obmc-console: Suppress syslog in bare metal mode In bare metal mode (when gbmc-bare-metal-active@.target is active), we want to prevent sensitive data from leaking into syslog. The previous implementation only filtered data on specific PII sockets but left the syslog handler active, logging all data. This change adds a state accessor `pii_get_state()` to expose the PII state from `pii-handler`. The `syslog-handler` is updated to check this state and skip logging to syslog when in `PII_DATA_USER` state (bare metal mode active). Tested: Moved to and from BM mode and we can see the journal logs stopped when we enter BM mode and they are started when we move to non-BM mode. https://paste.googleplex.com/5292513159151616 Google-Bug-Id: 506720057 Change-Id: Ib2faa6ae0511219a60f6bac2f43676fedb13bf1e Signed-off-by: Vikram Gara <vikramgara@google.com>
diff --git a/console-server.h b/console-server.h index d0addf6..a292d20 100644 --- a/console-server.h +++ b/console-server.h
@@ -230,6 +230,7 @@ }; ssize_t console_pii_socket_path(socket_path_t sun_path, const char *id, enum pii_data_t pii_data); +enum pii_data_t pii_get_state(void); /* utils */ int write_buf_to_fd(int fd, const uint8_t *buf, size_t len);
diff --git a/pii-handler.c b/pii-handler.c index e63e12d..40f73f0 100644 --- a/pii-handler.c +++ b/pii-handler.c
@@ -855,3 +855,8 @@ }; console_handler_register(&pii_handler.handler); + +enum pii_data_t pii_get_state(void) +{ + return pii_handler.pii_state; +}
diff --git a/syslog-handler.c b/syslog-handler.c index b6eda74..fe1455d 100644 --- a/syslog-handler.c +++ b/syslog-handler.c
@@ -101,6 +101,11 @@ { uint8_t *buf; size_t drained_len = 0; + bool skip_log = (pii_get_state() == PII_DATA_USER); + + if (skip_log) { + lh->curser = 0; /* Reset partial line buffer */ + } while (to_drain_len) { size_t len = @@ -109,7 +114,9 @@ break; } len = min(to_drain_len, len); - syslog_data_as_canonical_line(lh, buf, len); + if (!skip_log) { + syslog_data_as_canonical_line(lh, buf, len); + } ringbuffer_dequeue_commit(lh->rbc, len); drained_len += len; to_drain_len -= len;