125 lines
4.3 KiB
Diff
125 lines
4.3 KiB
Diff
|
From ea87ecab21a54741e64680977521837ccaf0206b Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||
|
|
Date: Tue, 5 Oct 2021 14:33:37 +0200
|
||
|
|
Subject: [PATCH] Allow empty /proc in offline mode
|
||
|
|
|
||
|
|
When scanning offline file systems the /proc might be empty. Currently,
|
||
|
|
OpenSCAP thinks that it means a permissions problems, which is often
|
||
|
|
true if it happens on a real system, but in offline mode it can be a
|
||
|
|
normal situation. We will not consider empty /proc an error in offline
|
||
|
|
mode.
|
||
|
|
|
||
|
|
The commit also includes a simple test case.
|
||
|
|
|
||
|
|
Inspired by eda9881e08f0398d1481f133fbb56c0080cfe9f3
|
||
|
|
|
||
|
|
Resolves: RHBZ #2008922
|
||
|
|
---
|
||
|
|
src/OVAL/probes/unix/process58_probe.c | 18 ++++++++++----
|
||
|
|
tests/probes/process58/CMakeLists.txt | 1 +
|
||
|
|
tests/probes/process58/empty_proc.sh | 33 ++++++++++++++++++++++++++
|
||
|
|
3 files changed, 47 insertions(+), 5 deletions(-)
|
||
|
|
create mode 100755 tests/probes/process58/empty_proc.sh
|
||
|
|
|
||
|
|
diff --git a/src/OVAL/probes/unix/process58_probe.c b/src/OVAL/probes/unix/process58_probe.c
|
||
|
|
index d1108fc59..29c582152 100644
|
||
|
|
--- a/src/OVAL/probes/unix/process58_probe.c
|
||
|
|
+++ b/src/OVAL/probes/unix/process58_probe.c
|
||
|
|
@@ -472,7 +472,7 @@ static inline char *make_defunc_str(char* const cmd_buffer){
|
||
|
|
static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||
|
|
{
|
||
|
|
char buf[PATH_MAX];
|
||
|
|
- int err = PROBE_EACCESS, max_cap_id;
|
||
|
|
+ int max_cap_id;
|
||
|
|
DIR *d;
|
||
|
|
struct dirent *ent;
|
||
|
|
oval_schema_version_t oval_version;
|
||
|
|
@@ -501,6 +501,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||
|
|
cmd_buffer[0] = '[';
|
||
|
|
|
||
|
|
// Scan the directories
|
||
|
|
+ bool any_pid_dir_found = false;
|
||
|
|
while (( ent = readdir(d) )) {
|
||
|
|
int fd, len;
|
||
|
|
char *tmp, state, tty_dev[128];
|
||
|
|
@@ -562,9 +563,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
-
|
||
|
|
- err = PROBE_ESUCCESS; // If we get this far, no permission problems
|
||
|
|
- dI("Have command: %s", cmd);
|
||
|
|
+ any_pid_dir_found = true;
|
||
|
|
cmd_sexp = SEXP_string_newf("%s", cmd);
|
||
|
|
pid_sexp = SEXP_number_newu_32(pid);
|
||
|
|
if ((cmd_sexp == NULL || probe_entobj_cmp(cmd_ent, cmd_sexp) == OVAL_RESULT_TRUE) &&
|
||
|
|
@@ -662,7 +661,16 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||
|
|
}
|
||
|
|
closedir(d);
|
||
|
|
oscap_buffer_free(cmdline_buffer);
|
||
|
|
- return err;
|
||
|
|
+
|
||
|
|
+ if (!any_pid_dir_found) {
|
||
|
|
+ dW("No data about processes could be read from '%s'.", buf);
|
||
|
|
+ }
|
||
|
|
+ // In offline mode, empty /proc might be a normal situation and doesn't
|
||
|
|
+ // have to mean permissions problems
|
||
|
|
+ if (prefix)
|
||
|
|
+ return PROBE_ESUCCESS;
|
||
|
|
+ else
|
||
|
|
+ return any_pid_dir_found ? PROBE_ESUCCESS : PROBE_EACCESS;
|
||
|
|
}
|
||
|
|
|
||
|
|
int process58_probe_offline_mode_supported(void)
|
||
|
|
diff --git a/tests/probes/process58/CMakeLists.txt b/tests/probes/process58/CMakeLists.txt
|
||
|
|
index 17261dbb7..947665de6 100644
|
||
|
|
--- a/tests/probes/process58/CMakeLists.txt
|
||
|
|
+++ b/tests/probes/process58/CMakeLists.txt
|
||
|
|
@@ -2,6 +2,7 @@ if(ENABLE_PROBES_UNIX)
|
||
|
|
add_oscap_test("capability.sh")
|
||
|
|
add_oscap_test("command_line.sh")
|
||
|
|
add_oscap_test("dev_to_tty.sh")
|
||
|
|
+ add_oscap_test("empty_proc.sh")
|
||
|
|
add_oscap_test("loginuid.sh")
|
||
|
|
add_oscap_test("selinux_domain_label.sh")
|
||
|
|
add_oscap_test("sessionid.sh")
|
||
|
|
diff --git a/tests/probes/process58/empty_proc.sh b/tests/probes/process58/empty_proc.sh
|
||
|
|
new file mode 100755
|
||
|
|
index 000000000..2f0334b15
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/tests/probes/process58/empty_proc.sh
|
||
|
|
@@ -0,0 +1,33 @@
|
||
|
|
+#!/usr/bin/env bash
|
||
|
|
+
|
||
|
|
+# This is regression test of RHBZ #2008922
|
||
|
|
+
|
||
|
|
+set -e -o pipefail
|
||
|
|
+
|
||
|
|
+. $builddir/tests/test_common.sh
|
||
|
|
+probecheck "process58" || exit 255
|
||
|
|
+
|
||
|
|
+name=$(basename $0 .sh)
|
||
|
|
+result=$(mktemp ${name}.out.XXXXXX)
|
||
|
|
+stderr=$(mktemp ${name}.err.XXXXXX)
|
||
|
|
+
|
||
|
|
+root=$(mktemp -d)
|
||
|
|
+
|
||
|
|
+# create an empty /proc in the offline file system dir
|
||
|
|
+mkdir -p "$root/proc"
|
||
|
|
+
|
||
|
|
+export OSCAP_PROBE_ROOT="$root"
|
||
|
|
+$OSCAP oval eval --results $result $srcdir/capability.oval.xml 2> $stderr
|
||
|
|
+
|
||
|
|
+[ $? -eq 0 ]
|
||
|
|
+grep -q "^W: oscap:\s\+No data about processes could be read from '$root/proc'." "$stderr"
|
||
|
|
+grep -q "OpenSCAP Error: Probe at sd=1 (process58) reported an error: Operation not permitted" "$stderr" && false
|
||
|
|
+grep -q "W: oscap:\s\+Can't receive message: 125, Operation canceled." "$stderr" && false
|
||
|
|
+
|
||
|
|
+[ -s "$result" ]
|
||
|
|
+assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'
|
||
|
|
+assert_exists 1 '/oval_results/results/system/oval_system_characteristics/collected_objects/object[@flag="does not exist"]'
|
||
|
|
+
|
||
|
|
+rm "$stderr"
|
||
|
|
+rm "$result"
|
||
|
|
+rm -r "$root"
|