C-WCOW: Runtime logging enforcement, misc cleanup

Signed-off-by: Mahati Chamarthy <mchamarthy@microsoft.com>

Author: MahatiC

cmd/gcs-sidecar/main.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"io"
 	"net"
 	"os"
 	"time"
@@ -150,7 +151,6 @@ func main() {
 		logrus.Fatal(err)
 	}
 	logrus.SetLevel(level)
-	logrus.SetOutput(logFileHandle)
 	trace.ApplyConfig(trace.Config{DefaultSampler: trace.AlwaysSample()})
 	trace.RegisterExporter(&oc.LogrusExporter{})
 
@@ -225,15 +225,17 @@ func main() {
 	case "allow":
 		initialEnforcer = &securitypolicy.OpenDoorSecurityPolicyEnforcer{}
 		logrus.Tracef("initial-policy-stance: allow")
+		logrus.SetOutput(logFileHandle)
 	case "deny":
 		initialEnforcer = &securitypolicy.ClosedDoorSecurityPolicyEnforcer{}
 		logrus.Tracef("initial-policy-stance: deny")
+		logrus.SetOutput(io.Discard)
 	default:
 		logrus.Error("unknown initial-policy-stance")
 	}
 
 	// 3. Create bridge and initializa
-	brdg := sidecar.NewBridge(shimCon, gcsCon, initialEnforcer)
+	brdg := sidecar.NewBridge(shimCon, gcsCon, initialEnforcer, logFileHandle)
 	brdg.AssignHandlers()
 
 	// 3. Listen and serve for hcsshim requests.

internal/gcs-sidecar/bridge.go

@@ -47,6 +47,9 @@ type Bridge struct {
 	// and send responses back to hcsshim respectively.
 	sendToGCSCh  chan request
 	sendToShimCh chan bridgeResponse
+
+	// logging target
+	logWriter io.Writer
 }
 
 // SequenceID is used to correlate requests and responses.
@@ -77,7 +80,7 @@ type request struct {
 	message []byte
 }
 
-func NewBridge(shimConn io.ReadWriteCloser, inboxGCSConn io.ReadWriteCloser, initialEnforcer securitypolicy.SecurityPolicyEnforcer) *Bridge {
+func NewBridge(shimConn io.ReadWriteCloser, inboxGCSConn io.ReadWriteCloser, initialEnforcer securitypolicy.SecurityPolicyEnforcer, logWriter io.Writer) *Bridge {
 	hostState := NewHost(initialEnforcer)
 	return &Bridge{
 		pending:        make(map[sequenceID]*prot.ContainerExecuteProcessResponse),
@@ -87,6 +90,7 @@ func NewBridge(shimConn io.ReadWriteCloser, inboxGCSConn io.ReadWriteCloser, ini
 		inboxGCSConn:   inboxGCSConn,
 		sendToGCSCh:    make(chan request),
 		sendToShimCh:   make(chan bridgeResponse),
+		logWriter:      logWriter,
 	}
 }