Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions dracut/99kdumpbase/kdump.sh
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,7 @@ dump_fs() {
KDUMP_LOG_DEST=$_dump_fs_path/
KDUMP_LOG_OP="mv '$KDUMP_LOG_FILE' '$KDUMP_LOG_DEST/'"

ddebug "Core Collector: $CORE_COLLECTOR"
$CORE_COLLECTOR /proc/vmcore "$_dump_fs_path/vmcore-incomplete" > /dev/console 2>&1
_dump_exitcode=$?
if [ $_dump_exitcode -eq 0 ]; then
Expand Down Expand Up @@ -392,6 +393,7 @@ dump_raw() {
fi

dinfo "saving vmcore"
ddebug "Core Collector: $CORE_COLLECTOR"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The CORE_COLLECTOR variable might contain sensitive information (e.g., passwords, API keys) if custom configurations are used. Printing it as debug information could expose these secrets. Consider sanitizing the output or using a more secure way to log this information.

For example, you could log a hash of the sensitive parts, or redact them entirely.

Suggested change
ddebug "Core Collector: $CORE_COLLECTOR"
ddebug "Core Collector: $(echo "$CORE_COLLECTOR" | sed 's/password=\S*//g')" # Redact sensitive information

$CORE_COLLECTOR /proc/vmcore | dd of="$1" bs=$DD_BLKSIZE >> /tmp/dd_progress_file 2>&1 || return 1
sync

Expand Down Expand Up @@ -440,6 +442,7 @@ dump_ssh() {
# shellcheck disable=SC2029,SC2086
# - _ssh_opts needs to be split
# - _ssh_dir needs to be expanded
ddebug "Core Collector: $CORE_COLLECTOR"
$CORE_COLLECTOR /proc/vmcore | ssh $_ssh_opts "$2" "umask 0077 && dd bs=512 of='$_ssh_dir/vmcore-incomplete'"
_ret=$?
_vmcore="vmcore.flat"
Expand Down
Loading