On Thu, 6 Feb 2020 15:49:02 +0000 David Díaz <dgonzalez@suse.de> wrote:
Hi!
Recently, we have been asked to change the save_y2logs generated file permissions[1] because it's only readable by root, which causes troubles[2] when trying to upload it elsewhere as a common user.
However, this is not possible because generated logs contain sensitive information like configuration of services, the content of the journal, or firewall configuration.
Adding a short explanation in the command output about the need to adjust the permissions when you are going to upload the file could help the user to understand what's going on, but seems to not be enough. The user should also be aware that logs might contain sensitive data and keep them safe.
How do you think we could improve that situation?
Hi, we need for sure discuss it with security team where are experts for this topic. Also we should maybe somehow mention that when Y2DEBUG is set to 1, then it logs everything including passwords as it logs also on UI layer ( by default not enabled ). Also what needs to be taken in consideration is that y2logs is always on system after each installation, so it for sure have not be readable outside of root as it can mean that you can access information about configuration on each machine. When user uploading logs it is a bit different because it is expected that it will be visible and in such case user is aware of it. Some users even manually pick what is in logs or clear logs before reproduce issue so it is really minimal. So save_y2logs have to be also run as root, but maybe what we can do there is add ability to pass user and chown tarball after calling. So something like `save_y2logs --user jreidinger` and resulting tarball will be readable by that user which looks like good compromise. and print warning if it is called without user specified. Josef
Regards.
[1] https://github.com/yast/yast-yast2/issues/978
[2] https://en.opensuse.org/openSUSE:Report_a_YaST_bug#Firefox_fails_to_attach_t...
-- To unsubscribe, e-mail: yast-devel+unsubscribe@opensuse.org To contact the owner, e-mail: yast-devel+owner@opensuse.org