From eb5112dd597336b566378b3a157e76fe3cbbbfee Mon Sep 17 00:00:00 2001

From: Thore Sommer <mail@thson.de>

Date: Mon, 16 Jan 2023 07:26:08 -0300

Subject: [PATCH 3/3] logging: remove option to log into separate file

The implementation had the issue that only the main loggers were added and that

the permissions were not set strict enough. Users should use the logging

provided by systemd instead.

Signed-off-by: Thore Sommer <mail@thson.de>

---

 keylime.conf                       | 10 ----------

 keylime/keylime_logging.py         | 31 ------------------------------

 scripts/templates/2.0/registrar.j2 |  9 ---------

 scripts/templates/2.0/verifier.j2  |  9 ---------

 4 files changed, 59 deletions(-)

diff --git a/keylime.conf b/keylime.conf

index d896f9f..043b6a8 100644

--- a/keylime.conf

+++ b/keylime.conf

@@ -342,11 +342,6 @@ tomtou_errors = False

 # signature check before storing them in the database.

 require_allow_list_signatures = False

-# Destination for log output, in addition to console. Values can be 'file', 

-# with the file being named after the "service" - cloud_verifier - created under 

-# /var/log/keylime), 'stream' or it can be left empty (which results in 

-# logging to console only, recommended when running inside a container)

-log_destination = file

 #=============================================================================

 [tenant]

@@ -595,11 +590,6 @@ auto_migrate_db = True

 # The file to use for SQLite persistence of provider hypervisor data.

 prov_db_filename = provider_reg_data.sqlite

-# Destination for log output, in addition to console. Values can be 'file',

-# with the file being named after the "service" - registrar - created under

-# /var/log/keylime), 'stream' or it can be left empty (which results in

-# logging to console only, recommended when running inside a container)

-log_destination = file

 #=============================================================================

 [ca]

diff --git a/keylime/keylime_logging.py b/keylime/keylime_logging.py

index bc8a11d..f7c7a8f 100644

--- a/keylime/keylime_logging.py

+++ b/keylime/keylime_logging.py

@@ -1,17 +1,10 @@

 import logging

-import os

 from logging import Logger

 from logging import config as logging_config

 from typing import Any, Callable, Dict

 from keylime import config

-LOG_TO_FILE = set()

-LOG_TO_STREAM = set()

-LOGDIR = os.getenv("KEYLIME_LOGDIR", "/var/log/keylime")

-# not clear that this works right.  console logging may not work

-LOGSTREAM = os.path.join(LOGDIR, "keylime-stream.log")

-

 logging_config.fileConfig(config.get_config("logging"))

@@ -50,31 +43,7 @@ def log_http_response(logger: Logger, loglevel: int, response_body: Dict[str, An

 def init_logging(loggername: str) -> Logger:

-

-    if loggername in ("verifier", "registrar"):

-        logdest = config.get(loggername, "log_destination", fallback="")

-        if logdest == "file":

-            LOG_TO_FILE.add(loggername)

-        if logdest == "stream":

-            LOG_TO_STREAM.add(loggername)

-

     logger = logging.getLogger(f"keylime.{loggername}")

     logging.getLogger("requests").setLevel(logging.WARNING)

-    mainlogger = logging.getLogger("keylime")

-    basic_formatter = logging.Formatter("%(asctime)s %(name)s %(levelname)s %(message)s")

-    if loggername in LOG_TO_FILE:

-        logfilename = os.path.join(LOGDIR, f"{loggername}.log")

-        if not os.path.exists(LOGDIR):

-            os.makedirs(LOGDIR, 0o750)

-        fh = logging.FileHandler(logfilename)

-        fh.setLevel(logger.getEffectiveLevel())

-        fh.setFormatter(basic_formatter)

-        mainlogger.addHandler(fh)

-

-    if loggername in LOG_TO_STREAM:

-        fh = logging.FileHandler(filename=LOGSTREAM, mode="w")

-        fh.setLevel(logger.getEffectiveLevel())

-        fh.setFormatter(basic_formatter)

-        mainlogger.addHandler(fh)

     return logger

diff --git a/scripts/templates/2.0/registrar.j2 b/scripts/templates/2.0/registrar.j2

index 3d92303..8de7a50 100644

--- a/scripts/templates/2.0/registrar.j2

+++ b/scripts/templates/2.0/registrar.j2

@@ -71,12 +71,3 @@ auto_migrate_db = {{ registrar.auto_migrate_db }}

 # The file to use for SQLite persistence of provider hypervisor data.

 prov_db_filename: {{ registrar.prov_db_filename }}

-

-# Destination for log output, in addition to console. If left empty, the log

-# output will only be printed to console (recommended for containers to avoid

-# filling data storage). The accepted values are:

-# 'file': The log output will also be written to a file named after the

-#         component in '/var/log/keylime/registrar.log'

-# 'stream': The log output will be written to a common file in

-#           'var/log/keylime/keylime-stream.log'

-log_destination = {{ registrar.log_destination }}

diff --git a/scripts/templates/2.0/verifier.j2 b/scripts/templates/2.0/verifier.j2

index d1584df..7a66cb1 100644

--- a/scripts/templates/2.0/verifier.j2

+++ b/scripts/templates/2.0/verifier.j2

@@ -196,12 +196,3 @@ zmq_port = {{ verifier.zmq_port }}

 # Webhook url for revocation notifications.

 webhook_url = {{ verifier.webhook_url }}

-

-# Destination for log output, in addition to console. If left empty, the log

-# output will only be printed to console (recommended for containers to avoid

-# filling data storage). The accepted values are:

-# 'file': The log output will also be written to a file named after the

-#         component in '/var/log/keylime/verifier.log'

-# 'stream': The log output will be written to a common file in

-#           'var/log/keylime/keylime-stream.log'

-log_destination = {{ verifier.log_destination }}

-- 

2.38.1