entry_mutator: keep trusted fields when stripping underscores - #146
Merged
Merged
Conversation
Watson1978
reviewed
Sep 17, 2026
Journald reserves the leading underscore for trusted fields, which a client cannot forge, but a client is free to send a user field with the same name minus the underscore. With `fields_strip_underscores true`, both names turned into the same key. Before: the trusted `_SYSTEMD_UNIT` and a client supplied `SYSTEMD_UNIT` were joined into one `SYSTEMD_UNIT` value, so any local process could hide its own value inside trusted journal metadata. After: the trusted field keeps the stripped name and the user field of that name is dropped. A trusted field that `field_map` sends to another name does not reserve the stripped name, so nothing is lost there. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
Co-authored-by: Shizuo Fujita <fujita@clear-code.com> Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
Contributor
|
Sorry, the suggestion could not carry the two lines outside the hunk, so applying it left them out. The following changes will be solve require 'fluent/config/error'
+require 'systemd/journal/fields'
module Fluent
module Plugin
@@
- class SystemdEntryMutator
+ class SystemdEntryMutator # rubocop:disable Metrics/ClassLength
+ TRUSTED_FIELDS = (Systemd::Journal::TRUSTED_FIELDS + Systemd::Journal::KERNEL_FIELDS).freeze
+
Options = Struct.new( |
kenhys
force-pushed
the
fix-trusted-field-collision
branch
from
September 17, 2026 02:21
4fd0dca to
f0ec906
Compare
Watson1978
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Journald reserves the leading underscore for trusted fields, which a client cannot forge, but a client is free to send a user field with the same name minus the underscore. With
fields_strip_underscores true, both names turned into the same key.Before:
the trusted
_SYSTEMD_UNITand a client suppliedSYSTEMD_UNITwere joined into oneSYSTEMD_UNITvalue, so any local process could hide its own value inside trusted journal metadata.After:
the trusted field keeps the stripped name and the user field of that name is dropped. A trusted field that
field_mapsends to another name does not reserve the stripped name, so nothing is lost there.