mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
d85e0550ca
There are cases when output from a utility run contains sensitive content that is better to avoid logging. For example, klist can be told to show actual encryption keys with -K option. Redacting them out with nolog option to ipapython.ipautil.run() is not possible because replacement routine expects exact matches. Introduce two boolean options that allow to skip printing output from the utility being run: -- nolog_output: skip printing captured stdout -- nolog_error: skip printing captured stderr These options default to False (thus, stdout/stderr content will continue to be printed). In case they were set to True, corresponding line will contain stdout=<REDACTED> or stderr=<REDACTED> Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
This is a set of libraries common to IPA clients and servers though mostly
geared currently towards command-line tools.
A brief overview:
config.py - identify the IPA server domain and realm. It uses python-dns to
try to detect this information first and will fall back to
/etc/ipa/default.conf if that fails.
ipautil.py - helper functions
entity.py - entity is the main data type. User and Group extend this class
(but don't add anything currently).
ipavalidate.py - basic data validation routines