Implement OWASP security logging. by blackboxsw · Pull Request #6689 · canonical/cloud-init

blackboxsw · 2026-01-26T21:48:31Z

Provide an initial spike for logging OWASP formatted events in cloud-init for discussion. Integration tests will be added upon agreement for security logging procedures.

Proposed Commit Message

    feat: add OWASP security event logging for user creation and system restart
    
    Implement OWASP structured logs in /var/log/cloud-init-security.log.
    
    Add security-related operations performed by cloud-init on behalf
    of user-data or platform meta-data:
    - user creation
    - user password change
    - system restart
    - system shutdown
  
    Default security log file can be changed by setting an alternative value
    for security_log_file in /etc/cloud/cloud.cfg(.d/*.cfg).

Additional Context

A followup PR will provide USER update functionality due to groups: { admingrp: [root, sys]} because this will require a refactor of Distro.create_group for multiple distros

Test Steps

CLOUD_INIT_CLOUD_INIT_OS_IMAGE=resolute tox -e integration-tests -- tests/integration_tests/modules/test_combined.py::TestCombined::test_security_logs

Merge type

Squash merge using "Proposed Commit Message"
Rebase and merge unique commits. Requires commit messages per-commit each referencing the pull request number (#<PR_NUM>)

blackboxsw · 2026-01-27T16:03:59Z

cc: @dbungert

holmanb

Thanks for this @blackboxsw. First pass.

If the goal is for this to be cross-distro, then implementing this in the distro class doesn't seem optimal because distro methods are expected to be (and in this case are) overridden.

Also, is there a reason that the logger package cannot be used? Manually writing to files seems undesirable - I would have expected this to define a custom logger for this purpose.

Thank you for the type annotations. Besides just annotating the types, I'd like to see if we can also avoid unnecessary complexity - something that annotations can assist with. For example rather than checking an Optional parameter for trutheyness, we could instead avoid the possibility of None and pass a falsey value instead.

cloudinit/log/security_event_log.py

holmanb · 2026-01-27T00:11:14Z

cloudinit/distros/__init__.py

+            sec_log_user_created(
+                userid="cloud-init",
+                new_userid=name,
+                attributes={"snapuser": True, "sudo": True},
+            )


Intermixing code of different different purposes like this will lead to difficulty maintaining and auditing the code. I would prefer if we could find a cleaner design.

good point, let's go decorator route instead,

Decorators didn't address the problem. These decorators are still mixing code of different purposes.

cloudinit/log/security_event_log.py

cloudinit/util.py

cloudinit/log/security_event_log.py

cloudinit/distros/__init__.py

holmanb · 2026-01-27T16:30:29Z

cloudinit/log/security_event_log.py

+    if params:
+        # Filter out None values and convert to strings
+        filtered_params = [str(p) for p in params if p is not None]
+        if filtered_params:


This conditional is unnecessary.

It is in the event that all filtered_params are empty. We don't want a trailing ":" appended if filtered_params == []

It is in the event that all filtered_params are empty.

This should never happen. See my comment above.

blackboxsw · 2026-03-05T05:19:33Z

I believe I have addressed all comments and this is ready for re-review.

…estart Implement OWASP structured logs in /var/log/cloud-init-security.log. Add security-related operations performed by cloud-init on behalf of user-data or platform meta-data: - user creation - user password change - system restart - system shutdown Default security log file can be changed by setting an alternative value for security_log_file in /etc/cloud/cloud.cfg(.d/*.cfg).

Replace LevelBasedFormatter with handler-level filters. SecurityOnlyFilter and NoSecurityFilter are applied at the handler level so SECURITY records flow only to a dedicated FileHandler on cloud-init-output.log using SECURITY_LOG_FORMAT, and are blocked from stderr and LogExporter. setup_security_logging() silently no-ops on OSError so unprivileged test environments are unaffected. Update test_logger_prints_security_as_ json_lines to assert file output and absence from stderr.

Use netdev_info to discover any interface with a global scope IP address. If no IPv4 address is present, return IPv6. If no network devices are up or no global addresses are present, avoid adding host_ip to event logs. Additionally, add "type": "security" to all events.

…ogger

…down Correct type hint for netdev_info

cloudinit/distros/__init__.py

cloudinit/log/security_event_log.py

tests/integration_tests/modules/test_combined.py

holmanb · 2026-03-06T19:36:03Z

cloudinit/distros/__init__.py

@@ -1113,6 +1123,7 @@ def set_passwd(self, user, passwd, hashed=False):

        return True

+    @sec_log_password_changed_batch
    def chpasswd(self, plist_in: list, hashed: bool):
        payload = (
            "\n".join(


Can we add @final here too?

Also migrated the sec_log_user_created decorator to add_user and add_snap_user as that is actually where a user gets created. Added @final decorators to both of those methods.
Refactored subclasses of add_user behavior into _add_user_preprocess_kwargs, _build_add_user_cmd and _post_add_user methods.

This is still overridden in a child class.

This is in distros/bsd.py, but bsd directly calls set_passwd for each name in plist_in. So BSD will still be logging separate OWASP events for each user, just as our @sec_log_password_changed_batch will.

As a result, I don't want to decorate chpasswd with @final and I also don't want to decorate cloudinit.distros.bsd.Disto.chpasswd with @sec_log passwd_changed_batch

cloudinit/log/security_event_log.py

holmanb · 2026-03-06T19:58:20Z

cloudinit/log/security_event_log.py

+    :return: Dictionary containing the security event data.
+    """
+    event = {
+        "datetime": datetime.datetime.now(datetime.timezone.utc).isoformat(),


This also concerns me - I would rather avoid side-effects in logging libraries. This causes a syscall.

Also, it seems odd to be manually building building a format for the log here.

Python's builtin logger allows supplying custom Formatter objects - which is where I would expect the format to be defined. The formatter should already have the time and can be configured to the desired format.

cloudinit/log/security_event_log.py

holmanb · 2026-03-06T20:08:05Z

cloudinit/log/security_event_log.py

+    """A decorator logging a system shutdown event."""
+
+    @functools.wraps(func)
+    def decorator(*args, **kwargs):


Why does this use kwargs when the keyword names are known?

- drop unintended @Final from Distro.set_passwd - simplify sec_log decorators to assume positional param idx 1 when kwarg empty - drop unchecked bool return values from _post_add_user

holmanb

Thanks for this @blackboxsw. See the latest feedback.

In general I'd like to see us avoid iterating over interfaces, opening sockets, and calling datetime on a per-log basis - and these kinds of side-effects don't seem well-suited for a system logging library.

The same goes for parsing data from untyped Dicts. A major problem with building a solution that can be maintained is that distro-specific code is doing configuration validation and manipulation - the existing code doesn't have clear separation of concerns.

Also: I'd like to see a sample log produced by this code.

holmanb · 2026-03-10T20:19:43Z

cloudinit/distros/__init__.py

-        }
+    @final
+    @sec_log_user_created
+    def add_user(self, name, **kwargs):


This no longer has a type annotation. Why did the type signature change?

I should have migrated this annotation to express that we expect no return value. Given that this PR migrates the pre-flight check for pre-existing user outside the Distro.add_user` call, there is no longer a need to check a bool return code from add_user given the simplification to the method.

Now we only call add user if we are sure the user doesn't exist up in create_user.

pre_existing_user = util.is_user(name) if pre_existing_user: LOG.info("User %s already exists, skipping.", name) else: self.add_user(name, **kwargs)

We also don't have any direct callers to Distro.add_user in any cloud-init runtime operations. Any call-sites in upstream are invoked via the Distro.create_user method. This could expose some downstream images with custom private Distro implementations, but that is a highly unlikely scenario as we don't treat cloudinit as a python library supporting direct calls into our python modules and class APIs.

holmanb · 2026-03-10T20:24:26Z

cloudinit/distros/__init__.py

@@ -1113,6 +1123,7 @@ def set_passwd(self, user, passwd, hashed=False):

        return True

+    @sec_log_password_changed_batch
    def chpasswd(self, plist_in: list, hashed: bool):
        payload = (
            "\n".join(


This is still overridden in a child class.

holmanb · 2026-03-10T20:31:39Z

cloudinit/distros/__init__.py

    def shutdown_command(cls, *, mode, delay, message):
-        # called from cc_power_state_change.load_power_state
+        # called from cc_power_state_change.load_power_state and clean
+        if hasattr(cls, "_shutdown_command"):  # Overridden in alpine.Distro


This class uses inheritance to define and override default behaviors. It seems unusual to reach for a low-level meta-programming utility rather than using inheritance. Why was this chosen instead?

The intent was to leave us with only one place with sec_log decorators in the parent class and disallow creating the shutdown_command method on subclasses via @final. I'll refactor this to use the same approach we user for add user with _build_shutdown_cmd. I've refactored the validation of the delay value which was duplicated in alpine and pulled it into a pre-flight check in shutdown_command.

holmanb · 2026-03-10T20:32:33Z

cloudinit/distros/alpine.py

                LOG.info("Added user '%s' to group '%s'", member, name)

-    def shutdown_command(self, mode="poweroff", delay="now", message=None):
+    @classmethod


holmanb · 2026-03-10T20:33:06Z

cloudinit/distros/freebsd.py

        for key, val in kwargs.items():
            if key in pw_useradd_opts and val and isinstance(val, (str, int)):
                pw_useradd_cmd.extend([pw_useradd_opts[key], str(val)])
-


holmanb · 2026-03-10T21:25:07Z

cloudinit/log/security_event_log.py

+        userid = kwargs.get("user")
+        if not userid:
+            userid = args[1]


This seems fishy. Isn't args[1] the password?

Updated the signature to expect known positional args. No more kwargs parsing.

holmanb · 2026-03-10T21:35:46Z

cloudinit/log/security_event_log.py

+    if params:
+        # Filter out None values and convert to strings
+        filtered_params = [str(p) for p in params if p is not None]
+        if filtered_params:


holmanb · 2026-03-10T21:50:24Z

cloudinit/log/security_event_log.py

+        params = ["cloud-init", new_userid]
+        groups_msg = ""
+        groups_suffix = kwargs.get("groups", "")
+        if groups_suffix:
+            if isinstance(groups_suffix, (dict, list)):
+                groups_suffix = ",".join(groups_suffix)
+        for perms in ("sudo", "doas"):
+            if kwargs.get(perms):
+                groups_suffix += f",{perms}"
+        if groups_suffix:
+            groups_suffix = groups_suffix.strip(",")
+            groups_msg = f" in groups: {groups_suffix}"
+            params.append(f"groups:{groups_suffix}")


This doesn't seem ideal. This is interpreting arbitrary untyped data from a dict. This dict interpretation is a long ways from wherever this datastructure is defined, yet it is tightly coupled to the structure where it was defined.

You are right, this feels fragile and is working around the complexity in both add_user and _build_add_user_cmd which both attempt to parse and handle "groups" being passed as an untyped dict config key value from merged user-data. An alternative to keep things closer to where distros processes this config content would be a helper function in cloudinit/distros/init.py which can expose the properly typed groups content in order to ensure the, add_user calls, _build_add_user_cmd and log decorator properly handle this information in the same manner. There is a lot of duplication here in the decorator and in Distro instance methods that we can avoid if all call-sites get a typed response from one place.

holmanb · 2026-03-10T21:52:36Z

cloudinit/log/security_event_log.py

+        plist_in = kwargs.get("plist_in")
+        if not plist_in:
+            plist_in = args[1]


This construct seems confusing, and possibly wrong.

Dropped in favor of known positional arg plist_in

holmanb · 2026-03-10T22:13:17Z

cloudinit/distros/__init__.py

+            sec_log_user_created(
+                userid="cloud-init",
+                new_userid=name,
+                attributes={"snapuser": True, "sudo": True},
+            )


Decorators didn't address the problem. These decorators are still mixing code of different purposes.

… args

Add _build_shutdown_cmd which is subclassed in Alpine. Move pre-flight delay type checking into Distro.shutdown_command and call the _build_shutdown_cmd to construct the distro-specific command.

blackboxsw

Addressed most review points, still looking at:

adding a Distro.extract_group method to extract typed information from opaque kwargs config passed into add_user
looking at custom logging formatted to provide the logging timestamp instead of calling datetime directly.

blackboxsw · 2026-03-12T21:47:01Z

cloudinit/log/security_event_log.py

+        "event": _build_event_string(event_type, event_params),
+        "level": level.value,
+        "description": description,
+        "hostname": util.get_hostname(),


I'm uncertain how we should resolve this concern and also deliver identifiable information within each log to provide breadcrumbs for security log aggregators about the source of the log.

Do you think we may instead want to just extract provided hostname data from the Platform via a call to util.get_hostname_fqdn to avoid using socket.gethostname. Or possibly @lru_cache around get_hostname to avoid recurring cost of a call?

I see our security logs as only being on the order of 10 events per boot vs 100's. So I don't know whether you are concerned about recurring cost, or just that fact that logging reaches out to some other system which could timeout.

It's possible we could drop this key, which places a responsibility on all security log aggregators to identify the source from which all logs originate.

blackboxsw · 2026-03-12T23:13:36Z

cloudinit/log/security_event_log.py

+        params = ["cloud-init", new_userid]
+        groups_msg = ""
+        groups_suffix = kwargs.get("groups", "")
+        if groups_suffix:
+            if isinstance(groups_suffix, (dict, list)):
+                groups_suffix = ",".join(groups_suffix)
+        for perms in ("sudo", "doas"):
+            if kwargs.get(perms):
+                groups_suffix += f",{perms}"
+        if groups_suffix:
+            groups_suffix = groups_suffix.strip(",")
+            groups_msg = f" in groups: {groups_suffix}"
+            params.append(f"groups:{groups_suffix}")


You are right, this feels fragile and is working around the complexity in both add_user and _build_add_user_cmd which both attempt to parse and handle "groups" being passed as an untyped dict config key value from merged user-data. An alternative to keep things closer to where distros processes this config content would be a helper function in cloudinit/distros/init.py which can expose the properly typed groups content in order to ensure the, add_user calls, _build_add_user_cmd and log decorator properly handle this information in the same manner. There is a lot of duplication here in the decorator and in Distro instance methods that we can avoid if all call-sites get a typed response from one place.

blackboxsw · 2026-03-13T18:23:44Z

cloudinit/log/security_event_log.py

+    if params:
+        # Filter out None values and convert to strings
+        filtered_params = [str(p) for p in params if p is not None]
+        if filtered_params:


It is in the event that all filtered_params are empty. We don't want a trailing ":" appended if filtered_params == []

blackboxsw · 2026-03-13T18:24:09Z

cloudinit/distros/__init__.py

-        }
+    @final
+    @sec_log_user_created
+    def add_user(self, name, **kwargs):


I should have migrated this annotation to express that we expect no return value. Given that this PR migrates the pre-flight check for pre-existing user outside the Distro.add_user` call, there is no longer a need to check a bool return code from add_user given the simplification to the method.

Now we only call add user if we are sure the user doesn't exist up in create_user.

pre_existing_user = util.is_user(name) if pre_existing_user: LOG.info("User %s already exists, skipping.", name) else: self.add_user(name, **kwargs)

We also don't have any direct callers to Distro.add_user in any cloud-init runtime operations. Any call-sites in upstream are invoked via the Distro.create_user method. This could expose some downstream images with custom private Distro implementations, but that is a highly unlikely scenario as we don't treat cloudinit as a python library supporting direct calls into our python modules and class APIs.

blackboxsw · 2026-03-13T18:24:13Z

cloudinit/distros/__init__.py

    def shutdown_command(cls, *, mode, delay, message):
-        # called from cc_power_state_change.load_power_state
+        # called from cc_power_state_change.load_power_state and clean
+        if hasattr(cls, "_shutdown_command"):  # Overridden in alpine.Distro


The intent was to leave us with only one place with sec_log decorators in the parent class and disallow creating the shutdown_command method on subclasses via @final. I'll refactor this to use the same approach we user for add user with _build_shutdown_cmd. I've refactored the validation of the delay value which was duplicated in alpine and pulled it into a pre-flight check in shutdown_command.

blackboxsw · 2026-03-13T18:25:40Z

cloudinit/netinfo.py

+        for _, info in netdev_info().items():
+            if not info["up"]:
+                continue
+            ipv4: List[dict] = info.get("ipv4", [])


Dropped cloudinit.netinfo.get_host_ip function to avoid the cost of shelling out to ip addr --json for every security event log. So this comment no longer applies.

This "up" check on the device would have also been a prerequisite to surfacing valid ipv4 settings. I also agree that a down interface will also not have any valid ipv4 of ipv6 addresses, so this check was unnecessary.

Agreed on typing in netinfo, and I think that is already tracked as an existing enhancement #5445 to eventually resolve those issues.

blackboxsw · 2026-03-13T18:25:50Z

cloudinit/netinfo.py

+    """
+    try:
+        first_ipv6: Optional[str] = None
+        for _, info in netdev_info().items():


Will address this if we end up adding host_ip info in the future.

blackboxsw · 2026-03-13T18:29:58Z

cloudinit/log/security_event_log.py

+        "event": _build_event_string(event_type, event_params),
+        "level": level.value,
+        "description": description,
+        "hostname": util.get_hostname(),


OWASP log formats look for identifiable information in the individual logs to ease the burden on aggregators. To avoid calling to socket.gethostname(). We could instead call util.get_hostname_fqdn to get what the IMDS told us the hostname should be (which is run in cloud-init-local stage to grab this data from the IMDS before cloud-init. We could also use @lru_cache to avoid repeated cost for such an operation.

blackboxsw · 2026-03-13T18:30:04Z

cloudinit/log/security_event_log.py

+        userid = kwargs.get("user")
+        if not userid:
+            userid = args[1]


Updated the signature to expect known positional args. No more kwargs parsing.

blackboxsw · 2026-03-13T18:34:33Z

cloudinit/distros/__init__.py

@@ -1113,6 +1123,7 @@ def set_passwd(self, user, passwd, hashed=False):

        return True

+    @sec_log_password_changed_batch
    def chpasswd(self, plist_in: list, hashed: bool):
        payload = (
            "\n".join(


This is in distros/bsd.py, but bsd directly calls set_passwd for each name in plist_in. So BSD will still be logging separate OWASP events for each user, just as our @sec_log_password_changed_batch will.

As a result, I don't want to decorate chpasswd with @final and I also don't want to decorate cloudinit.distros.bsd.Disto.chpasswd with @sec_log passwd_changed_batch

…created

holmanb · 2026-03-18T13:35:49Z

cloudinit/log/security_event_log.py

+        # Filter out None values and convert to strings
+        filtered_params = [str(p) for p in params if p is not None]


According to the type annotation, the filter will never do anything.

holmanb · 2026-03-18T13:38:12Z

cloudinit/log/security_event_log.py

+    if params:
+        # Filter out None values and convert to strings
+        filtered_params = [str(p) for p in params if p is not None]
+        if filtered_params:


It is in the event that all filtered_params are empty.

This should never happen. See my comment above.

holmanb · 2026-03-18T13:41:46Z

cloudinit/log/security_event_log.py

+
+def sec_log_password_changed_batch(func):
+    @functools.wraps(func)
+    def decorator(self, plist_in, *args, **kwargs):


Can we get a type annotation on plist_in?

holmanb · 2026-03-18T13:43:43Z

cloudinit/log/security_event_log.py

+    """A decorator logging a password change event."""
+
+    @functools.wraps(func)
+    def decorator(self, user: str, *args, **kwargs):


The function that this decorates doesn't have an annotation. Can we add it there too please?

holmanb · 2026-03-18T13:48:36Z

cloudinit/log/security_event_log.py

+            event_type=OWASPEventType.AUTHN_PASSWORD_CHANGE,
+            level=OWASPEventLevel.INFO,
+            description=f"Password changed for user '{user}'",
+            event_params=["cloud-init", user],


Why is every event_params getting passed ["cloud-init", ...]? If this is to be added by default, this doesn't seem like the right place for it, since it has to be duplicated at every call site.

Moved into _log_security_event to simplify call-sites.

holmanb · 2026-03-18T13:50:22Z

cloudinit/net/dhcp.py

        interface: str,
        dhcp_log_func: Optional[Callable[[str, str, str], None]] = None,
        distro=None,
+        metric=None,


Why this change?

Dropped unrelated stay delta from separate PR.

holmanb · 2026-03-18T13:53:02Z

doc/rtd/reference/user_files.rst

 - :file:`/var/log/cloud-init.log`: The primary log file. Verbose, but useful.
 - :file:`/var/log/cloud-init-output.log`: Captures the output from each stage.
  Output from user scripts goes here.
+- :file:`/var/log/cloud-init-security.log`: This file logs OWASP security


Files don't log events.

holmanb · 2026-03-18T13:55:49Z

cloudinit/log/security_event_log.py

+    """A decorator to log a user creation event and group attributes."""
+
+    @functools.wraps(func)
+    def decorator(self, name, *args, **kwargs):


Please add an annotation for name.

holmanb · 2026-03-18T14:00:09Z

cloudinit/log/security_event_log.py

+        # User creation operation did not raise an Exception
+        _log_security_event(
+            event_type=OWASPEventType.USER_CREATED,
+            level=OWASPEventLevel.WARN,


Why is this level WARN?

It's defined as WARN level on Canonical SSDLC user event guidance

This happens due to trusted inputs and this will case a WARN on every boot - the typically arguments for "why" to WARN don't seem to apply in this case.

Also, since that is just an example this seems up for interpretation. I think it makes more sense not to warn on every boot.

Maybe just set it to INFO and include a short comment in case anyone wonders why.

holmanb · 2026-03-18T14:01:18Z

cloudinit/log/security_event_log.py

+        groups_suffix = kwargs.get("groups", "")
+        if groups_suffix:
+            if isinstance(groups_suffix, (dict, list)):
+                groups_suffix = ",".join(groups_suffix)
+        for perms in ("sudo", "doas"):
+            if kwargs.get(perms):
+                groups_suffix += f",{perms}"
+        if groups_suffix:
+            groups_suffix = groups_suffix.strip(",")
+            groups_msg = f" in groups: {groups_suffix}"
+            params.append(f"groups:{groups_suffix}")


As mentioned elsewhere, this does both kwarg parsing and manipulation of data types that have nothing to do with logging.

Added both Distro._user_groups_to_list and Distro._get_elevated_roles to perform that processing in Distro and avoid pushing that kwarg handling into log/security_event_log.

…p change

Also call Distro._user_groups_to_list in sec_log_user_created to avoid duplicated processing of add_user kwargs in security_event_log.

github-actions bot added the documentation This Pull Request changes documentation label Jan 26, 2026

blackboxsw requested a review from holmanb January 26, 2026 21:48

blackboxsw assigned blackboxsw and holmanb and unassigned blackboxsw Jan 26, 2026

holmanb reviewed Jan 27, 2026

View reviewed changes

holmanb added the incomplete Action required by submitter label Feb 10, 2026

github-actions bot added stale-pr Pull request is stale; will be auto-closed soon and removed stale-pr Pull request is stale; will be auto-closed soon labels Feb 25, 2026

blackboxsw force-pushed the owasp-logs-poc branch 2 times, most recently from 046db76 to e7168c0 Compare March 2, 2026 16:44

blackboxsw removed the incomplete Action required by submitter label Mar 2, 2026

blackboxsw changed the title ~~POC: Implement OWASP security logging.~~ Implement OWASP security logging. Mar 5, 2026

blackboxsw requested a review from holmanb March 5, 2026 05:19

blackboxsw added 11 commits March 5, 2026 08:43

doc: document security_log_file base config setting

e4fd5a9

feat: define decorators for sec_log_* and apply to distro methods

9b7790b

chore: revert unnecessary changes to cloudinit.util

65bf5b0

fix: security_event_log setup should only be added when absent from l…

1a56972

…ogger

feat: sec log groups, sudo and doas

46d59b5

feat: sec log groups, sudo and doas

9a1b589

chore: mypy warnings and prevent subclassing for create_user and shut…

97a816f

…down Correct type hint for netdev_info

fix: ignore down nics, support chpasswd logging

e91cc58

blackboxsw force-pushed the owasp-logs-poc branch from df1d410 to e91cc58 Compare March 5, 2026 15:52

holmanb reviewed Mar 6, 2026

View reviewed changes

blackboxsw force-pushed the owasp-logs-poc branch from 7f50e9a to 3563a87 Compare March 9, 2026 21:25

canonical deleted a comment from github-actions bot Mar 10, 2026

blackboxsw added 3 commits March 10, 2026 11:42

fix: provide mode and delay values in shutdown sec events

5233396

fix: address mypy and ai review comments

2032bd3

- drop unintended @Final from Distro.set_passwd - simplify sec_log decorators to assume positional param idx 1 when kwarg empty - drop unchecked bool return values from _post_add_user

fix: mypy errors for @Final Distro methods

967ebbd

blackboxsw requested a review from holmanb March 10, 2026 19:10

blackboxsw added 3 commits March 10, 2026 14:39

fix: pylint issues

8eafe51

fix: mypy

9aebc9b

test: add assertion on expeted host_ip

45bc3c7

blackboxsw force-pushed the owasp-logs-poc branch from e342293 to 45bc3c7 Compare March 10, 2026 21:12

holmanb reviewed Mar 10, 2026

View reviewed changes

blackboxsw added 3 commits March 11, 2026 14:42

chore: drop host_ip from owasp logs use hostname for identity instead

476f0c5

comments: typing on add_user*, decorators to use mandatory positional…

310cac1

… args

chore: refactor Distros.shutdown_command

db03c52

Add _build_shutdown_cmd which is subclassed in Alpine. Move pre-flight delay type checking into Distro.shutdown_command and call the _build_shutdown_cmd to construct the distro-specific command.

blackboxsw commented Mar 13, 2026

View reviewed changes

blackboxsw added 3 commits March 13, 2026 20:17

chore: correct _build_shutdown command call signature

573d590

fix: incorrect naming alpine._build_shutdown_cmd

289f2af

chore: add SecurityFormatter to add datetime to sec logs from record.…

46291ca

…created

blackboxsw force-pushed the owasp-logs-poc branch from 6938fbc to 46291ca Compare March 13, 2026 22:40

refactor: add helper method to process groups in kwargs

56d70f9

holmanb reviewed Mar 18, 2026

View reviewed changes

blackboxsw added 4 commits March 20, 2026 19:39

chore: drop _build_event_string and fold into _log_security_event

b1192a1

chore: type hints for plist_in

e076eec

chore: default insert cloud-init a main event actor. Remove stray dhc…

95ab64c

…p change

chore: typing of name and doc log file correction

064ba63

blackboxsw force-pushed the owasp-logs-poc branch 2 times, most recently from 0e7b9f1 to 571b53b Compare March 21, 2026 15:09

refactor: add _get_elevated_roles and wire to sec_log_user_created

a18a102

Also call Distro._user_groups_to_list in sec_log_user_created to avoid duplicated processing of add_user kwargs in security_event_log.

blackboxsw force-pushed the owasp-logs-poc branch from 571b53b to a18a102 Compare March 21, 2026 21:33

blackboxsw mentioned this pull request Mar 21, 2026

refactor: generalize Distro add_user and shutdown_command #6800

Open

2 tasks

		# Filter out None values and convert to strings
		filtered_params = [str(p) for p in params if p is not None]

Conversation

blackboxsw commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Commit Message

Additional Context

Test Steps

Merge type

Uh oh!

blackboxsw commented Jan 27, 2026

Uh oh!

holmanb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blackboxsw commented Mar 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

holmanb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

blackboxsw commented Jan 26, 2026 •

edited

Loading