diff --git a/openscap-1.3.5-coverity1-PR_1617.patch b/openscap-1.3.5-coverity1-PR_1617.patch deleted file mode 100644 index ea7edcb..0000000 --- a/openscap-1.3.5-coverity1-PR_1617.patch +++ /dev/null @@ -1,162 +0,0 @@ -From 0311ac9d8368acd5baac8b7fc6f753bd895ea3fc Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Tue, 6 Oct 2020 13:32:19 +0200 -Subject: [PATCH 1/2] Fix Coverity warnings - -Addressing multiple Coverity defects similar to this one: -Defect type: CHECKED_RETURN -check_return: Calling "curl_easy_setopt(curl, _curl_opt, _curl_trace)" -without checking return value. This library function may fail and return -an error code. ---- - src/common/oscap_acquire.c | 65 +++++++++++++++++++++++++++++++------- - 1 file changed, 53 insertions(+), 12 deletions(-) - -diff --git a/src/common/oscap_acquire.c b/src/common/oscap_acquire.c -index 666f4f5c9..34a92fa19 100644 ---- a/src/common/oscap_acquire.c -+++ b/src/common/oscap_acquire.c -@@ -326,18 +326,59 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size) - return NULL; - } - -- struct oscap_buffer* buffer = oscap_buffer_new(); -- -- curl_easy_setopt(curl, CURLOPT_URL, url); -- curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory_callback); -- curl_easy_setopt(curl, CURLOPT_WRITEDATA, buffer); -- curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); -- curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, true); -- curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, true); -- curl_easy_setopt(curl, CURLOPT_VERBOSE, true); -- curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, _curl_trace); -- -- CURLcode res = curl_easy_perform(curl); -+ CURLcode res; -+ -+ res = curl_easy_setopt(curl, CURLOPT_URL, url); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_URL to '%s': %s", url, curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory_callback); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_WRITEFUNCTION to write_to_memory_callback: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_ACCEPT_ENCODING to an empty string: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, true); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_TRANSFER_ENCODING to true: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, true); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_FOLLOWLOCATION to true: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_VERBOSE, true); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_VERBOSE to true: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ res = curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, _curl_trace); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_DEBUGFUNCTION to _curl_trace: %s", curl_easy_strerror(res)); -+ return NULL; -+ } -+ -+ struct oscap_buffer *buffer = oscap_buffer_new(); -+ res = curl_easy_setopt(curl, CURLOPT_WRITEDATA, buffer); -+ if (res != 0) { -+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_WRITEDATA as buffer: %s", curl_easy_strerror(res)); -+ oscap_buffer_free(buffer); -+ return NULL; -+ } -+ -+ res = curl_easy_perform(curl); - curl_easy_cleanup(curl); - - if (res != 0) { - -From 34af1348b6ff6e4710aeb6e383b1a50c4751c16e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Mon, 26 Oct 2020 11:12:04 +0100 -Subject: [PATCH 2/2] Add curl_easy_cleanup everywhere - ---- - src/common/oscap_acquire.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/src/common/oscap_acquire.c b/src/common/oscap_acquire.c -index 34a92fa19..cd9bfc36f 100644 ---- a/src/common/oscap_acquire.c -+++ b/src/common/oscap_acquire.c -@@ -330,42 +330,49 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size) - - res = curl_easy_setopt(curl, CURLOPT_URL, url); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_URL to '%s': %s", url, curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory_callback); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_WRITEFUNCTION to write_to_memory_callback: %s", curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_ACCEPT_ENCODING to an empty string: %s", curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_TRANSFER_ENCODING, true); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_TRANSFER_ENCODING to true: %s", curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, true); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_FOLLOWLOCATION to true: %s", curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_VERBOSE, true); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_VERBOSE to true: %s", curl_easy_strerror(res)); - return NULL; - } - - res = curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, _curl_trace); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_DEBUGFUNCTION to _curl_trace: %s", curl_easy_strerror(res)); - return NULL; - } -@@ -373,6 +380,7 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size) - struct oscap_buffer *buffer = oscap_buffer_new(); - res = curl_easy_setopt(curl, CURLOPT_WRITEDATA, buffer); - if (res != 0) { -+ curl_easy_cleanup(curl); - oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_WRITEDATA as buffer: %s", curl_easy_strerror(res)); - oscap_buffer_free(buffer); - return NULL; diff --git a/openscap-1.3.5-coverity2-PR_1620.patch b/openscap-1.3.5-coverity2-PR_1620.patch deleted file mode 100644 index 404ff9c..0000000 --- a/openscap-1.3.5-coverity2-PR_1620.patch +++ /dev/null @@ -1,147 +0,0 @@ -From 538c70780b49a36a4d2420ef93b87b78817dc14c Mon Sep 17 00:00:00 2001 -From: Evgeny Kolesnikov -Date: Mon, 26 Oct 2020 08:31:53 +0100 -Subject: [PATCH] Covscan fixes - ---- - src/OVAL/probes/fsdev.c | 2 +- - src/OVAL/probes/independent/yamlfilecontent_probe.c | 5 +++-- - src/OVAL/probes/unix/fileextendedattribute_probe.c | 2 +- - src/OVAL/probes/unix/linux/partition_probe.c | 2 +- - src/OVAL/probes/unix/xinetd_probe.c | 7 ++++++- - src/XCCDF/xccdf_session.c | 4 ++-- - utils/oscap-tool.c | 6 +++++- - utils/oscap-xccdf.c | 3 +-- - 8 files changed, 20 insertions(+), 11 deletions(-) - -diff --git a/src/OVAL/probes/fsdev.c b/src/OVAL/probes/fsdev.c -index b2b984441..c82ab620b 100644 ---- a/src/OVAL/probes/fsdev.c -+++ b/src/OVAL/probes/fsdev.c -@@ -219,7 +219,7 @@ static fsdev_t *__fsdev_init(fsdev_t *lfs) - endmntent(fp); - - void *new_ids = realloc(lfs->ids, sizeof(dev_t) * i); -- if (new_ids == NULL) { -+ if (new_ids == NULL && i > 0) { - e = errno; - free(lfs->ids); - free(lfs); -diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c -index 6f18abf83..e7e6cb3f5 100644 ---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c -+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c -@@ -216,12 +216,13 @@ static int yaml_path_query(const char *filepath, const char *yaml_path_cstr, str - result_error("YAML parser error: %s", parser.problem); - goto cleanup; - } -+ -+ event_type = event.type; -+ - if (yaml_path_filter_event(yaml_path, &parser, &event) == YAML_PATH_FILTER_RESULT_OUT) { - goto next; - } - -- event_type = event.type; -- - if (sequence) { - if (event_type == YAML_SEQUENCE_END_EVENT) { - sequence = false; -diff --git a/src/OVAL/probes/unix/fileextendedattribute_probe.c b/src/OVAL/probes/unix/fileextendedattribute_probe.c -index b442ea540..ee853886a 100644 ---- a/src/OVAL/probes/unix/fileextendedattribute_probe.c -+++ b/src/OVAL/probes/unix/fileextendedattribute_probe.c -@@ -298,7 +298,7 @@ static int file_cb(const char *prefix, const char *p, const char *f, void *ptr, - - // Allocate buffer, '+1' is for trailing '\0' - void *new_xattr_val = realloc(xattr_val, sizeof(char) * (xattr_vallen + 1)); -- if (xattr_val == NULL) { -+ if (new_xattr_val == NULL) { - dE("Failed to allocate memory for xattr_val"); - free(xattr_val); - goto exit; -diff --git a/src/OVAL/probes/unix/linux/partition_probe.c b/src/OVAL/probes/unix/linux/partition_probe.c -index a74c0323a..adb244b04 100644 ---- a/src/OVAL/probes/unix/linux/partition_probe.c -+++ b/src/OVAL/probes/unix/linux/partition_probe.c -@@ -207,7 +207,7 @@ static int collect_item(probe_ctx *ctx, oval_schema_version_t over, struct mnten - mnt_ocnt = add_mnt_opt(&mnt_opts, mnt_ocnt, "move"); - } - -- dD("mnt_ocnt = %d, mnt_opts[mnt_ocnt]=%p", mnt_ocnt, mnt_opts[mnt_ocnt]); -+ dD("mnt_ocnt = %d, mnt_opts[mnt_ocnt]=%p", mnt_ocnt, mnt_opts == NULL ? NULL : mnt_opts[mnt_ocnt]); - - /* - * "Correct" the type (this won't be (hopefully) needed in a later version -diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c -index 75b12f95b..d61c7d547 100644 ---- a/src/OVAL/probes/unix/xinetd_probe.c -+++ b/src/OVAL/probes/unix/xinetd_probe.c -@@ -566,7 +566,12 @@ static int xiconf_add_cfile(xiconf_t *xiconf, const char *path, int depth) - } - - xifile->depth = depth; -- xiconf->cfile = realloc(xiconf->cfile, sizeof(xiconf_file_t *) * ++xiconf->count); -+ void *cfile = realloc(xiconf->cfile, sizeof(xiconf_file_t *) * ++xiconf->count); -+ if (cfile == NULL) { -+ dE("Failed re-allocate memory for cfile"); -+ return (-1); -+ } -+ xiconf->cfile = cfile; - xiconf->cfile[xiconf->count - 1] = xifile; - - dD("Added new file to the cfile queue: %s; fi=%zu", path, xiconf->count - 1); -diff --git a/src/XCCDF/xccdf_session.c b/src/XCCDF/xccdf_session.c -index 8bd394e2f..f1b837959 100644 ---- a/src/XCCDF/xccdf_session.c -+++ b/src/XCCDF/xccdf_session.c -@@ -286,9 +286,9 @@ static struct oscap_source *xccdf_session_extract_arf_source(struct xccdf_sessio - } - struct tm *tm_mtime = malloc(sizeof(struct tm)); - #ifdef OS_WINDOWS -- tm_mtime = localtime_s(tm_mtime, &file_stat.st_mtime); -+ localtime_s(tm_mtime, &file_stat.st_mtime); - #else -- tm_mtime = localtime_r(&file_stat.st_mtime, tm_mtime); -+ localtime_r(&file_stat.st_mtime, tm_mtime); - #endif - strftime(tailoring_doc_timestamp, max_timestamp_len, - "%Y-%m-%dT%H:%M:%S", tm_mtime); -diff --git a/utils/oscap-tool.c b/utils/oscap-tool.c -index 9bfe52697..660a19047 100644 ---- a/utils/oscap-tool.c -+++ b/utils/oscap-tool.c -@@ -315,7 +315,10 @@ static void getopt_parse_env(struct oscap_module *module, int *argc, char ***arg - opt = oscap_strtok_r(opts, delim, &state); - while (opt != NULL) { - eargc++; -- eargv = realloc(eargv, eargc * sizeof(char *)); -+ void *new_eargv = realloc(eargv, eargc * sizeof(char *)); -+ if (new_eargv == NULL) -+ goto exit; -+ eargv = new_eargv; - eargv[eargc - 1] = strdup(opt); - opt = oscap_strtok_r(NULL, delim, &state); - } -@@ -334,6 +337,7 @@ static void getopt_parse_env(struct oscap_module *module, int *argc, char ***arg - - *argc = nargc; - *argv = nargv; -+exit: - free(opts); - free(eargv); - } -diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c -index af337b844..0a9ae5270 100644 ---- a/utils/oscap-xccdf.c -+++ b/utils/oscap-xccdf.c -@@ -610,8 +610,7 @@ int app_evaluate_xccdf(const struct oscap_action *action) - - /* syslog message */ - #if defined(HAVE_SYSLOG_H) -- syslog(priority, "Evaluation finished. Return code: %d, Base score %f.", evaluation_result, -- session == NULL ? 0 : xccdf_session_get_base_score(session)); -+ syslog(priority, "Evaluation finished. Return code: %d, Base score %f.", evaluation_result, xccdf_session_get_base_score(session)); - #endif - - xccdf_session_set_xccdf_export(session, action->f_results); diff --git a/openscap-1.3.5-plug-memory-leak-PR_1616.patch b/openscap-1.3.5-plug-memory-leak-PR_1616.patch deleted file mode 100644 index 8c8f4cf..0000000 --- a/openscap-1.3.5-plug-memory-leak-PR_1616.patch +++ /dev/null @@ -1,71 +0,0 @@ -From d5518f3f4c32ac19fcf3427602d5b2978b7ef1b4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Mon, 5 Oct 2020 16:02:29 +0200 -Subject: [PATCH] Plug a memory leak - -Addressing: - -8 bytes in 1 blocks are indirectly lost in loss record 7 of 235 - at 0x483A809: malloc (vg_replace_malloc.c:307) - by 0x48F15CA: oval_collection_new (oval_collection.c:64) - by 0x48F4FCC: oval_result_criteria_node_new (oval_resultCriteriaNode.c:106) - by 0x48F5580: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:249) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F7F41: oval_result_system_get_new_definition_with_check (oval_resultSystem.c:217) - by 0x48F5686: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:279) - by 0x48F55BD: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:260) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F8794: oval_result_system_prepare_definition (oval_resultSystem.c:395) - by 0x48F86A6: oval_result_system_eval_definition (oval_resultSystem.c:369) - by 0x48C23FD: oval_agent_eval_definition (oval_agent.c:181) - -8 bytes in 1 blocks are definitely lost in loss record 8 of 235 - at 0x483A809: malloc (vg_replace_malloc.c:307) - by 0x48F1799: oval_collection_iterator (oval_collection.c:120) - by 0x48CCE4C: oval_criteria_node_get_subnodes (oval_criteriaNode.c:161) - by 0x48F5590: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:255) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F7F41: oval_result_system_get_new_definition_with_check (oval_resultSystem.c:217) - by 0x48F5686: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:279) - by 0x48F55BD: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:260) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F8794: oval_result_system_prepare_definition (oval_resultSystem.c:395) - by 0x48F86A6: oval_result_system_eval_definition (oval_resultSystem.c:369) - by 0x48C23FD: oval_agent_eval_definition (oval_agent.c:181) - -48 (40 direct, 8 indirect) bytes in 1 blocks are definitely lost in loss record 125 of 235 - at 0x483A809: malloc (vg_replace_malloc.c:307) - by 0x48F4F50: oval_result_criteria_node_new (oval_resultCriteriaNode.c:98) - by 0x48F5580: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:249) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F7F41: oval_result_system_get_new_definition_with_check (oval_resultSystem.c:217) - by 0x48F5686: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:279) - by 0x48F55BD: make_result_criteria_node_from_oval_criteria_node (oval_resultCriteriaNode.c:260) - by 0x48F6B51: make_result_definition_from_oval_definition (oval_resultDefinition.c:130) - by 0x48F8794: oval_result_system_prepare_definition (oval_resultSystem.c:395) - by 0x48F86A6: oval_result_system_eval_definition (oval_resultSystem.c:369) - by 0x48C23FD: oval_agent_eval_definition (oval_agent.c:181) - by 0x48C2671: oval_agent_eval_system (oval_agent.c:286) - -This leak has been created by #1610. ---- - src/OVAL/results/oval_resultCriteriaNode.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/OVAL/results/oval_resultCriteriaNode.c b/src/OVAL/results/oval_resultCriteriaNode.c -index 807283206..f6e980861 100644 ---- a/src/OVAL/results/oval_resultCriteriaNode.c -+++ b/src/OVAL/results/oval_resultCriteriaNode.c -@@ -258,8 +258,11 @@ struct oval_result_criteria_node *make_result_criteria_node_from_oval_criteria_n - = oval_criteria_node_iterator_next(oval_subnodes); - struct oval_result_criteria_node *rslt_subnode - = make_result_criteria_node_from_oval_criteria_node(sys, oval_subnode, visited_definitions, variable_instance); -- if (rslt_subnode == NULL) -+ if (rslt_subnode == NULL) { -+ oval_criteria_node_iterator_free(oval_subnodes); -+ oval_result_criteria_node_free(rslt_node); - return NULL; -+ } - oval_result_criteria_node_add_subnode(rslt_node, rslt_subnode); - } - oval_criteria_node_iterator_free(oval_subnodes); diff --git a/openscap-1.3.5-yamlfilecontent-fix-field-names-PR_1619.patch b/openscap-1.3.5-yamlfilecontent-fix-field-names-PR_1619.patch deleted file mode 100644 index 7d39e31..0000000 --- a/openscap-1.3.5-yamlfilecontent-fix-field-names-PR_1619.patch +++ /dev/null @@ -1,67 +0,0 @@ -diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c -index 6f18abf83..17741a240 100644 ---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c -+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c -@@ -206,6 +206,7 @@ static int yaml_path_query(const char *filepath, const char *yaml_path_cstr, str - yaml_event_type_t event_type; - bool sequence = false; - bool mapping = false; -+ bool fake_mapping = false; - int index = 0; - char *key = strdup("#"); - -@@ -224,21 +225,39 @@ static int yaml_path_query(const char *filepath, const char *yaml_path_cstr, str - - if (sequence) { - if (event_type == YAML_SEQUENCE_END_EVENT) { -- sequence = false; -+ if (fake_mapping) { -+ fake_mapping = false; -+ if (record && record->itemcount > 0) { -+ oscap_list_add(values, record); -+ } else { -+ // Do not collect empty records -+ oscap_htable_free0(record); -+ } -+ record = NULL; -+ } else { -+ sequence = false; -+ } - } else if (event_type == YAML_SEQUENCE_START_EVENT) { -- result_error("YAML path '%s' points to a multi-dimensional structure (sequence containing another sequence)", yaml_path_cstr); -- goto cleanup; -+ if (mapping || fake_mapping) { -+ result_error("YAML path '%s' points to a multi-dimensional structure (a map or a sequence containing other sequences)", yaml_path_cstr); -+ goto cleanup; -+ } else { -+ fake_mapping = true; -+ record = oscap_htable_new(); -+ } - } - } else { - if (event_type == YAML_SEQUENCE_START_EVENT) { - sequence = true; -+ if (mapping) -+ index++; - } - } - - if (mapping) { - if (event_type == YAML_MAPPING_END_EVENT) { - mapping = false; -- if (record->itemcount > 0) { -+ if (record && record->itemcount > 0) { - oscap_list_add(values, record); - } else { - // Do not collect empty records -@@ -255,6 +274,10 @@ static int yaml_path_query(const char *filepath, const char *yaml_path_cstr, str - result_error("YAML path '%s' points to an invalid structure (map containing another map)", yaml_path_cstr); - goto cleanup; - } -+ if (fake_mapping) { -+ result_error("YAML path '%s' points to a multi-dimensional structure (two-dimensional sequence containing a map)", yaml_path_cstr); -+ goto cleanup; -+ } - mapping = true; - sequence = false; - index = 0; diff --git a/openscap-1.3.6-replace-getlogin-pr-1753.patch b/openscap-1.3.6-replace-getlogin-pr-1753.patch new file mode 100644 index 0000000..a63f094 --- /dev/null +++ b/openscap-1.3.6-replace-getlogin-pr-1753.patch @@ -0,0 +1,36 @@ +From b31cff1bc3a298cfa36a10476f2d633c290b6741 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Tue, 11 May 2021 13:20:18 +0200 +Subject: [PATCH] Replace getlogin by cuserid + +The getlogin() is used here to fill in the xccdf:identity element which +shall contain information about the system identity or user employed +during application of the benchmark. But, the getlogin() can return NULL +when there is no controlling terminal. This happened when testing oscap +on a test system with no pty. As an alternative, the system provides +also cuserid() function which gets the effective user ID of the process. +However, these 2 values differ when the program is executed under sudo. +From the user experience point of view, it would be better to have +displayed there the user logged in on the controlling terminal. As a +compromise, we will first attempt to obtain the name using getlogin() +and if that fails we will run cuserid(). +--- + src/XCCDF/result.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c +index cd03e6bd8f..cbe016c44a 100644 +--- a/src/XCCDF/result.c ++++ b/src/XCCDF/result.c +@@ -217,7 +217,10 @@ static inline void _xccdf_result_fill_identity(struct xccdf_result *result) + xccdf_identity_set_authenticated(id, 0); + xccdf_identity_set_privileged(id, 0); + #ifdef OSCAP_UNIX +- xccdf_identity_set_name(id, getlogin()); ++ char *name = getlogin(); ++ if (name == NULL) ++ name = cuserid(NULL); ++ xccdf_identity_set_name(id, name); + #elif defined(OS_WINDOWS) + GetUserName((TCHAR *) w32_username, &w32_usernamesize); /* XXX: Check the return value? */ + xccdf_identity_set_name(id, w32_username); diff --git a/openscap-1.3.6-waive-hugetables-pr-1745.patch b/openscap-1.3.6-waive-hugetables-pr-1745.patch new file mode 100644 index 0000000..4272a78 --- /dev/null +++ b/openscap-1.3.6-waive-hugetables-pr-1745.patch @@ -0,0 +1,43 @@ +From 192f908562779fe4c9b7e5cc7605840976a06c85 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Mon, 26 Apr 2021 13:13:26 +0200 +Subject: [PATCH] Waive the known issue with hugepages on ppc64/ppc64le + +The known issue has been reported in +https://bugzilla.redhat.com/show_bug.cgi?id=1642995 + +This modification is currently applied as a patch applied during setup +phase of Sanity/smoke-test in Fedora CI gating. +https://src.fedoraproject.org/tests/openscap/blob/main/f/Sanity/smoke-test +The patched file got changed recetly so the patch doesn't apply anymore +which causes the Rawhide gating to fail. +We have decided to propose the change to upstream to avoid the need +for modifying the patch in the tests and to prevent similar problems +in the future. +--- + tests/probes/sysctl/test_sysctl_probe_all.sh | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/tests/probes/sysctl/test_sysctl_probe_all.sh b/tests/probes/sysctl/test_sysctl_probe_all.sh +index 2280ff7ae..c79d7ed18 100755 +--- a/tests/probes/sysctl/test_sysctl_probe_all.sh ++++ b/tests/probes/sysctl/test_sysctl_probe_all.sh +@@ -73,6 +73,10 @@ if [ "$procps_ver" != "$lowest_ver" ]; then + sed -i '/.*vm.stat_refresh/d' "$sysctlNames" + fi + ++if ! grep -q "hugepages" "$ourNames"; then ++ sed -i "/^.*hugepages.*$/d" "$sysctlNames" ++fi ++ + echo "Diff (sysctlNames / ourNames): ------" + diff "$sysctlNames" "$ourNames" + echo "-------------------------------------" +@@ -84,6 +88,7 @@ sed -i -E "/^E: oscap: +Can't read sysctl value from /d" "$stderr" + # that can't fit into 8K buffer and result in errno 14 + # (for example /proc/sys/kernel/spl/hostid could be the case) + sed -i -E "/^E: oscap: +An error.*14, Bad address/d" "$stderr" ++sed -i "/^.*hugepages.*$/d" "$stderr" + + echo "Errors (without messages related to permissions):" + cat "$stderr" diff --git a/openscap.spec b/openscap.spec index f0bce87..a462f5e 100644 --- a/openscap.spec +++ b/openscap.spec @@ -1,15 +1,13 @@ Name: openscap -Version: 1.3.4 -Release: 4%{?dist} +Version: 1.3.5 +Release: 1%{?dist} Epoch: 1 Summary: Set of open source libraries enabling integration of the SCAP line of standards License: LGPLv2+ URL: http://www.open-scap.org/ Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz -Patch1: openscap-1.3.5-plug-memory-leak-PR_1616.patch -Patch2: openscap-1.3.5-coverity1-PR_1617.patch -Patch3: openscap-1.3.5-coverity2-PR_1620.patch -Patch4: openscap-1.3.5-yamlfilecontent-fix-field-names-PR_1619.patch +Patch1: openscap-1.3.6-waive-hugetables-pr-1745.patch +Patch2: openscap-1.3.6-replace-getlogin-pr-1753.patch BuildRequires: cmake >= 2.6 BuildRequires: gcc BuildRequires: gcc-c++ @@ -27,6 +25,7 @@ BuildRequires: openldap-devel BuildRequires: glib2-devel BuildRequires: dbus-devel BuildRequires: libyaml-devel +BuildRequires: xmlsec1-devel xmlsec1-openssl-devel %if %{?_with_check:1}%{!?_with_check:0} BuildRequires: perl-XML-XPath BuildRequires: bzip2 @@ -43,6 +42,7 @@ Requires: openldap Requires: popt # Fedora has procps-ng, which provides procps Requires: procps +Requires: xmlsec1 xmlsec1-openssl %description OpenSCAP is a set of open source libraries providing an easier path @@ -203,6 +203,9 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm %{_mandir}/man8/oscap-podman.8* %changelog +* Fri Apr 23 2021 Jan Černý - 1:1.3.5-1 +- Update to the latest upstream release + * Fri Apr 16 2021 Mohan Boddu - 1:1.3.4-4 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 diff --git a/sources b/sources index 3a07ce7..66eb0b0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openscap-1.3.4.tar.gz) = 686dbae35fa7b3a3fcb05b0e8babc15249b1830b61388d57b4107507c3a133b9c87a8d32bdd7a796c2726f13774a706b8ed0c9bab158f98eaebec7859fc96755 +SHA512 (openscap-1.3.5.tar.gz) = 896d7b1e4552cba936dba70f186c3e3c5696d9ccb020ab5f18d8ac08de403f236b1651682da9711ed4721c365db9de7dacd3fce5d0fa467c15c16addef1055db