[docs] Add manpage for sos clean

Adds a manpage for `sos clean`, with a link for `sos mask`.

Updates `man sos` as well to include the options moved into the global
group as part of the SoSCleaner patchset.

Related: #1987

Signed-off-by: Jake Hunsaker <jhunsake@redhat.com>

1 files changed, 50 insertions, 0 deletions

diff --git a/man/en/sos.1 b/man/en/sos.1
index 0444dba4..af1a5287 100644
--- a/man/en/sos.1
+++ b/man/en/sos.1
@@ -49,10 +49,57 @@ See \fBsos collect --help\fR and \fBman sos-collect\fR for more information.
 May also be invoked via the alias \fBsos collector\fR or the deprecated command
 \fBsos-collector\fR.
 
+.TP
+.B clean|mask
+This subcommand takes input of either 1) an sosreport tarball, 2) a collection
+of sosreport tarballs such as from \fBcollect\fR, or 3) the unpackaged
+directory of an sosreport and obfuscates potentially sensitive system information
+that is not covered by the standard postprocessing of \fBsos report\fR.
+
+Such data includes IP addresses, networks, MAC addresses, and more. Data obfuscated
+by this command will remain consistent throughout the report and across reports provided
+in the same invocation. Additionally, care is taken to maintain network topology relationships
+between matched data items.
+
+See \fB sos clean --help\fR and \fBman sos-clean\fR for more information.
+
+May be invoked via either \fBsos clean\fR, \fBsos mask\fR, or via the \fB--clean\fR or \fB --mask\fR options
+for \fBreport\fR and \fBcollect\fR.
+
 .SH GLOBAL OPTIONS
 sos components provide their own set of options, however the following are available
 to be set across all components.
 
+.B \-\-batch
+Do not prompt interactively, user will not be prompted for any data
+.TP
+.B \--encrypt-key KEY
+Encrypts the resulting archive that sosreport produces using GPG. KEY must be
+an existing key in the user's keyring as GPG does not allow for keyfiles.
+KEY can be any value accepted by gpg's 'recipient' option.
+
+Note that the user running sosreport must match the user owning the keyring
+from which keys will be obtained. In particular this means that if sudo is
+used to run sosreport, the keyring must also be set up using sudo
+(or direct shell access to the account).
+
+Users should be aware that encrypting the final archive will result in sos
+using double the amount of temporary disk space - the encrypted archive must be
+written as a separate, rather than replacement, file within the temp directory
+that sos writes the archive to. However, since the encrypted archive will be
+the same size as the original archive, there is no additional space consumption
+once the temporary directory is removed at the end of execution.
+
+This means that only the encrypted archive is present on disk after sos
+finishes running.
+
+If encryption fails for any reason, the original unencrypted archive is
+preserved instead.
+.TP
+.B \--encrypt-pass PASS
+The same as \--encrypt-key, but use the provided PASS for symmetric encryption
+rather than key-pair encryption.
+.TP
 .B \--config-file CONFIG
 Specify alternate configuration file.
 .TP
@@ -72,6 +119,9 @@ additional debugging messages.
 .B \-q, \--quiet
 Only log fatal errors to stderr.
 .TP
+.B \-z, \-\-compression-type {auto|xz|gzip}
+Compression type to use when compression the final archive output
+.TP
 .B \--help
 Display usage message.
 .SH MAINTAINER