app/stacksnipe: redact secrets in exported command lines - #4688
Open
aly-obol wants to merge 1 commit into
Open
Conversation
The stack sniping collector read the full command line of every detected validator client and exported it verbatim, both as the cli_parameters label of the app_validator_stack_params gauge served on the monitoring endpoint, and as a field of a debug log line. Validator client command lines routinely carry secret material, for example keystore passwords, the paths of files holding them, and keymanager bearer tokens. Exporting them unmodified pushes that material into the metrics and log planes, whose readers and retention are usually much broader than the process table it came from. Redact the values of flags whose names look sensitive (auth, jwt, key, passphrase, password, secret, token) before the command line is logged or handed to the metrics callback. Both the "--flag value" and the "--flag=value" forms are handled, and flag names are preserved so the telemetry stays useful. A /proc cmdline is NUL separated, so redaction normally operates per argument; if the whole command line ever arrives as a single blob it is split on whitespace first, so redaction fails safe rather than passing the blob through untouched. Also warn at startup when --proc-directory is set, and note the disclosure tradeoff in the flag's help text, so the behaviour is not a surprise. The feature remains disabled by default.
|
aly-obol
enabled auto-merge (squash)
September 7, 2026 18:53
aly-obol
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4688 +/- ##
==========================================
+ Coverage 65.38% 65.49% +0.10%
==========================================
Files 247 247
Lines 29983 30070 +87
==========================================
+ Hits 19605 19693 +88
+ Misses 10377 10376 -1
Partials 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The stack sniping collector reads the full command line of every detected validator client and exports it verbatim in two places:
cli_parameterslabel of theapp_validator_stack_paramsgauge, served on the monitoring endpointDetected stack componentdebug log lineValidator client command lines routinely carry secret material: keystore passwords, the paths of the files holding them, and keymanager bearer tokens, among others. Exporting them unmodified moves that material into the metrics and log planes, whose readers and retention are typically much broader than the process table it was read from.
Change
Redact the values of flags whose names look sensitive (
auth,jwt,key,passphrase,password,secret,token) before the command line is logged or handed to the metrics callback:--flag valueand the--flag=valueforms are handled<redacted>/proccmdline is NUL separated, so redaction normally operates per argument. If the whole command line ever arrives as a single blob, it is split on whitespace first, so redaction fails safe rather than passing the blob through untouchedAlso:
WARNat startup when--proc-directoryis set, so the disclosure tradeoff is visible to operatorsdocs/configuration.md)The feature remains disabled by default;
--proc-directorystill defaults to empty.Testing
go test ./app/stacksnipe/passes, with two new subtests: one asserting no secret material survives export from a realistic NUL separated cmdline (while non-sensitive flags and values are untouched), and one covering the unsplit-blob fallbackgo test ./cmd -run=TestConfigReferencepasses, confirmingdocs/configuration.mdmatches the updated flag helpgofmtcleancategory: bug
ticket: none