Redact environment variable values in vminitd debug logs#813
Open
vyncint wants to merge 1 commit into
Open
Conversation
vminitd logged the full OCI spec/process at debug level, exposing secrets passed through environment variables (apple#518). Add redactingEnvironmentValues() to ContainerizationOCI's Spec, Process, Hook, and Hooks - masking values while keeping variable names - and use it at both log sites in ManagedContainer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #518.
What
vminitd logs the full OCI spec / exec process at debug level in
ManagedContainer("created bundle with spec …", "creating exec process with …"), which dumps everyNAME=valueenvironment entry into the boot log. Environment variables routinely carry secrets, socontainer logs --boot web | grep PASSWORDreproduces the leak exactly as described in #518.This PR adds
redactingEnvironmentValues()toContainerizationOCI'sSpec,Process,Hook, andHooks— it returns a copy with every env value replaced by<redacted>while keeping the variable names (still useful for debugging which variables were set), leavingNAME-only inherit entries untouched — and uses it at both log sites. With this change the same repro showsMY_SUPER_SECRET_PASSWORD=<redacted>.The helper lives in
ContainerizationOCI(rather than privately in vminitd) so host-side users of the framework who log specs get the same tool; it's a small additive API with doc comments. These two vminitd sites are the only places in the repo that interpolate a wholeSpec/Processinto a log message (the gRPC handlers only log IDs and ports).Verification
SpecRedactionTests(4 tests) cover: values masked / names kept,NAME-only entries passed through,NAME=and values containing=fully masked, hooks' env masked, non-env fields untouched, originals unmutated, and — mirroring the issue directly — that the rendered string no longer contains the secret values.ContainerizationOCITestssuite passes (53 tests).make vminitdcross-compiles cleanly against the pinned Swift 6.3 static Linux SDK with warnings-as-errors, so both edited log sites are type-checked for the Linux target.swift format lint --strictclean on all touched files.Per the AI contribution guidelines: this change was developed with AI assistance (Claude Code); every line has been reviewed, and the reasoning above is the complete justification for each change.
🤖 Generated with Claude Code