Do not log DM password in ca/kra installation logs

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>

ipaserver/install/cainstance.py

@@ -602,7 +602,10 @@ class CAInstance(DogtagInstance):
 
         self.backup_state('installed', True)
         try:
-            DogtagInstance.spawn_instance(self, cfg_file)
+            DogtagInstance.spawn_instance(
+                self, cfg_file,
+                nolog_list=(self.dm_password, self.admin_password)
+            )
         finally:
             os.remove(cfg_file)
 

ipaserver/install/dogtaginstance.py

@@ -152,19 +152,13 @@ class DogtagInstance(service.Service):
         return os.path.exists(os.path.join(
             paths.VAR_LIB_PKI_TOMCAT_DIR, self.subsystem.lower()))
 
-    def spawn_instance(self, cfg_file, nolog_list=None):
+    def spawn_instance(self, cfg_file, nolog_list=()):
         """
         Create and configure a new Dogtag instance using pkispawn.
         Passes in a configuration file with IPA-specific
         parameters.
         """
         subsystem = self.subsystem
-
-        # Define the things we don't want logged
-        if nolog_list is None:
-            nolog_list = []
-        nolog = tuple(nolog_list) + (self.admin_password,)
-
         args = [paths.PKISPAWN,
                 "-s", subsystem,
                 "-f", cfg_file]
@@ -172,10 +166,10 @@ class DogtagInstance(service.Service):
         with open(cfg_file) as f:
             self.log.debug(
                 'Contents of pkispawn configuration file (%s):\n%s',
-                cfg_file, ipautil.nolog_replace(f.read(), nolog))
+                cfg_file, ipautil.nolog_replace(f.read(), nolog_list))
 
         try:
-            ipautil.run(args, nolog=nolog)
+            ipautil.run(args, nolog=nolog_list)
         except ipautil.CalledProcessError as e:
             self.handle_setup_error(e)
 

ipaserver/install/krainstance.py

@@ -263,7 +263,10 @@ class KRAInstance(DogtagInstance):
             config.write(f)
 
         try:
-            DogtagInstance.spawn_instance(self, cfg_file)
+            DogtagInstance.spawn_instance(
+                self, cfg_file,
+                nolog_list=(self.dm_password, self.admin_password)
+            )
         finally:
             os.remove(p12_tmpfile_name)
             os.remove(cfg_file)