Force GDPR compliance of containers logs

After purge_after_days, defaults to a 14, forcibly remove
any rotated and compressed logs of containerized services
in /var/log/containers. This overrides any related
containerized logrotate configuration used for
containerized services.

Allow to alter rotation interval for log files managed
via containerized logrotate. Defaults to 'daily'
and rotate 14 (days).

Use sharedscripts to clean up files in the postrotate
script only once.

Additionally, to enforce GDPR compliance of log files
in /var/log/containers, put them under logrotate management
(minsize 1) and always compress. Prohibit the size option
as it does not honor time-based contstraints required by
GDPR. Forcibly remove all files but those rotated and
compressed logs, via the postscript section.

Partial-bug: #1771543

Change-Id: Id8e4717a5ecda53bc9cd39f1c2efaa80b56bd45e
Signed-off-by: Bogdan Dobrelya <bdobreli@redhat.com>
This commit is contained in:
Bogdan Dobrelya 2018-05-17 12:53:03 +02:00
parent 3b6c90ad70
commit e13654504a
3 changed files with 79 additions and 18 deletions

View File

@ -50,6 +50,29 @@
# [*user*]
# (optional) Defaults to 'root'. Configures cron job for logrotate.
#
# [*maxsize*]
# (optional) Defaults to '10M'.
# Configures the logrotate maxsize parameter.
#
# [*rotation*]
# (optional) Defaults to 'daily'.
# Configures the logrotate rotation interval.
#
# [*rotate*]
# (optional) Defaults to 14.
# Configures the logrotate rotate parameter.
#
# [*purge_after_days*]
# (optional) Defaults to 14.
# Configures forced purge period for rotated logs.
# Overrides the rotation and rotate settings.
#
# DEPRECATED PARAMETERS
#
# [*size*]
# DEPRECATED: (optional) Defaults to '10M'.
# Configures the logrotate size parameter.
#
# [*delaycompress*]
# (optional) Defaults to True.
# Configures the logrotate delaycompress parameter.
@ -58,14 +81,6 @@
# (optional) Defaults to True.
# Configures the logrotate compress parameter.
#
# [*size*]
# (optional) Defaults to '10M'.
# Configures the logrotate size parameter.
#
# [*rotate*]
# (optional) Defaults to 14.
# Configures the logrotate rotate parameter.
#
class tripleo::profile::base::logging::logrotate (
$step = Integer(hiera('step')),
$ensure = present,
@ -76,13 +91,25 @@ class tripleo::profile::base::logging::logrotate (
$weekday = '*',
Integer $maxdelay = 90,
$user = 'root',
$delaycompress = true,
$compress = true,
$size = '10M',
$rotation = 'daily',
$maxsize = '10M',
$rotate = 14,
$purge_after_days = 14,
# DEPRECATED PARAMETERS
$size = undef,
$delaycompress = false,
$compress = true,
) {
if $step >= 4 {
if (! $compress or $delaycompress or $size != undef) {
warning('Size and delaycompress are DISABLED to enforce GDPR.')
warning('Size configures maxsize instead of size.')
warning('Compress cannot be delayed or turned off.')
$maxsize = pick($size, $maxsize)
$compress = true
$delaycompress = false
}
if $maxdelay == 0 {
$sleep = ''
} else {

View File

@ -0,0 +1,26 @@
---
upgrade:
- |
Rotated logs of containerized services in /var/log/containers
will be purged with the next containerized logrotate run
triggered via cron, if the rotated logs have been kept longer
than `purge_after_days` (defaults to a 14 days).
Containerized logrotate now always compresses the rotated
/var/log/containers logs and this can no longer be delayed
with delaycompress. Size parameter does not honor time-based
constraints and is disabled as not GDPR compliant. From now on,
it configures maxsize instead. Minsize is set to a 1 byte to
put all /var/log/containers logs under the containerized
logrotate control.
security:
- |
Forcibly purge rotated /var/log/containers logs after
`purge_after_days` (defaults to a 14 days). New param `rotation`
additionally allows to alter logrotate rotation interval.
Defaults to a 'daily'. Make sure to adjust `purge_after_days` as
needed.
Any files in /var/log/containers, if not managed by
the containerized logrotate, will be purged forcibly with each
containerized logrotate run triggered via cron.

View File

@ -1,17 +1,25 @@
/var/log/containers/*/*log /var/log/containers/*/*/*log {
<%= @rotation %>
rotate <%= @rotate %>
size <%= @size %>
# minsize 1 is required for GDPR compliance, all files in
# /var/log/containers not managed with logrotate will be purged!
minsize 1
# Do not use size as it's not compatible with time-based rotation rules
# required for GDPR compliance.
maxsize <%= @maxsize %>
missingok
notifempty
<%- if @delaycompress %>
delaycompress
<%- end %>
<%- if @compress %>
# Do not use delaycompress as it's not compatible with the postrotate script.
# Compress always is required for the postrotate script compatibility.
compress
<%- end %>
sharedscripts
postrotate
/sbin/lsof -nPs +L1 +D /var/log 2>&1|\
awk '/\S+\s+[0-9]+\s.*\/var\/log\/.*\(deleted\)/ {print $2}' |\
/bin/xargs -n1 -r -t kill -HUP
/bin/xargs -n1 -r -t kill -HUP;
/usr/bin/find /var/log/containers -type f \
\( -not -name "*.gz" -and -not -name "*.[0-9]*" \) -exec rm -f {} \;;
/usr/bin/find /var/log/containers -type f \
-mtime +<%= @purge_after_days %> -exec rm -f {} \;
endscript
}