pmoravec@redhat.com>
Date: Tue, 19 Aug 2025 09:08:15 +0200
Subject: [PATCH] [openstack_nova] Improve scrubbing
Improve postproc obfuscation in two ways:
- apply postproc also to /var/lib/openstack/config/nova on RedHatNova
- obfuscate just password from transport_url, not the whole URL
Closes: #4108
Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
---
sos/report/plugins/openstack_nova.py | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/sos/report/plugins/openstack_nova.py b/sos/report/plugins/openstack_nova.py
index 728aed1e..2635866e 100644
--- a/sos/report/plugins/openstack_nova.py
+++ b/sos/report/plugins/openstack_nova.py
@@ -29,6 +29,7 @@ class OpenStackNova(Plugin):
var_puppet_gen = "/var/lib/config-data/puppet-generated/nova"
service_name = "openstack-nova-api.service"
apachepkg = None
+ postproc_dirs = ["/etc/nova/",]
def setup(self):
@@ -141,12 +142,13 @@ class OpenStackNova(Plugin):
self.add_copy_spec(specs)
def apply_regex_sub(self, regexp, subst):
- """ Apply regex substitution """
- self.do_path_regex_sub("/etc/nova/*", regexp, subst)
- for npath in ['', '_libvirt', '_metadata', '_placement']:
- self.do_path_regex_sub(
- f"{self.var_puppet_gen}{npath}/etc/nova/*",
- regexp, subst)
+ """ Apply regex substitution to all sensitive dirs """
+ for _dir in self.postproc_dirs:
+ self.do_path_regex_sub(f"{_dir}/*", regexp, subst)
+ for npath in ['', '_libvirt', '_metadata', '_placement']:
+ self.do_path_regex_sub(
+ f"{self.var_puppet_gen}{npath}{_dir}/*",
+ regexp, subst)
def postproc(self):
protect_keys = [
@@ -155,10 +157,9 @@ class OpenStackNova(Plugin):
"xenapi_connection_password", "password", "host_password",
"vnc_password", "admin_password", "connection_password",
"memcache_secret_key", "s3_secret_key",
- "metadata_proxy_shared_secret", "fixed_key", "transport_url",
- "rbd_secret_uuid"
+ "metadata_proxy_shared_secret", "fixed_key", "rbd_secret_uuid"
]
- connection_keys = ["connection", "sql_connection"]
+ connection_keys = ["connection", "sql_connection", "transport_url"]
join_con_keys = "|".join(connection_keys)
@@ -214,6 +215,7 @@ class RedHatNova(OpenStackNova, RedHatPlugin):
apachepkg = "httpd"
nova = False
packages = ('openstack-selinux',)
+ postproc_dirs = ["/etc/nova/", "/var/lib/openstack/config/nova"]
def setup(self):
super().setup()
--
2.49.0

36
0003-component-Fix-regression-57bbc89-in-toolbox-containe.patch Normal file
View File

@ -0,0 +1,36 @@
From c0e514894b2c35c2b36f247f8b84dd4311034fb6 Mon Sep 17 00:00:00 2001
From: Pavel Moravec <pmoravec@redhat.com>
Date: Fri, 12 Sep 2025 11:36:02 +0200
Subject: [PATCH] [component] Fix regression 57bbc89 in toolbox containers
57bbc89 commit set tmpdir to source the dir from Policy. Which means
HOST sysroot directory is newly applied already in
LinuxPolicy._container_init method.
Removed lines mimic the same in a worse way, so let drop them here.
Resolves: #4116
Closes: #4118
Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
---
sos/component.py | 3 ---
1 file changed, 3 deletions(-)
diff --git a/sos/component.py b/sos/component.py
index a110c270..3e53fe3d 100644
--- a/sos/component.py
+++ b/sos/component.py
@@ -170,9 +170,6 @@ class SoSComponent():
else:
tmpdir = os.getenv('TMPDIR', None) or self.policy.get_tmp_dir(None)
- if os.getenv('HOST', None) and os.getenv('container', None):
- tmpdir = os.path.join(os.getenv('HOST'), tmpdir.lstrip('/'))
-
# no standard library method exists for this, so call out to stat to
# avoid bringing in a dependency on psutil
self.tmpfstype = shell_out(
--
2.49.0

49
0004-revert-PR4092.patch Normal file
View File

@ -0,0 +1,49 @@
--- a/sos/upload/targets/__init__.py 2025-09-16 19:57:27.294642506 +0200
+++ b/sos/upload/targets/__init__.py 2025-09-16 19:59:44.498573843 +0200
@@ -465,7 +465,7 @@
self.upload_password or
self._upload_password)
- def upload_sftp(self, user=None, password=None, user_dir=None):
+ def upload_sftp(self, user=None, password=None):
"""Attempts to upload the archive to an SFTP location.
Due to the lack of well maintained, secure, and generally widespread
@@ -540,13 +540,10 @@
raise Exception("Unable to connect via SFTP to "
f"{self.get_upload_url_string()}")
- # certain implementations require file to be put in the user dir
- put_cmd = (
- f"put {self.upload_archive_name} "
- f"{f'{user_dir}/' if user_dir else ''}"
- f"{self._get_sftp_upload_name()}"
- )
+ put_cmd = (f'put {self.upload_archive_name} '
+ f'{self._get_sftp_upload_name()}')
ret.sendline(put_cmd)
+
put_expects = [
'100%',
pexpect.TIMEOUT,
--- a/sos/upload/targets/redhat.py 2025-09-16 19:57:36.804628207 +0200
+++ b/sos/upload/targets/redhat.py 2025-09-16 20:00:52.578728154 +0200
@@ -145,7 +145,7 @@
return fname
# pylint: disable=too-many-branches
- def upload_sftp(self, user=None, password=None, user_dir=None):
+ def upload_sftp(self, user=None, password=None):
"""Override the base upload_sftp to allow for setting an on-demand
generated anonymous login for the RH SFTP server if a username and
password are not given
@@ -217,8 +217,7 @@
f"{anon.status_code}): {anon.json()}"
)
if _user and _token:
- return super().upload_sftp(user=_user, password=_token,
- user_dir=_user)
+ return super().upload_sftp(user=_user, password=_token)
raise Exception("Could not retrieve valid or anonymous credentials")
def check_file_too_big(self, archive):

77
sos-RHEL-22732-reverted.patch
View File

@ -1,77 +0,0 @@
From 11879fbb1adc33d8abc0cb70dc63e7e88c39fc3f Mon Sep 17 00:00:00 2001
From: Jose Castillo <jcastillo@redhat.com>
Date: Wed, 21 Feb 2024 12:24:37 +0000
Subject: [PATCH] [redhat|policy] Check for archive size before upload
The Red Hat Customer Portal has a max limit for
single http requests of 1Gb. From sos side, we never checked this
and so customers had to wait for the whole upload to be attempted
before receiving an error from the portal.
This patch attempts to stop the upload before it starts, informing
customers of such limit, and switching to secure FTP where there's
no limit.
Related: RHEL-22732
Signed-off-by: Jose Castillo <jcastillo@redhat.com>
---
sos/policies/distros/redhat.py | 29 +++++++++++++++++++++++------
1 file changed, 23 insertions(+), 6 deletions(-)
diff --git a/sos/policies/distros/redhat.py b/sos/policies/distros/redhat.py
index edea151e2..2fb0df3fa 100644
--- a/sos/policies/distros/redhat.py
+++ b/sos/policies/distros/redhat.py
@@ -22,7 +22,7 @@
from sos.policies.package_managers.rpm import RpmPackageManager
from sos.policies.package_managers.flatpak import FlatpakPackageManager
from sos.policies.package_managers import MultiPackageManager
-from sos.utilities import bold
+from sos.utilities import bold, convert_bytes
from sos import _sos as _
try:
@@ -232,6 +232,8 @@ class RHELPolicy(RedHatPolicy):
_upload_url = RH_SFTP_HOST
_upload_method = 'post'
_device_token = None
+ # Max size for an http single request is 1Gb
+ _max_size_request = 1073741824
def __init__(self, sysroot=None, init=None, probe_runtime=True,
remote_exec=None):
@@ -429,15 +429,30 @@ support representative.
return super().upload_sftp(user=_user, password=_token)
raise Exception("Could not retrieve valid or anonymous credentials")
+ def check_file_too_big(self, archive):
+ size = os.path.getsize(archive)
+ # Lets check if the size is bigger than the limit.
+ # There's really no need to transform the size to Gb,
+ # so we don't need to call any size converter implemented
+ # in tools.py
+ if (size >= self._max_size_request):
+ self.ui_log.warning(
+ _("Size of archive is bigger than Red Hat Customer Portal "
+ "limit for uploads of "
+ f"{convert_bytes(self._max_size_request)} "
+ " via sos http upload. \n")
+ )
+ return RH_SFTP_HOST
+ else:
+ return RH_API_HOST
+
def upload_archive(self, archive):
"""Override the base upload_archive to provide for automatic failover
from RHCP failures to the public RH dropbox
"""
try:
- if self.upload_url and self.upload_url.startswith(RH_API_HOST) and\
- (not self.get_upload_user() or
- not self.get_upload_password()):
- self.upload_url = RH_SFTP_HOST
+ if self.get_upload_url().startswith(RH_API_HOST):
+ self.upload_url = self.check_file_too_big(archive)
uploaded = super().upload_archive(archive)
except Exception as e:
uploaded = False

77
sos.spec
View File

@ -1,11 +1,11 @@
%{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
%global auditversion 0.3
%global auditversion 0.3-1
Summary: A set of tools to gather troubleshooting information from a system
Name: sos
Version: 4.7.2
Release: 2%{?dist}
Version: 4.10.0
Release: 4%{?dist}
Group: Applications/System
Source0: https://github.com/sosreport/sos/archive/%{version}/sos-%{version}.tar.gz
Source1: sos-audit-%{auditversion}.tgz
@ -22,7 +22,10 @@ Recommends: python3-pexpect
Recommends: python3-pyyaml
Conflicts: vdsm < 4.40
Obsoletes: sos-collector <= 1.9
Patch0: sos-RHEL-22732-reverted.patch
Patch1: 0001-cleaner-Make-cleaner-s-obfuscate_file-properly-worki.patch
Patch2: 0002-openstack_nova-Improve-scrubbing.patch
Patch3: 0003-component-Fix-regression-57bbc89-in-toolbox-containe.patch
Patch4: 0004-revert-PR4092.patch
%description
Sos is a set of tools that gathers information about system
@ -33,7 +36,10 @@ support technicians and developers.
%prep
%setup -qn %{name}-%{version}
%setup -T -D -a1 -q
%patch0 -p1 -R
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
%patch -P 4 -p1
%build
%py3_build
@ -62,8 +68,6 @@ cd ..
# %%files -f %%{name}.lang
%files
%{_sbindir}/sos
%{_sbindir}/sosreport
%{_sbindir}/sos-collector
#%dir /etc/sos/cleaner
%dir /etc/sos/presets.d
%dir /etc/sos/extras.d
@ -80,7 +84,7 @@ cd ..
%package audit
Summary: Audit use of some commands for support purposes
License: GPLv2+
License: GPL-2.0-or-later
Group: Application/System
%description audit
@ -103,9 +107,66 @@ of the system. Currently storage and filesystem commands are audited.
%{_mandir}/man8/sos-audit.sh.8.gz
%ghost /etc/audit/rules.d/40-sos-filesystem.rules
%ghost /etc/audit/rules.d/40-sos-storage.rules
%license LICENSE
%changelog
* Tue Sep 23 2025 Jan Jansky <jjansky@redhat.com> = 4.10.0-4
- Update to 4.10.0-4
Resolves: RHEL-113793
* Wed Sep 17 2025 Jan Jansky <jjansky@redhat.com> = 4.10.0-3
- Update to 4.10.0-3
Resolves: RHEL-113793
* Wed Sep 17 2025 Jan Jansky <jjansky@redhat.com> = 4.10.0-2
- Update to 4.10.0-2
Resolves: RHEL-113793
* Thu Aug 21 2025 Jan Jansky <jjansky@redhat.com> = 4.10.0-1
- Update to 4.10.0
Resolves: RHEL-110504
Resolves: RHEL-110505
* Fri Jul 04 2025 Jan Jansky <jjansky@redhat.com> = 4.9.2-1
- Update to 4.9.2
Resolves: RHEL-101721
Resolves: RHEL-101722
* Fri May 30 2025 Jan Jansky <jjansky@redhat.com> = 4.9.1-2
- Update to 4.9.1-2 in RHEL 10
Resolves: RHEL-86667
Resolves: RHEL-86651
* Tue Apr 15 2025 Jan Jansky <jjansky@redhat.com> = 4.9.1-1
- Update to 4.9.1 in RHEL 10
Resolves: RHEL-86667
Resolves: RHEL-86651
* Fri Jan 24 2025 Jan Jansky <jjansky@redhat.com> = 4.8.2-2
- Add new plugin aap_containerized
Resolves: RHEL-75977
* Tue Jan 07 2025 Jan Jansky <jjansky@redhat.com> = 4.8.2-1
- Update to 4.8.2 in RHEL 10
Resolves: RHEL-72943
* Fri Nov 15 2024 Jan Jansky <jjansky@redhat.com> = 4.8.1-1
- Update to 4.8.1 in RHEL 10
Resolves: RHEL-64161
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 4.8.0-3
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
* Fri Sep 27 2024 Jan Jansky <jjansky@redhat.com> = 4.8.0-2
- Added credentials obfuscation from multiple files
Resolves: RHEL-58946
* Thu Sep 19 2024 Jan Jansky <jjansky@redhat.com> = 4.8.0-1
- Update to 4.8.0 in RHEL 10
Resolves: RHEL-58946
* Wed Aug 21 2024 Pavel Moravec <pmoravec@redhat.com> = 4.7.2-2
- Reverting RHEL-22732 patch due to regressions
Resolves: RHEL-50589

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (sos-4.7.2.tar.gz) = 00124fcd1b14a16213ddd53da9686c4efcb773321e5e6e4a2c883bbe71e8ea200055134404942140a55bd94a3aeec272c5bc296f73b5bf16c7194955442e40e6
SHA512 (sos-audit-0.3.tgz) = 32597baf6350804d08179a0dbe48470a93df148e83d2e49bb3288f6bcc2d151bb1433761913bfbccd912c14de92435939fef5bcd7e091dfe33a345d61ea842ea
SHA512 (sos-4.10.0.tar.gz) = 696fd51aeb474ab3118346b998b36a03cb0e6a68a75dbec0295dbce47fd5a71d0b3f9c778b21fac550592b3081870452f7a37a164f19f25046747ecce22821b4
SHA512 (sos-audit-0.3-1.tgz) = 24c7bfec7e47a082ca1f2a96c5ad455c692d81dcc4339877de5bd324719609d91bc0ef6ddb95485fb75b81f90f8a7cc58370ada6f626c275bab36e9e2a409330