External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-04 00:52:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

virsh: secret: Print warning that passing secret on command-line is insecure

Browse Source 
Print a warning if users pass in secrets as command line arguments and
mention it in the man page.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Peter Krempa 2020-01-24 16:16:27 +01:00
parent dbbc74e4ce
commit 3c5c90ca19
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docs/manpages/virsh.rst
View File

@ -6571,6 +6571,9 @@ Base64-encoded value *base64* or Base-64-encoded contents of file named
Note that *--file* and *base64* options are mutually exclusive.
Passing secrets via the *base64* option on command line is INSECURE and
deprecated. Use the *--file* option instead.
secret-get-value
----------------

4
tools/virsh-secret.c
View File

@ -217,6 +217,10 @@ cmdSecretSetValue(vshControl *ctl, const vshCmd *cmd)
return false;
}
/* warn users that the --base64 option passed from command line is wrong */
if (base64)
vshError(ctl, _("Passing secret value as command-line argument is insecure!"));
if (filename) {
ssize_t read_ret;
if ((read_ret = virFileReadAll(filename, 1024, &file_buf)) < 0) {