Backport postinst for LP: #2013967

1 files changed, 45 insertions, 0 deletions

diff --git a/debian/cloud-init.postinst b/debian/cloud-init.postinst
index 69f53c0c..36b0c986 100644
--- a/debian/cloud-init.postinst
+++ b/debian/cloud-init.postinst
@@ -334,6 +334,49 @@ change_cloud_init_output_log_permissions() {
     fi
 }
 
+fix_lp2013967() {
+    # Ensure sensitive user data and vendor data gets redacted from instance-data.json
+    local oldver="$1" last_bad_ver="21.1-19-gbad84ad4-0ubuntu1~16.04.2"
+    dpkg --compare-versions "$oldver" le-nl "$last_bad_ver" || return 0
+
+    if ! python3 -c '
+import json
+import os
+from pathlib import Path
+
+from cloudinit.atomic_helper import write_json
+from cloudinit.sources import (
+    DataSource,
+    process_instance_metadata,
+    redact_sensitive_keys,
+)
+from cloudinit.stages import Init
+
+init = Init()
+log_file = init.cfg["def_log_file"]
+if os.path.exists(log_file):
+    os.chmod(log_file, 0o640)
+
+rundir = init.paths.run_dir
+instance_data_path = Path(rundir, "instance-data.json")
+
+instance_json = json.load(instance_data_path.open(encoding="utf-8"))
+
+sensitive_keys = DataSource.sensitive_metadata_keys
+
+processed_json = process_instance_metadata(
+    instance_json, sensitive_keys=sensitive_keys
+)
+redacted_json = redact_sensitive_keys(processed_json)
+
+write_json(str(instance_data_path), redacted_json)' >/dev/null 2>&1; then
+        # instance-data.json will get regenerated on boot. Try to remove it for now and signal reboot required.
+        rm -f /run/cloud-init/instance-data.json
+        [ -x /usr/share/update-notifier/notify-reboot-required ] && \
+            /usr/share/update-notifier/notify-reboot-required || true
+    fi
+}
+
 
 if [ "$1" = "configure" ]; then
    # disable ureadahead (LP: #499520)
@@ -368,6 +411,8 @@ EOF
 
    fix_lp1889555 "$2"
    change_cloud_init_output_log_permissions "$2"
+
+   fix_lp2013967 "$2"
 fi
 
 #DEBHELPER#