import openscap-1.3.6-3.el8
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
143455d816
commit
5c937baa4a
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/openscap-1.3.5.tar.gz
|
||||
SOURCES/openscap-1.3.6.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
77494383980082f8bc625a6e196a6760d30a5107 SOURCES/openscap-1.3.5.tar.gz
|
||||
8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz
|
||||
|
||||
@ -1,43 +0,0 @@
|
||||
From 192f908562779fe4c9b7e5cc7605840976a06c85 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Mon, 26 Apr 2021 13:13:26 +0200
|
||||
Subject: [PATCH] Waive the known issue with hugepages on ppc64/ppc64le
|
||||
|
||||
The known issue has been reported in
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=1642995
|
||||
|
||||
This modification is currently applied as a patch applied during setup
|
||||
phase of Sanity/smoke-test in Fedora CI gating.
|
||||
https://src.fedoraproject.org/tests/openscap/blob/main/f/Sanity/smoke-test
|
||||
The patched file got changed recetly so the patch doesn't apply anymore
|
||||
which causes the Rawhide gating to fail.
|
||||
We have decided to propose the change to upstream to avoid the need
|
||||
for modifying the patch in the tests and to prevent similar problems
|
||||
in the future.
|
||||
---
|
||||
tests/probes/sysctl/test_sysctl_probe_all.sh | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/tests/probes/sysctl/test_sysctl_probe_all.sh b/tests/probes/sysctl/test_sysctl_probe_all.sh
|
||||
index 2280ff7ae..c79d7ed18 100755
|
||||
--- a/tests/probes/sysctl/test_sysctl_probe_all.sh
|
||||
+++ b/tests/probes/sysctl/test_sysctl_probe_all.sh
|
||||
@@ -73,6 +73,10 @@ if [ "$procps_ver" != "$lowest_ver" ]; then
|
||||
sed -i '/.*vm.stat_refresh/d' "$sysctlNames"
|
||||
fi
|
||||
|
||||
+if ! grep -q "hugepages" "$ourNames"; then
|
||||
+ sed -i "/^.*hugepages.*$/d" "$sysctlNames"
|
||||
+fi
|
||||
+
|
||||
echo "Diff (sysctlNames / ourNames): ------"
|
||||
diff "$sysctlNames" "$ourNames"
|
||||
echo "-------------------------------------"
|
||||
@@ -84,6 +88,7 @@ sed -i -E "/^E: oscap: +Can't read sysctl value from /d" "$stderr"
|
||||
# that can't fit into 8K buffer and result in errno 14
|
||||
# (for example /proc/sys/kernel/spl/hostid could be the case)
|
||||
sed -i -E "/^E: oscap: +An error.*14, Bad address/d" "$stderr"
|
||||
+sed -i "/^.*hugepages.*$/d" "$stderr"
|
||||
|
||||
echo "Errors (without messages related to permissions):"
|
||||
cat "$stderr"
|
||||
@ -1,52 +0,0 @@
|
||||
From 378ef5e438a2f5af7a50374d2bd23bdd3403201f Mon Sep 17 00:00:00 2001
|
||||
From: Evgeny Kolesnikov <ekolesni@redhat.com>
|
||||
Date: Tue, 4 May 2021 08:41:06 +0200
|
||||
Subject: [PATCH] Fix covscan-reported issues in yamlfilecontent probe and
|
||||
schematron
|
||||
|
||||
Error: FORWARD_NULL (CWE-476): [#def1]
|
||||
/OVAL/probes/independent/yamlfilecontent_probe.c:392: var_compare_op: Comparing "yaml_file" to null implies that "yaml_file" might be null.
|
||||
/OVAL/probes/independent/yamlfilecontent_probe.c:417: var_deref_model: Passing null pointer "yaml_file" to "fclose", which dereferences it.
|
||||
# 416| cleanup:
|
||||
# 417|-> fclose(yaml_file);
|
||||
# 418| yaml_parser_delete(&parser);
|
||||
|
||||
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
|
||||
/source/schematron.c:549: alloc_fn: Storage is returned from allocation function "xmlXPathNodeEval".
|
||||
/source/schematron.c:549: var_assign: Assigning: "component_refs" = storage returned from "xmlXPathNodeEval(data_stream_node, (xmlChar *)"ds:checklists/ds:component-ref", context)".
|
||||
/source/schematron.c:551: leaked_storage: Variable "component_refs" going out of scope leaks the storage it points to.
|
||||
# 550| if (component_refs == NULL || component_refs->nodesetval == NULL) {
|
||||
# 551|-> return res;
|
||||
# 552| }
|
||||
---
|
||||
src/OVAL/probes/independent/yamlfilecontent_probe.c | 3 ++-
|
||||
src/source/schematron.c | 2 ++
|
||||
2 files changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
index ed5ce0d68..62a8f4ff2 100644
|
||||
--- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
@@ -414,7 +414,8 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f
|
||||
}
|
||||
|
||||
cleanup:
|
||||
- fclose(yaml_file);
|
||||
+ if (yaml_file != NULL)
|
||||
+ fclose(yaml_file);
|
||||
yaml_parser_delete(&parser);
|
||||
free(filepath_with_prefix);
|
||||
free(filepath);
|
||||
diff --git a/src/source/schematron.c b/src/source/schematron.c
|
||||
index 6cb22658b..c32d5aed6 100644
|
||||
--- a/src/source/schematron.c
|
||||
+++ b/src/source/schematron.c
|
||||
@@ -548,6 +548,8 @@ static bool _req_src_346_1_sub1(xmlNodePtr data_stream_node, xmlXPathContextPtr
|
||||
/* every $m in ds:checklists/ds:component-ref satisfies ... */
|
||||
xmlXPathObjectPtr component_refs = xmlXPathNodeEval(data_stream_node, BAD_CAST "ds:checklists/ds:component-ref", context);
|
||||
if (component_refs == NULL || component_refs->nodesetval == NULL) {
|
||||
+ if (component_refs != NULL)
|
||||
+ xmlXPathFreeObject(component_refs);
|
||||
return res;
|
||||
}
|
||||
for (int i = 0; i < component_refs->nodesetval->nodeNr; i++) {
|
||||
@ -1,64 +0,0 @@
|
||||
From 5f0a9033b466d929613a2a55a1524ec75c09b5b0 Mon Sep 17 00:00:00 2001
|
||||
From: Evgeny Kolesnikov <ekolesni@redhat.com>
|
||||
Date: Thu, 6 May 2021 08:14:12 +0200
|
||||
Subject: [PATCH] Introduce OSBuild Blueprint fix type
|
||||
|
||||
---
|
||||
utils/oscap-xccdf.c | 7 +++++--
|
||||
utils/oscap.8 | 2 +-
|
||||
xsl/xccdf-share.xsl | 1 +
|
||||
3 files changed, 7 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c
|
||||
index 95c1c7658d..801e54fa35 100644
|
||||
--- a/utils/oscap-xccdf.c
|
||||
+++ b/utils/oscap-xccdf.c
|
||||
@@ -275,7 +275,8 @@ static struct oscap_module XCCDF_GEN_FIX = {
|
||||
.usage = "[options] xccdf-file.xml",
|
||||
.help = GEN_OPTS
|
||||
"\nFix Options:\n"
|
||||
- " --fix-type <type> - Fix type. Should be one of: bash, ansible, puppet, anaconda (default: bash).\n"
|
||||
+ " --fix-type <type> - Fix type. Should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes,\n"
|
||||
+ " blueprint (default: bash).\n"
|
||||
" --output <file> - Write the script into file.\n"
|
||||
" --result-id <id> - Fixes will be generated for failed rule-results of the specified TestResult.\n"
|
||||
" --template <id|filename> - Fix template. (default: bash)\n"
|
||||
@@ -887,10 +888,12 @@ int app_generate_fix(const struct oscap_action *action)
|
||||
template = "urn:xccdf:fix:script:ignition";
|
||||
} else if (strcmp(action->fix_type, "kubernetes") == 0) {
|
||||
template = "urn:xccdf:fix:script:kubernetes";
|
||||
+ } else if (strcmp(action->fix_type, "blueprint") == 0) {
|
||||
+ template = "urn:redhat:osbuild:blueprint";
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
"Unknown fix type '%s'.\n"
|
||||
- "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes.\n"
|
||||
+ "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint.\n"
|
||||
"Or provide a custom template using '--template' instead.\n",
|
||||
action->fix_type);
|
||||
return OSCAP_ERROR;
|
||||
diff --git a/utils/oscap.8 b/utils/oscap.8
|
||||
index 240b829d7b..6cae0ffe8a 100644
|
||||
--- a/utils/oscap.8
|
||||
+++ b/utils/oscap.8
|
||||
@@ -395,7 +395,7 @@ Result-oriented fixes are generated using result-id provided to select only the
|
||||
Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes.
|
||||
.TP
|
||||
\fB\-\-fix-type TYPE\fR
|
||||
-Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
|
||||
+Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
|
||||
.TP
|
||||
\fB\-\-output FILE\fR
|
||||
Write the report to this file instead of standard output.
|
||||
diff --git a/xsl/xccdf-share.xsl b/xsl/xccdf-share.xsl
|
||||
index 9f8e587676..d7a9f3b7e2 100644
|
||||
--- a/xsl/xccdf-share.xsl
|
||||
+++ b/xsl/xccdf-share.xsl
|
||||
@@ -295,6 +295,7 @@ Authors:
|
||||
<xsl:when test="$fix/@system = 'urn:xccdf:fix:script:puppet'">Puppet snippet</xsl:when>
|
||||
<xsl:when test="$fix/@system = 'urn:redhat:anaconda:pre'">Anaconda snippet</xsl:when>
|
||||
<xsl:when test="$fix/@system = 'urn:xccdf:fix:script:kubernetes'">Kubernetes snippet</xsl:when>
|
||||
+ <xsl:when test="$fix/@system = 'urn:redhat:osbuild:blueprint'">OSBuild Blueprint snippet</xsl:when>
|
||||
<xsl:otherwise>script</xsl:otherwise>
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
@ -1,36 +0,0 @@
|
||||
From b31cff1bc3a298cfa36a10476f2d633c290b6741 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 11 May 2021 13:20:18 +0200
|
||||
Subject: [PATCH] Replace getlogin by cuserid
|
||||
|
||||
The getlogin() is used here to fill in the xccdf:identity element which
|
||||
shall contain information about the system identity or user employed
|
||||
during application of the benchmark. But, the getlogin() can return NULL
|
||||
when there is no controlling terminal. This happened when testing oscap
|
||||
on a test system with no pty. As an alternative, the system provides
|
||||
also cuserid() function which gets the effective user ID of the process.
|
||||
However, these 2 values differ when the program is executed under sudo.
|
||||
From the user experience point of view, it would be better to have
|
||||
displayed there the user logged in on the controlling terminal. As a
|
||||
compromise, we will first attempt to obtain the name using getlogin()
|
||||
and if that fails we will run cuserid().
|
||||
---
|
||||
src/XCCDF/result.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c
|
||||
index cd03e6bd8f..cbe016c44a 100644
|
||||
--- a/src/XCCDF/result.c
|
||||
+++ b/src/XCCDF/result.c
|
||||
@@ -217,7 +217,10 @@ static inline void _xccdf_result_fill_identity(struct xccdf_result *result)
|
||||
xccdf_identity_set_authenticated(id, 0);
|
||||
xccdf_identity_set_privileged(id, 0);
|
||||
#ifdef OSCAP_UNIX
|
||||
- xccdf_identity_set_name(id, getlogin());
|
||||
+ char *name = getlogin();
|
||||
+ if (name == NULL)
|
||||
+ name = cuserid(NULL);
|
||||
+ xccdf_identity_set_name(id, name);
|
||||
#elif defined(OS_WINDOWS)
|
||||
GetUserName((TCHAR *) w32_username, &w32_usernamesize); /* XXX: Check the return value? */
|
||||
xccdf_identity_set_name(id, w32_username);
|
||||
@ -1,150 +0,0 @@
|
||||
From 89f99834ba183284a7d75835932a0c0ea4eb9007 Mon Sep 17 00:00:00 2001
|
||||
From: Evgeny Kolesnikov <ekolesni@redhat.com>
|
||||
Date: Mon, 17 May 2021 08:40:17 +0200
|
||||
Subject: [PATCH] oval/yamlfilecontent: Add 'null' values handling
|
||||
|
||||
For now null values would be represented as string '(null)' as
|
||||
record's field could not be attributed as nil="true" yet.
|
||||
---
|
||||
.../independent/yamlfilecontent_probe.c | 9 ++++
|
||||
.../test_probes_yamlfilecontent_types.sh | 5 ++
|
||||
.../test_probes_yamlfilecontent_types.xml | 52 +++++++++++++++++++
|
||||
tests/probes/yamlfilecontent/types.yaml | 4 ++
|
||||
4 files changed, 70 insertions(+)
|
||||
|
||||
diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
index 62a8f4ff29..2d0cac6991 100644
|
||||
--- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
||||
@@ -41,6 +41,7 @@
|
||||
#define OSCAP_YAML_BOOL_TAG "tag:yaml.org,2002:bool"
|
||||
#define OSCAP_YAML_FLOAT_TAG "tag:yaml.org,2002:float"
|
||||
#define OSCAP_YAML_INT_TAG "tag:yaml.org,2002:int"
|
||||
+#define OSCAP_YAML_NULL_TAG "tag:yaml.org,2002:null"
|
||||
|
||||
#define OVECCOUNT 30 /* should be a multiple of 3 */
|
||||
|
||||
@@ -135,6 +136,14 @@ static SEXP_t *yaml_scalar_event_to_sexp(yaml_event_t *event)
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
+ if (question || !strcmp(tag, OSCAP_YAML_NULL_TAG)) {
|
||||
+ if (match_regex("^(null|Null|NULL|~|)$", value)) {
|
||||
+ // TODO: Return real NULL when record's field will support nil="true"
|
||||
+ return SEXP_string_new("(null)", strlen("(null)"));
|
||||
+ } else if (!question) {
|
||||
+ return NULL;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
return SEXP_string_new(value, strlen(value));
|
||||
}
|
||||
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
|
||||
index 4f110f6eb7..e445771d03 100755
|
||||
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
|
||||
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
|
||||
@@ -60,6 +60,11 @@ function test_probes_yamlfilecontent_types {
|
||||
assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="boolean" and text()="true"]'
|
||||
# string_number
|
||||
assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="int" and text()="81"]'
|
||||
+ # string_null
|
||||
+ assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="null"]'
|
||||
+
|
||||
+ # null_1_2_3
|
||||
+ assert_exists 3 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="(null)"]'
|
||||
|
||||
# bool_error_cast, int_error_cast, float_error_cast
|
||||
co='/oval_results/results/system/oval_system_characteristics/collected_objects'
|
||||
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
|
||||
index adf96571b8..503ec2d4a4 100644
|
||||
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
|
||||
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
|
||||
@@ -262,6 +262,19 @@
|
||||
</criteria>
|
||||
</definition>
|
||||
|
||||
+ <definition class="compliance" version="1" id="oval:0:def:26">
|
||||
+ <metadata>
|
||||
+ <title></title>
|
||||
+ <description></description>
|
||||
+ </metadata>
|
||||
+ <criteria operator="AND">
|
||||
+ <criterion comment="comment" test_ref="oval:0:tst:26"/>
|
||||
+ <criterion comment="comment" test_ref="oval:0:tst:27"/>
|
||||
+ <criterion comment="comment" test_ref="oval:0:tst:28"/>
|
||||
+ <criterion comment="comment" test_ref="oval:0:tst:29"/>
|
||||
+ </criteria>
|
||||
+ </definition>
|
||||
+
|
||||
</definitions>
|
||||
|
||||
<tests>
|
||||
@@ -364,6 +377,21 @@
|
||||
<ind-def:object object_ref="oval:0:obj:25"/>
|
||||
</ind-def:yamlfilecontent_test>
|
||||
|
||||
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:26" check="all" comment="true">
|
||||
+ <ind-def:object object_ref="oval:0:obj:26"/>
|
||||
+ </ind-def:yamlfilecontent_test>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:27" check="all" comment="true">
|
||||
+ <ind-def:object object_ref="oval:0:obj:27"/>
|
||||
+ </ind-def:yamlfilecontent_test>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:28" check="all" comment="true">
|
||||
+ <ind-def:object object_ref="oval:0:obj:28"/>
|
||||
+ </ind-def:yamlfilecontent_test>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:29" check="all" comment="true">
|
||||
+ <ind-def:object object_ref="oval:0:obj:29"/>
|
||||
+ </ind-def:yamlfilecontent_test>
|
||||
</tests>
|
||||
|
||||
<objects>
|
||||
@@ -517,6 +545,30 @@
|
||||
<ind-def:filename>types.yaml</ind-def:filename>
|
||||
<ind-def:yamlpath>.float_error_cast</ind-def:yamlpath>
|
||||
</ind-def:yamlfilecontent_object>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:26">
|
||||
+ <ind-def:path>/tmp</ind-def:path>
|
||||
+ <ind-def:filename>types.yaml</ind-def:filename>
|
||||
+ <ind-def:yamlpath>.null_1</ind-def:yamlpath>
|
||||
+ </ind-def:yamlfilecontent_object>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:27">
|
||||
+ <ind-def:path>/tmp</ind-def:path>
|
||||
+ <ind-def:filename>types.yaml</ind-def:filename>
|
||||
+ <ind-def:yamlpath>.null_2</ind-def:yamlpath>
|
||||
+ </ind-def:yamlfilecontent_object>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:28">
|
||||
+ <ind-def:path>/tmp</ind-def:path>
|
||||
+ <ind-def:filename>types.yaml</ind-def:filename>
|
||||
+ <ind-def:yamlpath>.null_3</ind-def:yamlpath>
|
||||
+ </ind-def:yamlfilecontent_object>
|
||||
+
|
||||
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:29">
|
||||
+ <ind-def:path>/tmp</ind-def:path>
|
||||
+ <ind-def:filename>types.yaml</ind-def:filename>
|
||||
+ <ind-def:yamlpath>.string_null</ind-def:yamlpath>
|
||||
+ </ind-def:yamlfilecontent_object>
|
||||
</objects>
|
||||
|
||||
</oval_definitions>
|
||||
diff --git a/tests/probes/yamlfilecontent/types.yaml b/tests/probes/yamlfilecontent/types.yaml
|
||||
index f05fa3a967..fb26eab5f0 100644
|
||||
--- a/tests/probes/yamlfilecontent/types.yaml
|
||||
+++ b/tests/probes/yamlfilecontent/types.yaml
|
||||
@@ -19,7 +19,11 @@ bool_false_cast: !!bool "false"
|
||||
int_cast: !!int "369"
|
||||
float_cast: !!float "978.65"
|
||||
string_true: "true"
|
||||
+string_null: "null"
|
||||
string_number: "81"
|
||||
bool_error_cast: !!bool "falsee"
|
||||
int_error_cast: !!int "50%"
|
||||
float_error_cast: !!float "58.41$"
|
||||
+null_1: null
|
||||
+null_2:
|
||||
+null_3: !!null "null"
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,38 +0,0 @@
|
||||
From 80543bc666d648d0251e4c7b675489b8011a548a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Fri, 25 Jun 2021 10:19:43 +0200
|
||||
Subject: [PATCH] Fix UBI 9 scan
|
||||
|
||||
In offline mode when scanning a cointainer based on UBI 9 the
|
||||
system_info probe failed because the function `_offline_get_hname` which
|
||||
reads from `/etc/hostname` returns an empty string which causes
|
||||
`__sysinfo_saneval(hname)` check to return zero which in turn causes the
|
||||
probe returns an error. We can prevent this situation by replacing the
|
||||
empty string by `"Unknown"`, which we already do when the `hname` is
|
||||
`NULL`.
|
||||
|
||||
Addressing:
|
||||
|
||||
W: oscap: Can't receive message: 125, Operation canceled.
|
||||
E: oscap: Recv: retry limit (0) reached.
|
||||
OpenSCAP Error: Probe at sd=32 (system_info) reported an error: Invalid type, value or format [/home/jcerny/work/git/openscap/src/OVAL/oval_probe_ext.c:383]
|
||||
Unable to receive a message from probe [/home/jcerny/work/git/openscap/src/OVAL/oval_probe_ext.c:572]
|
||||
|
||||
Resolves: rhbz#1953610
|
||||
---
|
||||
src/OVAL/probes/independent/system_info_probe.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/OVAL/probes/independent/system_info_probe.c b/src/OVAL/probes/independent/system_info_probe.c
|
||||
index 9bdd73556d..8251e655ed 100644
|
||||
--- a/src/OVAL/probes/independent/system_info_probe.c
|
||||
+++ b/src/OVAL/probes/independent/system_info_probe.c
|
||||
@@ -732,7 +732,7 @@ int system_info_probe_main(probe_ctx *ctx, void *arg)
|
||||
if (!architecture)
|
||||
architecture = strdup(unknown);
|
||||
|
||||
- if (!hname)
|
||||
+ if (!hname || *hname == '\0')
|
||||
hname = strdup(unknown);
|
||||
|
||||
if (__sysinfo_saneval(os_name) < 1 ||
|
||||
@ -1,136 +0,0 @@
|
||||
From 5c422226df442855a7dc9834eb4ff74865394a92 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 8 Jul 2021 14:28:16 +0200
|
||||
Subject: [PATCH 1/3] Initialize crypto API only once
|
||||
|
||||
The function `crapi_init` calls `gcry_check_version` which must be
|
||||
called before any other function from the Libgcrypt library. That might
|
||||
be violated when multiple threads executing multiple probes are running.
|
||||
The mitigation proposed in this PR is to call `crapi_init` only once
|
||||
when the session is initialized which means before any threads are
|
||||
spawned.
|
||||
|
||||
See also: https://www.gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading
|
||||
|
||||
Resolves: RHBZ#1959570
|
||||
---
|
||||
src/OVAL/oval_probe_session.c | 5 +++++
|
||||
src/OVAL/probes/independent/filehash58_probe.c | 6 ------
|
||||
src/OVAL/probes/independent/filehash_probe.c | 6 ------
|
||||
src/OVAL/probes/independent/filemd5_probe.c | 6 ------
|
||||
4 files changed, 5 insertions(+), 18 deletions(-)
|
||||
|
||||
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
|
||||
index 435ca148fd..6f6d7ad426 100644
|
||||
--- a/src/OVAL/oval_probe_session.c
|
||||
+++ b/src/OVAL/oval_probe_session.c
|
||||
@@ -93,6 +93,11 @@ static void oval_probe_session_libinit(void)
|
||||
SEXP_free((SEXP_t *)exp);
|
||||
|
||||
ncache_libinit();
|
||||
+ /*
|
||||
+ * Initialize crypto API
|
||||
+ */
|
||||
+ if (crapi_init (NULL) != 0)
|
||||
+ return (NULL);
|
||||
}
|
||||
|
||||
/**
|
||||
diff --git a/src/OVAL/probes/independent/filehash58_probe.c b/src/OVAL/probes/independent/filehash58_probe.c
|
||||
index ff1e065746..32a38562bd 100644
|
||||
--- a/src/OVAL/probes/independent/filehash58_probe.c
|
||||
+++ b/src/OVAL/probes/independent/filehash58_probe.c
|
||||
@@ -210,12 +210,6 @@ int filehash58_probe_offline_mode_supported()
|
||||
|
||||
void *filehash58_probe_init(void)
|
||||
{
|
||||
- /*
|
||||
- * Initialize crypto API
|
||||
- */
|
||||
- if (crapi_init (NULL) != 0)
|
||||
- return (NULL);
|
||||
-
|
||||
/*
|
||||
* Initialize mutex.
|
||||
*/
|
||||
diff --git a/src/OVAL/probes/independent/filehash_probe.c b/src/OVAL/probes/independent/filehash_probe.c
|
||||
index 522d976512..6d8780dc95 100644
|
||||
--- a/src/OVAL/probes/independent/filehash_probe.c
|
||||
+++ b/src/OVAL/probes/independent/filehash_probe.c
|
||||
@@ -190,12 +190,6 @@ int filehash_probe_offline_mode_supported()
|
||||
|
||||
void *filehash_probe_init(void)
|
||||
{
|
||||
- /*
|
||||
- * Initialize crypto API
|
||||
- */
|
||||
- if (crapi_init (NULL) != 0)
|
||||
- return (NULL);
|
||||
-
|
||||
/*
|
||||
* Initialize mutex.
|
||||
*/
|
||||
diff --git a/src/OVAL/probes/independent/filemd5_probe.c b/src/OVAL/probes/independent/filemd5_probe.c
|
||||
index d0de402d8b..99913581f0 100644
|
||||
--- a/src/OVAL/probes/independent/filemd5_probe.c
|
||||
+++ b/src/OVAL/probes/independent/filemd5_probe.c
|
||||
@@ -163,12 +163,6 @@ int probe_offline_mode_supported()
|
||||
|
||||
void *probe_init (void)
|
||||
{
|
||||
- /*
|
||||
- * Initialize crypto API
|
||||
- */
|
||||
- if (crapi_init (NULL) != 0)
|
||||
- return (NULL);
|
||||
-
|
||||
/*
|
||||
* Initialize mutex.
|
||||
*/
|
||||
|
||||
From c4c26d99a59205d744befe52be4e81bcf5f55d9c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 13 Jul 2021 13:03:21 +0200
|
||||
Subject: [PATCH 2/3] Add a missing include
|
||||
|
||||
---
|
||||
src/OVAL/oval_probe_session.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
|
||||
index 6f6d7ad426..295782b536 100644
|
||||
--- a/src/OVAL/oval_probe_session.c
|
||||
+++ b/src/OVAL/oval_probe_session.c
|
||||
@@ -48,6 +48,7 @@
|
||||
#include "oval_probe_ext.h"
|
||||
#include "probe-table.h"
|
||||
#include "oval_types.h"
|
||||
+#include "crapi/crapi.h"
|
||||
|
||||
#if defined(OSCAP_THREAD_SAFE)
|
||||
#include <pthread.h>
|
||||
|
||||
From 6241a8835574429a787e0dd48d2c0ac2a71499b8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 15 Jul 2021 14:21:00 +0200
|
||||
Subject: [PATCH 3/3] Don't initialize crypto on Windows
|
||||
|
||||
---
|
||||
src/OVAL/oval_probe_session.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
|
||||
index 295782b536..b443cbcc80 100644
|
||||
--- a/src/OVAL/oval_probe_session.c
|
||||
+++ b/src/OVAL/oval_probe_session.c
|
||||
@@ -97,8 +97,10 @@ static void oval_probe_session_libinit(void)
|
||||
/*
|
||||
* Initialize crypto API
|
||||
*/
|
||||
+#ifndef OS_WINDOWS
|
||||
if (crapi_init (NULL) != 0)
|
||||
return (NULL);
|
||||
+#endif
|
||||
}
|
||||
|
||||
/**
|
||||
@ -1,25 +0,0 @@
|
||||
From 9f9a322b73e71bb4945a736605eb0515acf9a207 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Wed, 28 Jul 2021 08:36:50 +0200
|
||||
Subject: [PATCH] Document problems with --local-files in oscap-ssh
|
||||
|
||||
Related to: https://github.com/OpenSCAP/openscap/pull/1769
|
||||
Thanks @ggbecker for pointing this out.
|
||||
---
|
||||
utils/oscap-ssh.8 | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/utils/oscap-ssh.8 b/utils/oscap-ssh.8
|
||||
index 416b1f3e5..05c80cd3c 100644
|
||||
--- a/utils/oscap-ssh.8
|
||||
+++ b/utils/oscap-ssh.8
|
||||
@@ -67,6 +67,9 @@ Specific option for oscap-ssh (must be first argument):
|
||||
oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable, and pastes its contents into the command-line of ssh to the location where options are expected.
|
||||
Supply the variable in form of a string that corresponds to a section of the ssh command-line and that consists of options you want to pass.
|
||||
|
||||
+.SS Using --local-files option
|
||||
+The oscap-ssh command supports the --local-files option, but it isn't possible to pass './' and '../' as an argument. Use a full directory path instead.
|
||||
+
|
||||
.SH EXAMPLE USAGE
|
||||
.SS Simple XCCDF evaluation
|
||||
The following command evaluates a remote Fedora machine as root. HTML report is written out as report.html on the local machine. Can be executed from any machine that has ssh, scp and bash. The local machine does not need to have openscap installed.
|
||||
@ -1,97 +0,0 @@
|
||||
From 05faede8f6602b7b71d71fd965276225a986fb1f Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Wed, 28 Jul 2021 13:06:25 +0200
|
||||
Subject: [PATCH] Add a regression test for rhbz#1959570
|
||||
|
||||
The bug was a segmentation fault in filehash58 probe which happened
|
||||
in openscap-1.3.3-6.el8_3.
|
||||
|
||||
The bug was fixed by https://github.com/OpenSCAP/openscap/pull/1779
|
||||
and this patch adds a very small test.
|
||||
---
|
||||
tests/probes/filehash58/CMakeLists.txt | 1 +
|
||||
.../probes/filehash58/rhbz1959570_segfault.sh | 19 +++++++++
|
||||
.../rhbz1959570_segfault_reproducer.xml | 39 +++++++++++++++++++
|
||||
3 files changed, 59 insertions(+)
|
||||
create mode 100755 tests/probes/filehash58/rhbz1959570_segfault.sh
|
||||
create mode 100644 tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
|
||||
|
||||
diff --git a/tests/probes/filehash58/CMakeLists.txt b/tests/probes/filehash58/CMakeLists.txt
|
||||
index b26d8171fb..cdec0792eb 100644
|
||||
--- a/tests/probes/filehash58/CMakeLists.txt
|
||||
+++ b/tests/probes/filehash58/CMakeLists.txt
|
||||
@@ -1,3 +1,4 @@
|
||||
if(ENABLE_PROBES_INDEPENDENT)
|
||||
add_oscap_test("test_probes_filehash58.sh")
|
||||
+ add_oscap_test("rhbz1959570_segfault.sh")
|
||||
endif()
|
||||
diff --git a/tests/probes/filehash58/rhbz1959570_segfault.sh b/tests/probes/filehash58/rhbz1959570_segfault.sh
|
||||
new file mode 100755
|
||||
index 0000000000..0c32cc79f1
|
||||
--- /dev/null
|
||||
+++ b/tests/probes/filehash58/rhbz1959570_segfault.sh
|
||||
@@ -0,0 +1,19 @@
|
||||
+#!/usr/bin/env bash
|
||||
+
|
||||
+# Copyright 2021 Red Hat Inc., Durham, North Carolina.
|
||||
+# All Rights Reserved.
|
||||
+#
|
||||
+# OpenSCAP Probes Test Suite.
|
||||
+#
|
||||
+# Authors:
|
||||
+# Jan Černý, <jcerny@redhat.com>
|
||||
+
|
||||
+set -e -o pipefail
|
||||
+. $builddir/tests/test_common.sh
|
||||
+
|
||||
+# Test Cases
|
||||
+
|
||||
+stderr="$(mktemp)"
|
||||
+$OSCAP oval eval --id oval:x:def:1 "$srcdir/rhbz1959570_segfault_reproducer.xml" 2> "$stderr"
|
||||
+[ ! -s "$stderr" ]
|
||||
+rm "$stderr"
|
||||
diff --git a/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
|
||||
new file mode 100644
|
||||
index 0000000000..4b3fc4863a
|
||||
--- /dev/null
|
||||
+++ b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
|
||||
@@ -0,0 +1,39 @@
|
||||
+<?xml version="1.0"?>
|
||||
+<oval-def:oval_definitions xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
|
||||
+ <oval-def:generator>
|
||||
+ <oval:product_name>jcerny</oval:product_name>
|
||||
+ <oval:product_version>1</oval:product_version>
|
||||
+ <oval:schema_version>5.11</oval:schema_version>
|
||||
+ <oval:timestamp>2021-07-28T07:40:55</oval:timestamp>
|
||||
+ </oval-def:generator>
|
||||
+ <oval-def:definitions>
|
||||
+ <oval-def:definition class="compliance" id="oval:x:def:1" version="1">
|
||||
+ <oval-def:metadata>
|
||||
+ <oval-def:title>title</oval-def:title>
|
||||
+ <oval-def:description>description</oval-def:description>
|
||||
+ </oval-def:metadata>
|
||||
+ <oval-def:criteria>
|
||||
+ <oval-def:criterion comment="comment" test_ref="oval:x:tst:1"/>
|
||||
+ </oval-def:criteria>
|
||||
+ </oval-def:definition>
|
||||
+ </oval-def:definitions>
|
||||
+ <oval-def:tests>
|
||||
+ <ind:filehash58_test check="all" check_existence="all_exist" comment="comment" id="oval:x:tst:1" version="1">
|
||||
+ <ind:object object_ref="oval:x:obj:1"/>
|
||||
+ <ind:state state_ref="oval:x:ste:1"/>
|
||||
+ </ind:filehash58_test>
|
||||
+ </oval-def:tests>
|
||||
+ <oval-def:objects>
|
||||
+ <ind:filehash58_object id="oval:x:obj:1" version="1">
|
||||
+ <ind:filepath>/etc/os-release</ind:filepath>
|
||||
+ <ind:hash_type>SHA-256</ind:hash_type>
|
||||
+ </ind:filehash58_object>
|
||||
+ </oval-def:objects>
|
||||
+ <oval-def:states>
|
||||
+ <ind:filehash58_state id="oval:x:ste:1" version="1">
|
||||
+ <ind:filepath>/etc/os-release</ind:filepath>
|
||||
+ <ind:hash_type>SHA-256</ind:hash_type>
|
||||
+ <ind:hash>6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af</ind:hash>
|
||||
+ </ind:filehash58_state>
|
||||
+ </oval-def:states>
|
||||
+</oval-def:oval_definitions>
|
||||
@ -1,72 +0,0 @@
|
||||
From d97687c12ba6cbca1d732534ff7394bd14547d92 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Fri, 10 Sep 2021 14:53:42 +0200
|
||||
Subject: [PATCH] Add an alternative source of hostname
|
||||
|
||||
If /etc/hostname can't be read, we will try to open /proc/sys/kernel/hostname instead.
|
||||
|
||||
Resolves: rhbz#1977668
|
||||
---
|
||||
src/XCCDF/result.c | 5 ++++
|
||||
tests/API/XCCDF/unittests/CMakeLists.txt | 1 +
|
||||
.../XCCDF/unittests/test_results_hostname.sh | 26 +++++++++++++++++++
|
||||
3 files changed, 32 insertions(+)
|
||||
create mode 100755 tests/API/XCCDF/unittests/test_results_hostname.sh
|
||||
|
||||
diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c
|
||||
index 91fcc6041d..c0ad4b926f 100644
|
||||
--- a/src/XCCDF/result.c
|
||||
+++ b/src/XCCDF/result.c
|
||||
@@ -271,6 +271,11 @@ static char *_get_etc_hostname(const char *oscap_probe_root)
|
||||
|
||||
fp = oscap_fopen_with_prefix(oscap_probe_root, "/etc/hostname");
|
||||
|
||||
+ if (fp == NULL) {
|
||||
+ dD("Trying to use /proc/sys/kernel/hostname instead of /etc/hostname");
|
||||
+ fp = oscap_fopen_with_prefix(oscap_probe_root, "/proc/sys/kernel/hostname");
|
||||
+ }
|
||||
+
|
||||
if (fp == NULL)
|
||||
goto fail;
|
||||
|
||||
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
index 52645834c4..6549538440 100644
|
||||
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
@@ -101,3 +101,4 @@ add_oscap_test("test_fix_arf.sh")
|
||||
add_oscap_test("test_fix_resultid_by_suffix.sh")
|
||||
add_oscap_test("test_generate_fix_ansible_vars.sh")
|
||||
add_oscap_test("test_xccdf_requires_conflicts.sh")
|
||||
+add_oscap_test("test_results_hostname.sh")
|
||||
diff --git a/tests/API/XCCDF/unittests/test_results_hostname.sh b/tests/API/XCCDF/unittests/test_results_hostname.sh
|
||||
new file mode 100755
|
||||
index 0000000000..c4408affbb
|
||||
--- /dev/null
|
||||
+++ b/tests/API/XCCDF/unittests/test_results_hostname.sh
|
||||
@@ -0,0 +1,26 @@
|
||||
+#!/usr/bin/env bash
|
||||
+. $builddir/tests/test_common.sh
|
||||
+
|
||||
+set -e
|
||||
+set -o pipefail
|
||||
+
|
||||
+result=$(mktemp)
|
||||
+tmpdir=$(mktemp -d)
|
||||
+
|
||||
+export OSCAP_PROBE_ROOT="$tmpdir"
|
||||
+
|
||||
+mkdir -p "$tmpdir/etc"
|
||||
+echo "hostname_defined_in_etc_hostname" > "$tmpdir/etc/hostname"
|
||||
+$OSCAP xccdf eval --results "$result" "$srcdir/test_single_rule.ds.xml" || ret=$?
|
||||
+assert_exists 1 '/Benchmark/TestResult/target[text()="hostname_defined_in_etc_hostname"]'
|
||||
+assert_exists 0 '/Benchmark/TestResult/target[text()="hostname_defined_in_proc_sys_kernel"]'
|
||||
+
|
||||
+rm -rf "$tmpdir/etc/hostname"
|
||||
+mkdir -p "$tmpdir/proc/sys/kernel/"
|
||||
+echo "hostname_defined_in_proc_sys_kernel" > "$tmpdir/proc/sys/kernel/hostname"
|
||||
+$OSCAP xccdf eval --results "$result" "$srcdir/test_single_rule.ds.xml" || ret=$?
|
||||
+assert_exists 0 '/Benchmark/TestResult/target[text()="hostname_defined_in_etc_hostname"]'
|
||||
+assert_exists 1 '/Benchmark/TestResult/target[text()="hostname_defined_in_proc_sys_kernel"]'
|
||||
+
|
||||
+rm -f "$result"
|
||||
+rm -rf "$tmpdir"
|
||||
@ -1,583 +0,0 @@
|
||||
From b0b7626dca08acd4563ae42c1c27ccc0777b5357 Mon Sep 17 00:00:00 2001
|
||||
From: Evgeny Kolesnikov <ekolesni@redhat.com>
|
||||
Date: Thu, 23 Sep 2021 00:58:29 +0200
|
||||
Subject: [PATCH] Add proper Blueprint's remediation snippets handling for
|
||||
generation of the final TOML document.
|
||||
|
||||
As the final Blueprint could not be created by just gluing up all
|
||||
the snippets together we have to get a bit more creative.
|
||||
---
|
||||
docs/manual/manual.adoc | 15 ++
|
||||
src/XCCDF_POLICY/xccdf_policy_remediate.c | 216 ++++++++++++++++--
|
||||
src/common/list.c | 19 ++
|
||||
src/common/list.h | 1 +
|
||||
tests/API/XCCDF/unittests/CMakeLists.txt | 1 +
|
||||
.../unittests/test_remediation_blueprint.sh | 27 +++
|
||||
.../unittests/test_remediation_blueprint.toml | 45 ++++
|
||||
.../test_remediation_blueprint.xccdf.xml | 102 +++++++++
|
||||
8 files changed, 405 insertions(+), 21 deletions(-)
|
||||
create mode 100755 tests/API/XCCDF/unittests/test_remediation_blueprint.sh
|
||||
create mode 100644 tests/API/XCCDF/unittests/test_remediation_blueprint.toml
|
||||
create mode 100644 tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
|
||||
|
||||
diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc
|
||||
index e8664eb920..90e2cc2c63 100644
|
||||
--- a/docs/manual/manual.adoc
|
||||
+++ b/docs/manual/manual.adoc
|
||||
@@ -1084,6 +1084,21 @@ scanned during this command. If you want to generate remediation only for the
|
||||
failed rules based on scan results, refer to <<_reviewing_remediations,Reviewing
|
||||
remediations>>.
|
||||
|
||||
+=== Generating Image Builder Blueprints
|
||||
+
|
||||
+OpenSCAP can also create a remediation in form of Image Builder (OSBuild) Blueprint. This remeditaion
|
||||
+is intendeded to be used as a bootstrap for image creation and usually it will contain only essential
|
||||
+elements of the configuration, elements that would be hard or impossible to change after the image
|
||||
+is created, like partitioning or set of installed packages.
|
||||
+
|
||||
+It is recommended to combine this type of remediation with other types, executed on the running system.
|
||||
+
|
||||
+For example, to generate a blueprint remediation for RHEL 8 OSPP profile, run:
|
||||
+
|
||||
+----
|
||||
+$ oscap xccdf generate fix --profile ospp --fix-type blueprint /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml > blueprint.toml
|
||||
+----
|
||||
+
|
||||
== Details on SCAP conformance
|
||||
|
||||
=== Check Engines
|
||||
diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c
|
||||
index 0b3a037a5f..6033c3b54b 100644
|
||||
--- a/src/XCCDF_POLICY/xccdf_policy_remediate.c
|
||||
+++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c
|
||||
@@ -656,6 +656,78 @@ static int _write_fix_missing_warning_to_fd(const char *sys, int output_fd, stru
|
||||
}
|
||||
}
|
||||
|
||||
+struct blueprint_entries {
|
||||
+ const char *pattern;
|
||||
+ struct oscap_list *list;
|
||||
+ pcre *re;
|
||||
+};
|
||||
+
|
||||
+static inline int _parse_blueprint_fix(const char *fix_text, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
|
||||
+{
|
||||
+ const char *err;
|
||||
+ int errofs;
|
||||
+ int ret = 0;
|
||||
+
|
||||
+ struct blueprint_entries tab[] = {
|
||||
+ {"\\[customizations\\.services\\]\\s+enabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_enable, NULL},
|
||||
+ {"\\[customizations\\.services\\]\\s+disabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_disable, NULL},
|
||||
+ {"\\[customizations\\.kernel\\]\\s+append[=\\s\"]+([^\"]+)[\\s\"]+", kernel_append, NULL},
|
||||
+ // We do this only to pop the 'distro' entry to the top of the generic list,
|
||||
+ // effectively placing it to the root of the TOML document.
|
||||
+ {"\\s+(distro[=\\s\"]+[^\"]+[\\s\"]+)", generic, NULL},
|
||||
+ {NULL, NULL, NULL}
|
||||
+ };
|
||||
+
|
||||
+ for (int i = 0; tab[i].pattern != NULL; i++) {
|
||||
+ tab[i].re = pcre_compile(tab[i].pattern, PCRE_UTF8, &err, &errofs, NULL);
|
||||
+ if (tab[i].re == NULL) {
|
||||
+ dE("Unable to compile /%s/ regex pattern, pcre_compile() returned error (offset: %d): '%s'.\n", tab[i].pattern, errofs, err);
|
||||
+ ret = 1;
|
||||
+ goto exit;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ const size_t fix_text_len = strlen(fix_text);
|
||||
+ size_t start_offset = 0;
|
||||
+ int ovector[6] = {0};
|
||||
+
|
||||
+ for (int i = 0; tab[i].pattern != NULL; i++) {
|
||||
+ while (true) {
|
||||
+ const int match = pcre_exec(tab[i].re, NULL, fix_text, fix_text_len, start_offset,
|
||||
+ 0, ovector, sizeof(ovector) / sizeof(ovector[0]));
|
||||
+ if (match == -1)
|
||||
+ break;
|
||||
+
|
||||
+ if (match != 2) {
|
||||
+ dE("Expected 1 capture group matches per entry. Found %i!", match - 1);
|
||||
+ ret = 1;
|
||||
+ goto exit;
|
||||
+ }
|
||||
+
|
||||
+ char *val = malloc((ovector[3] - ovector[2] + 1) * sizeof(char));
|
||||
+ memcpy(val, &fix_text[ovector[2]], ovector[3] - ovector[2]);
|
||||
+ val[ovector[3] - ovector[2]] = '\0';
|
||||
+
|
||||
+ if (!oscap_list_contains(kernel_append, val, (oscap_cmp_func) oscap_streq)) {
|
||||
+ oscap_list_prepend(tab[i].list, val);
|
||||
+ } else {
|
||||
+ free(val);
|
||||
+ }
|
||||
+
|
||||
+ start_offset = ovector[1];
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (start_offset < fix_text_len-1) {
|
||||
+ oscap_list_add(generic, strdup(fix_text + start_offset));
|
||||
+ }
|
||||
+
|
||||
+exit:
|
||||
+ for (int i = 0; tab[i].pattern != NULL; i++)
|
||||
+ pcre_free(tab[i].re);
|
||||
+
|
||||
+ return ret;
|
||||
+}
|
||||
|
||||
static inline int _parse_ansible_fix(const char *fix_text, struct oscap_list *variables, struct oscap_list *tasks)
|
||||
{
|
||||
@@ -793,6 +865,18 @@ static int _xccdf_policy_rule_generate_fix(struct xccdf_policy *policy, struct x
|
||||
return ret;
|
||||
}
|
||||
|
||||
+static int _xccdf_policy_rule_generate_blueprint_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
|
||||
+{
|
||||
+ char *fix_text = NULL;
|
||||
+ int ret = _xccdf_policy_rule_get_fix_text(policy, rule, template, &fix_text);
|
||||
+ if (fix_text == NULL) {
|
||||
+ return ret;
|
||||
+ }
|
||||
+ ret = _parse_blueprint_fix(fix_text, generic, services_enable, services_disable, kernel_append);
|
||||
+ free(fix_text);
|
||||
+ return ret;
|
||||
+}
|
||||
+
|
||||
static int _xccdf_policy_rule_generate_ansible_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct oscap_list *variables, struct oscap_list *tasks)
|
||||
{
|
||||
char *fix_text = NULL;
|
||||
@@ -914,25 +998,45 @@ static char *_comment_multiline_text(char *text)
|
||||
static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_result *result, const char *sys, int output_fd)
|
||||
{
|
||||
if (!(oscap_streq(sys, "") || oscap_streq(sys, "urn:xccdf:fix:script:sh") || oscap_streq(sys, "urn:xccdf:fix:commands") ||
|
||||
- oscap_streq(sys, "urn:xccdf:fix:script:ansible")))
|
||||
+ oscap_streq(sys, "urn:xccdf:fix:script:ansible") || oscap_streq(sys, "urn:redhat:osbuild:blueprint")))
|
||||
return 0; // no header required
|
||||
|
||||
- const bool ansible_script = strcmp(sys, "urn:xccdf:fix:script:ansible") == 0;
|
||||
- const char *how_to_apply = ansible_script ?
|
||||
- "# $ ansible-playbook -i \"localhost,\" -c local playbook.yml\n"
|
||||
- "# $ ansible-playbook -i \"192.168.1.155,\" playbook.yml\n"
|
||||
- "# $ ansible-playbook -i inventory.ini playbook.yml" :
|
||||
- "# $ sudo ./remediation-script.sh";
|
||||
const char *oscap_version = oscap_get_version();
|
||||
- const char *format = ansible_script ? "ansible" : "bash";
|
||||
- const char *remediation_type = ansible_script ? "Ansible Playbook" : "Bash Remediation Script";
|
||||
- const char *shebang_with_newline = ansible_script ? "" : "#!/usr/bin/env bash\n";
|
||||
+ char *how_to_apply = "";
|
||||
+ char *format = (char *)sys;
|
||||
+ char *remediation_type = "Unknown";
|
||||
+ char *shebang_with_newline = "";
|
||||
+
|
||||
+ if (oscap_streq(sys, "urn:xccdf:fix:script:ansible")) {
|
||||
+ how_to_apply = "# $ ansible-playbook -i \"localhost,\" -c local playbook.yml\n"
|
||||
+ "# $ ansible-playbook -i \"192.168.1.155,\" playbook.yml\n"
|
||||
+ "# $ ansible-playbook -i inventory.ini playbook.yml";
|
||||
+ format = "ansible";
|
||||
+ remediation_type = "Ansible Playbook";
|
||||
+ }
|
||||
+
|
||||
+ if (oscap_streq(sys, "urn:redhat:osbuild:blueprint")) {
|
||||
+ how_to_apply = "# composer-cli blueprints push blueprint.toml";
|
||||
+ format = "blueprint";
|
||||
+ remediation_type = "Blueprint";
|
||||
+ }
|
||||
+
|
||||
+ if (oscap_streq(sys, "") || oscap_streq(sys, "urn:xccdf:fix:script:sh") || oscap_streq(sys, "urn:xccdf:fix:commands")) {
|
||||
+ how_to_apply = "# $ sudo ./remediation-script.sh";
|
||||
+ format = "bash";
|
||||
+ remediation_type = "Bash Remediation Script";
|
||||
+ shebang_with_newline = "#!/usr/bin/env bash\n";
|
||||
+ }
|
||||
|
||||
char *fix_header;
|
||||
|
||||
struct xccdf_profile *profile = xccdf_policy_get_profile(policy);
|
||||
const char *profile_id = xccdf_profile_get_id(profile);
|
||||
|
||||
+ struct xccdf_benchmark *benchmark = xccdf_policy_get_benchmark(policy);
|
||||
+ const char *benchmark_version_info = benchmark ? xccdf_benchmark_get_version(benchmark) : "Unknown";
|
||||
+ const char *benchmark_id = benchmark ? xccdf_benchmark_get_id(benchmark) : "Unknown";
|
||||
+
|
||||
// Title
|
||||
struct oscap_text_iterator *title_iterator = xccdf_profile_get_title(profile);
|
||||
char *raw_profile_title = oscap_textlist_get_preferred_plaintext(title_iterator, NULL);
|
||||
@@ -942,11 +1046,6 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
|
||||
|
||||
if (result == NULL) {
|
||||
// Profile-based remediation fix
|
||||
- struct xccdf_benchmark *benchmark = xccdf_policy_get_benchmark(policy);
|
||||
- if (benchmark == NULL) {
|
||||
- free(profile_title);
|
||||
- return 1;
|
||||
- }
|
||||
// Description
|
||||
struct oscap_text_iterator *description_iterator = xccdf_profile_get_description(profile);
|
||||
char *profile_description = description_iterator != NULL ?
|
||||
@@ -955,10 +1054,8 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
|
||||
char *commented_profile_description = _comment_multiline_text(profile_description);
|
||||
free(profile_description);
|
||||
|
||||
- const char *benchmark_version_info = xccdf_benchmark_get_version(benchmark);
|
||||
- const char *benchmark_id = xccdf_benchmark_get_id(benchmark);
|
||||
- const struct xccdf_version_info *xccdf_version = xccdf_benchmark_get_schema_version(benchmark);
|
||||
- const char *xccdf_version_name = xccdf_version_info_get_version(xccdf_version);
|
||||
+ const struct xccdf_version_info *xccdf_version = benchmark ? xccdf_benchmark_get_schema_version(benchmark) : NULL;
|
||||
+ const char *xccdf_version_name = xccdf_version ? xccdf_version_info_get_version(xccdf_version) : "Unknown";
|
||||
|
||||
fix_header = oscap_sprintf(
|
||||
"%s"
|
||||
@@ -1026,9 +1123,8 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
|
||||
result_id, format, remediation_type, remediation_type, how_to_apply
|
||||
);
|
||||
}
|
||||
- free(profile_title);
|
||||
|
||||
- if (ansible_script) {
|
||||
+ if (oscap_streq(sys, "urn:xccdf:fix:script:ansible")) {
|
||||
char *ansible_fix_header = oscap_sprintf(
|
||||
"---\n"
|
||||
"%s\n"
|
||||
@@ -1036,9 +1132,85 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
|
||||
fix_header);
|
||||
free(fix_header);
|
||||
return _write_text_to_fd_and_free(output_fd, ansible_fix_header);
|
||||
+ } else if (oscap_streq(sys, "urn:redhat:osbuild:blueprint")) {
|
||||
+ char *blueprint_fix_header = oscap_sprintf(
|
||||
+ "%s"
|
||||
+ "name = \"%s\"\n"
|
||||
+ "description = \"%s\"\n"
|
||||
+ "version = \"%s\"\n",
|
||||
+ fix_header, profile_id, profile_title, benchmark_version_info);
|
||||
+ free(fix_header);
|
||||
+ return _write_text_to_fd_and_free(output_fd, blueprint_fix_header);
|
||||
} else {
|
||||
return _write_text_to_fd_and_free(output_fd, fix_header);
|
||||
}
|
||||
+
|
||||
+ free(profile_title);
|
||||
+}
|
||||
+
|
||||
+static int _xccdf_policy_generate_fix_blueprint(struct oscap_list *rules_to_fix, struct xccdf_policy *policy, const char *sys, int output_fd)
|
||||
+{
|
||||
+ int ret = 0;
|
||||
+ struct oscap_list *generic = oscap_list_new();
|
||||
+ struct oscap_list *services_enable = oscap_list_new();
|
||||
+ struct oscap_list *services_disable = oscap_list_new();
|
||||
+ struct oscap_list *kernel_append = oscap_list_new();
|
||||
+ struct oscap_iterator *rules_to_fix_it = oscap_iterator_new(rules_to_fix);
|
||||
+ while (oscap_iterator_has_more(rules_to_fix_it)) {
|
||||
+ struct xccdf_rule *rule = (struct xccdf_rule*)oscap_iterator_next(rules_to_fix_it);
|
||||
+ ret = _xccdf_policy_rule_generate_blueprint_fix(policy, rule, sys, generic, services_enable, services_disable, kernel_append);
|
||||
+ if (ret != 0)
|
||||
+ break;
|
||||
+ }
|
||||
+ oscap_iterator_free(rules_to_fix_it);
|
||||
+
|
||||
+ struct oscap_iterator *generic_it = oscap_iterator_new(generic);
|
||||
+ while(oscap_iterator_has_more(generic_it)) {
|
||||
+ char *var_line = (char *) oscap_iterator_next(generic_it);
|
||||
+ _write_text_to_fd(output_fd, var_line);
|
||||
+ }
|
||||
+ _write_text_to_fd(output_fd, "\n");
|
||||
+ oscap_iterator_free(generic_it);
|
||||
+ oscap_list_free(generic, free);
|
||||
+
|
||||
+ _write_text_to_fd(output_fd, "[customizations.kernel]\nappend = \"");
|
||||
+ struct oscap_iterator *kernel_append_it = oscap_iterator_new(kernel_append);
|
||||
+ while(oscap_iterator_has_more(kernel_append_it)) {
|
||||
+ char *var_line = (char *) oscap_iterator_next(kernel_append_it);
|
||||
+ _write_text_to_fd(output_fd, var_line);
|
||||
+ if (oscap_iterator_has_more(kernel_append_it))
|
||||
+ _write_text_to_fd(output_fd, " ");
|
||||
+ }
|
||||
+ _write_text_to_fd(output_fd, "\"\n\n");
|
||||
+ oscap_iterator_free(kernel_append_it);
|
||||
+ oscap_list_free(kernel_append, free);
|
||||
+
|
||||
+ _write_text_to_fd(output_fd, "[customizations.services]\n");
|
||||
+ _write_text_to_fd(output_fd, "enabled = [");
|
||||
+ struct oscap_iterator *services_enable_it = oscap_iterator_new(services_enable);
|
||||
+ while(oscap_iterator_has_more(services_enable_it)) {
|
||||
+ char *var_line = (char *) oscap_iterator_next(services_enable_it);
|
||||
+ _write_text_to_fd(output_fd, var_line);
|
||||
+ if (oscap_iterator_has_more(services_enable_it))
|
||||
+ _write_text_to_fd(output_fd, ",");
|
||||
+ }
|
||||
+ _write_text_to_fd(output_fd, "]\n");
|
||||
+ oscap_iterator_free(services_enable_it);
|
||||
+ oscap_list_free(services_enable, free);
|
||||
+
|
||||
+ _write_text_to_fd(output_fd, "disabled = [");
|
||||
+ struct oscap_iterator *services_disable_it = oscap_iterator_new(services_disable);
|
||||
+ while(oscap_iterator_has_more(services_disable_it)) {
|
||||
+ char *var_line = (char *) oscap_iterator_next(services_disable_it);
|
||||
+ _write_text_to_fd(output_fd, var_line);
|
||||
+ if (oscap_iterator_has_more(services_disable_it))
|
||||
+ _write_text_to_fd(output_fd, ",");
|
||||
+ }
|
||||
+ _write_text_to_fd(output_fd, "]\n\n");
|
||||
+ oscap_iterator_free(services_disable_it);
|
||||
+ oscap_list_free(services_disable, free);
|
||||
+
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
static int _xccdf_policy_generate_fix_ansible(struct oscap_list *rules_to_fix, struct xccdf_policy *policy, const char *sys, int output_fd)
|
||||
@@ -1145,6 +1317,8 @@ int xccdf_policy_generate_fix(struct xccdf_policy *policy, struct xccdf_result *
|
||||
// in Ansible we have to generate variables first and then tasks
|
||||
if (strcmp(sys, "urn:xccdf:fix:script:ansible") == 0) {
|
||||
ret = _xccdf_policy_generate_fix_ansible(rules_to_fix, policy, sys, output_fd);
|
||||
+ } else if (strcmp(sys, "urn:redhat:osbuild:blueprint") == 0) {
|
||||
+ ret = _xccdf_policy_generate_fix_blueprint(rules_to_fix, policy, sys, output_fd);
|
||||
} else {
|
||||
ret = _xccdf_policy_generate_fix_other(rules_to_fix, policy, sys, output_fd);
|
||||
}
|
||||
diff --git a/src/common/list.c b/src/common/list.c
|
||||
index 2516d0f2f0..90381069f8 100644
|
||||
--- a/src/common/list.c
|
||||
+++ b/src/common/list.c
|
||||
@@ -66,6 +66,25 @@ bool oscap_list_add(struct oscap_list * list, void *value)
|
||||
return true;
|
||||
}
|
||||
|
||||
+bool oscap_list_prepend(struct oscap_list * list, void *value)
|
||||
+{
|
||||
+ __attribute__nonnull__(list);
|
||||
+ if (value == NULL) return false;
|
||||
+
|
||||
+ struct oscap_list_item *item = malloc(sizeof(struct oscap_list_item));
|
||||
+ item->next = NULL;
|
||||
+ item->data = value;
|
||||
+ ++list->itemcount;
|
||||
+
|
||||
+ if (list->first == NULL) {
|
||||
+ list->last = list->first = item;
|
||||
+ } else {
|
||||
+ item->next = list->first;
|
||||
+ list->first = item;
|
||||
+ }
|
||||
+ return true;
|
||||
+}
|
||||
+
|
||||
bool oscap_list_push(struct oscap_list *list, void *value)
|
||||
{
|
||||
return oscap_list_add(list,value);
|
||||
diff --git a/src/common/list.h b/src/common/list.h
|
||||
index 7a0694dc8a..3179c514f0 100644
|
||||
--- a/src/common/list.h
|
||||
+++ b/src/common/list.h
|
||||
@@ -62,6 +62,7 @@ struct oscap_list *oscap_list_new(void);
|
||||
void oscap_create_lists(struct oscap_list **first, ...);
|
||||
bool oscap_list_add(struct oscap_list *list, void *value);
|
||||
bool oscap_list_push(struct oscap_list *list, void *value);
|
||||
+bool oscap_list_prepend(struct oscap_list *list, void *value);
|
||||
bool oscap_list_pop(struct oscap_list *list, oscap_destruct_func destructor);
|
||||
bool oscap_list_remove(struct oscap_list *list, void *value, oscap_cmp_func compare, oscap_destruct_func destructor);
|
||||
struct oscap_list *oscap_list_clone(const struct oscap_list * list, oscap_clone_func cloner);
|
||||
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
index 52645834c4..9c17ebb78a 100644
|
||||
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
|
||||
@@ -75,6 +75,7 @@ add_oscap_test("test_single_rule_stigw.sh")
|
||||
add_oscap_test("test_remediation_simple.sh")
|
||||
add_oscap_test("test_remediation_offline.sh")
|
||||
add_oscap_test("test_remediation_metadata.sh")
|
||||
+add_oscap_test("test_remediation_blueprint.sh")
|
||||
add_oscap_test("test_remediation_bad_fix.sh")
|
||||
add_oscap_test("test_remediation_subs_plain_text.sh")
|
||||
add_oscap_test("test_remediation_subs_plain_text_empty.sh")
|
||||
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.sh b/tests/API/XCCDF/unittests/test_remediation_blueprint.sh
|
||||
new file mode 100755
|
||||
index 0000000000..7c79822529
|
||||
--- /dev/null
|
||||
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.sh
|
||||
@@ -0,0 +1,27 @@
|
||||
+#!/usr/bin/env bash
|
||||
+. $builddir/tests/test_common.sh
|
||||
+
|
||||
+set -e
|
||||
+set -o pipefail
|
||||
+
|
||||
+name=$(basename $0 .sh)
|
||||
+result=$(make_temp_file /tmp ${name}.out)
|
||||
+stderr=$(make_temp_file /tmp ${name}.out)
|
||||
+
|
||||
+ret=0
|
||||
+
|
||||
+input_xml="$srcdir/${name}.xccdf.xml"
|
||||
+valid_toml="$srcdir/${name}.toml"
|
||||
+
|
||||
+echo "Stderr file = $stderr"
|
||||
+echo "Result file = $result"
|
||||
+[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
|
||||
+
|
||||
+# The $valid_toml file was generated without ' # This file was generated by OpenSCAP 1.3.5 using:' line
|
||||
+# to make the test independent from the scanner version. We have to filter this line from the output as well.
|
||||
+
|
||||
+$OSCAP xccdf generate fix --fix-type blueprint --profile 'common' "$input_xml" | grep -v "OpenSCAP" > "$result"
|
||||
+
|
||||
+diff $valid_toml $result
|
||||
+
|
||||
+rm "$result"
|
||||
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.toml b/tests/API/XCCDF/unittests/test_remediation_blueprint.toml
|
||||
new file mode 100644
|
||||
index 0000000000..e189adca9d
|
||||
--- /dev/null
|
||||
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.toml
|
||||
@@ -0,0 +1,45 @@
|
||||
+###############################################################################
|
||||
+#
|
||||
+# Blueprint for Profile title on one line
|
||||
+#
|
||||
+# Profile Description:
|
||||
+# Profile description
|
||||
+#
|
||||
+# Profile ID: xccdf_moc.elpmaxe.www_profile_common
|
||||
+# Benchmark ID: xccdf_moc.elpmaxe.www_benchmark_test
|
||||
+# Benchmark Version: 1.0
|
||||
+# XCCDF Version: 1.2
|
||||
+#
|
||||
+# $ oscap xccdf generate fix --profile xccdf_moc.elpmaxe.www_profile_common --fix-type blueprint xccdf-file.xml
|
||||
+#
|
||||
+# It attempts to fix every selected rule, even if the system is already compliant.
|
||||
+#
|
||||
+# How to apply this Blueprint:
|
||||
+# composer-cli blueprints push blueprint.toml
|
||||
+#
|
||||
+###############################################################################
|
||||
+
|
||||
+name = "xccdf_moc.elpmaxe.www_profile_common"
|
||||
+description = "Profile title on one line"
|
||||
+version = "1.0"
|
||||
+distro = rhel-80
|
||||
+
|
||||
+[[packages]]
|
||||
+name = "aide"
|
||||
+version = "*"
|
||||
+
|
||||
+[[customizations.filesystem]]
|
||||
+mountpoint = "/home"
|
||||
+size = 1
|
||||
+
|
||||
+[[customizations.filesystem]]
|
||||
+mountpoint = "/tmp"
|
||||
+size = 2
|
||||
+
|
||||
+[customizations.kernel]
|
||||
+append = "foo=bar audit=1"
|
||||
+
|
||||
+[customizations.services]
|
||||
+enabled = ["sshd","usbguard"]
|
||||
+disabled = ["kdump"]
|
||||
+
|
||||
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml b/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
|
||||
new file mode 100644
|
||||
index 0000000000..e685620dac
|
||||
--- /dev/null
|
||||
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
|
||||
@@ -0,0 +1,102 @@
|
||||
+<?xml version="1.0" encoding="UTF-8"?>
|
||||
+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_test">
|
||||
+ <status>accepted</status>
|
||||
+ <version>1.0</version>
|
||||
+ <Profile id="xccdf_moc.elpmaxe.www_profile_common">
|
||||
+ <title>Profile title on one line</title>
|
||||
+ <description>Profile description</description>
|
||||
+ <select idref="xccdf_moc.elpmaxe.www_rule_1" selected="true"/>
|
||||
+ </Profile>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_1">
|
||||
+ <title>Install aide</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[[packages]]
|
||||
+name = "aide"
|
||||
+version = "*"
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_2">
|
||||
+ <title>Define /home</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[[customizations.filesystem]]
|
||||
+mountpoint = "/home"
|
||||
+size = 1
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_3">
|
||||
+ <title>Add audit=1 kernel option</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[customizations.kernel]
|
||||
+append = "audit=1"
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_4">
|
||||
+ <title>Add foo=bar kernel option</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[customizations.kernel]
|
||||
+append = "foo=bar"
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_5">
|
||||
+ <title>Define /tmp</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[[customizations.filesystem]]
|
||||
+mountpoint = "/tmp"
|
||||
+size = 2
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_6">
|
||||
+ <title>Enable usbguard</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[customizations.services]
|
||||
+enabled = ["usbguard"]
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_7">
|
||||
+ <title>Disable kdump</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[customizations.services]
|
||||
+disabled = ["kdump"]
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_8">
|
||||
+ <title>Set distro (RHEL 8.0)</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+distro = rhel-80
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_9">
|
||||
+ <title>Enable sshd</title>
|
||||
+ <fix system="urn:redhat:osbuild:blueprint">
|
||||
+[customizations.services]
|
||||
+enabled = ["sshd"]
|
||||
+</fix>
|
||||
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
|
||||
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
|
||||
+ </check>
|
||||
+ </Rule>
|
||||
+</Benchmark>
|
||||
@ -1,124 +0,0 @@
|
||||
From ea87ecab21a54741e64680977521837ccaf0206b Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 5 Oct 2021 14:33:37 +0200
|
||||
Subject: [PATCH] Allow empty /proc in offline mode
|
||||
|
||||
When scanning offline file systems the /proc might be empty. Currently,
|
||||
OpenSCAP thinks that it means a permissions problems, which is often
|
||||
true if it happens on a real system, but in offline mode it can be a
|
||||
normal situation. We will not consider empty /proc an error in offline
|
||||
mode.
|
||||
|
||||
The commit also includes a simple test case.
|
||||
|
||||
Inspired by eda9881e08f0398d1481f133fbb56c0080cfe9f3
|
||||
|
||||
Resolves: RHBZ #2008922
|
||||
---
|
||||
src/OVAL/probes/unix/process58_probe.c | 18 ++++++++++----
|
||||
tests/probes/process58/CMakeLists.txt | 1 +
|
||||
tests/probes/process58/empty_proc.sh | 33 ++++++++++++++++++++++++++
|
||||
3 files changed, 47 insertions(+), 5 deletions(-)
|
||||
create mode 100755 tests/probes/process58/empty_proc.sh
|
||||
|
||||
diff --git a/src/OVAL/probes/unix/process58_probe.c b/src/OVAL/probes/unix/process58_probe.c
|
||||
index d1108fc59..29c582152 100644
|
||||
--- a/src/OVAL/probes/unix/process58_probe.c
|
||||
+++ b/src/OVAL/probes/unix/process58_probe.c
|
||||
@@ -472,7 +472,7 @@ static inline char *make_defunc_str(char* const cmd_buffer){
|
||||
static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||||
{
|
||||
char buf[PATH_MAX];
|
||||
- int err = PROBE_EACCESS, max_cap_id;
|
||||
+ int max_cap_id;
|
||||
DIR *d;
|
||||
struct dirent *ent;
|
||||
oval_schema_version_t oval_version;
|
||||
@@ -501,6 +501,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||||
cmd_buffer[0] = '[';
|
||||
|
||||
// Scan the directories
|
||||
+ bool any_pid_dir_found = false;
|
||||
while (( ent = readdir(d) )) {
|
||||
int fd, len;
|
||||
char *tmp, state, tty_dev[128];
|
||||
@@ -562,9 +563,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||||
}
|
||||
}
|
||||
|
||||
-
|
||||
- err = PROBE_ESUCCESS; // If we get this far, no permission problems
|
||||
- dI("Have command: %s", cmd);
|
||||
+ any_pid_dir_found = true;
|
||||
cmd_sexp = SEXP_string_newf("%s", cmd);
|
||||
pid_sexp = SEXP_number_newu_32(pid);
|
||||
if ((cmd_sexp == NULL || probe_entobj_cmp(cmd_ent, cmd_sexp) == OVAL_RESULT_TRUE) &&
|
||||
@@ -662,7 +661,16 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
|
||||
}
|
||||
closedir(d);
|
||||
oscap_buffer_free(cmdline_buffer);
|
||||
- return err;
|
||||
+
|
||||
+ if (!any_pid_dir_found) {
|
||||
+ dW("No data about processes could be read from '%s'.", buf);
|
||||
+ }
|
||||
+ // In offline mode, empty /proc might be a normal situation and doesn't
|
||||
+ // have to mean permissions problems
|
||||
+ if (prefix)
|
||||
+ return PROBE_ESUCCESS;
|
||||
+ else
|
||||
+ return any_pid_dir_found ? PROBE_ESUCCESS : PROBE_EACCESS;
|
||||
}
|
||||
|
||||
int process58_probe_offline_mode_supported(void)
|
||||
diff --git a/tests/probes/process58/CMakeLists.txt b/tests/probes/process58/CMakeLists.txt
|
||||
index 17261dbb7..947665de6 100644
|
||||
--- a/tests/probes/process58/CMakeLists.txt
|
||||
+++ b/tests/probes/process58/CMakeLists.txt
|
||||
@@ -2,6 +2,7 @@ if(ENABLE_PROBES_UNIX)
|
||||
add_oscap_test("capability.sh")
|
||||
add_oscap_test("command_line.sh")
|
||||
add_oscap_test("dev_to_tty.sh")
|
||||
+ add_oscap_test("empty_proc.sh")
|
||||
add_oscap_test("loginuid.sh")
|
||||
add_oscap_test("selinux_domain_label.sh")
|
||||
add_oscap_test("sessionid.sh")
|
||||
diff --git a/tests/probes/process58/empty_proc.sh b/tests/probes/process58/empty_proc.sh
|
||||
new file mode 100755
|
||||
index 000000000..2f0334b15
|
||||
--- /dev/null
|
||||
+++ b/tests/probes/process58/empty_proc.sh
|
||||
@@ -0,0 +1,33 @@
|
||||
+#!/usr/bin/env bash
|
||||
+
|
||||
+# This is regression test of RHBZ #2008922
|
||||
+
|
||||
+set -e -o pipefail
|
||||
+
|
||||
+. $builddir/tests/test_common.sh
|
||||
+probecheck "process58" || exit 255
|
||||
+
|
||||
+name=$(basename $0 .sh)
|
||||
+result=$(mktemp ${name}.out.XXXXXX)
|
||||
+stderr=$(mktemp ${name}.err.XXXXXX)
|
||||
+
|
||||
+root=$(mktemp -d)
|
||||
+
|
||||
+# create an empty /proc in the offline file system dir
|
||||
+mkdir -p "$root/proc"
|
||||
+
|
||||
+export OSCAP_PROBE_ROOT="$root"
|
||||
+$OSCAP oval eval --results $result $srcdir/capability.oval.xml 2> $stderr
|
||||
+
|
||||
+[ $? -eq 0 ]
|
||||
+grep -q "^W: oscap:\s\+No data about processes could be read from '$root/proc'." "$stderr"
|
||||
+grep -q "OpenSCAP Error: Probe at sd=1 (process58) reported an error: Operation not permitted" "$stderr" && false
|
||||
+grep -q "W: oscap:\s\+Can't receive message: 125, Operation canceled." "$stderr" && false
|
||||
+
|
||||
+[ -s "$result" ]
|
||||
+assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'
|
||||
+assert_exists 1 '/oval_results/results/system/oval_system_characteristics/collected_objects/object[@flag="does not exist"]'
|
||||
+
|
||||
+rm "$stderr"
|
||||
+rm "$result"
|
||||
+rm -r "$root"
|
||||
@ -1,41 +0,0 @@
|
||||
From ce74fde37771fa2cf6d947e5aaeebd9a197db50b Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 9 Nov 2021 09:15:20 +0100
|
||||
Subject: [PATCH] Print warning for local files
|
||||
|
||||
This will explicitely display users that they're using local
|
||||
files instead of the remote resource.
|
||||
|
||||
See https://bugzilla.redhat.com/show_bug.cgi?id=1970529#c6
|
||||
---
|
||||
src/DS/sds.c | 4 +++-
|
||||
tests/DS/test_ds_use_local_remote_resources.sh | 1 +
|
||||
2 files changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/DS/sds.c b/src/DS/sds.c
|
||||
index a26fdbb09..243b62968 100644
|
||||
--- a/src/DS/sds.c
|
||||
+++ b/src/DS/sds.c
|
||||
@@ -407,7 +407,9 @@ static int _handle_disabled_downloads(struct ds_sds_session *session, const char
|
||||
char *local_filepath = oscap_path_join(local_files, relative_filepath);
|
||||
struct stat sb;
|
||||
if (stat(local_filepath, &sb) == 0) {
|
||||
- dI("Using local file '%s' instead of '%s'", local_filepath, xlink_href);
|
||||
+ ds_sds_session_remote_resources_progress(session)(true,
|
||||
+ "WARNING: Using local file '%s' instead of '%s'",
|
||||
+ local_filepath, xlink_href);
|
||||
struct oscap_source *source_file = oscap_source_new_from_file(local_filepath);
|
||||
xmlDoc *doc = oscap_source_get_xmlDoc(source_file);
|
||||
if (doc == NULL) {
|
||||
diff --git a/tests/DS/test_ds_use_local_remote_resources.sh b/tests/DS/test_ds_use_local_remote_resources.sh
|
||||
index 789dc8326..2feb47da1 100755
|
||||
--- a/tests/DS/test_ds_use_local_remote_resources.sh
|
||||
+++ b/tests/DS/test_ds_use_local_remote_resources.sh
|
||||
@@ -24,6 +24,7 @@ $OSCAP xccdf eval --local-files "$tmpdir3" --profile "$PROFILE" --results "$resu
|
||||
|
||||
grep -q "WARNING: Datastream component 'scap_org.open-scap_cref_remote.oval.xml' points out to the remote 'https://www.example.com/security/data/oval/remote.oval.xml'. Use '--fetch-remote-resources' option to download it." "$stderr" && false
|
||||
grep -q "WARNING: Skipping 'https://www.example.com/security/data/oval/remote.oval.xml' file which is referenced from datastream" "$stderr" && false
|
||||
+grep -q "WARNING: Using local file '$tmpdir3/remote.oval.xml' instead of 'https://www.example.com/security/data/oval/remote.oval.xml'" "$stderr"
|
||||
|
||||
assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass"]/result[text()="pass"]'
|
||||
# the remote_res rule is a multicheck with 2 oval definitions so it's twice here
|
||||
@ -1,242 +0,0 @@
|
||||
From a7a0c4a3f528594bb3181174b6986e9c50a684b4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Mon, 30 Aug 2021 15:44:37 +0200
|
||||
Subject: [PATCH 1/3] Lower memory limits and improve their checking
|
||||
|
||||
This patch attempts to mitigate problems caused by a large amount of
|
||||
collected objects such as rhbz#1932833.
|
||||
|
||||
Specifically, these changes are made:
|
||||
- Lower the threshold so that the amount of used memory is checked when
|
||||
only 1000 items are collected for the given OVAL object. That's
|
||||
because 32768 items (the original value) is already a large amount which
|
||||
occupies a lot of memory during further processing.
|
||||
- Lower the memory usage ratio limit for the probe to 10 %. We have
|
||||
found experimentally that giving the probe 15 % or more will cause the
|
||||
oscap process to be killed when processing the collected data and
|
||||
generating results.
|
||||
- In the calling function probe_item_collect, distinguish between return
|
||||
codes which means different behavior when there is insufficient memory
|
||||
than when the memory consumption can't be checked.
|
||||
- Improve the warning message to show greater details about memory
|
||||
consumption to the user.
|
||||
- Remove the check for the absolute amount of remaining free memory. As
|
||||
we can see on the example of rhbz#1932833, on systems with large
|
||||
amount of memory the remaining memory of 512 MB isn't enough memory for
|
||||
openscap to process the collected data. At the same time, if we lowered
|
||||
the usage ratio, we don't need this anymore.
|
||||
- Remove useless message "spt:" from the verbose log because it's
|
||||
produced many times and pollutes the log extremely.
|
||||
---
|
||||
src/OVAL/probes/probe/icache.c | 23 +++++++++++------------
|
||||
src/common/memusage.c | 2 --
|
||||
2 files changed, 11 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/OVAL/probes/probe/icache.c b/src/OVAL/probes/probe/icache.c
|
||||
index 7e16daa334..af7b528372 100644
|
||||
--- a/src/OVAL/probes/probe/icache.c
|
||||
+++ b/src/OVAL/probes/probe/icache.c
|
||||
@@ -487,9 +487,8 @@ int probe_icache_nop(probe_icache_t *cache)
|
||||
return (0);
|
||||
}
|
||||
|
||||
-#define PROBE_RESULT_MEMCHECK_CTRESHOLD 32768 /* item count */
|
||||
-#define PROBE_RESULT_MEMCHECK_MINFREEMEM 512 /* MiB */
|
||||
-#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.8 /* max. memory usage ratio - used/total */
|
||||
+#define PROBE_RESULT_MEMCHECK_CTRESHOLD 1000 /* item count */
|
||||
+#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.1 /* max. memory usage ratio - used/total */
|
||||
|
||||
/**
|
||||
* Returns 0 if the memory constraints are not reached. Otherwise, 1 is returned.
|
||||
@@ -511,18 +510,12 @@ static int probe_cobj_memcheck(size_t item_cnt)
|
||||
c_ratio = (double)mu_proc.mu_rss/(double)(mu_sys.mu_total);
|
||||
|
||||
if (c_ratio > PROBE_RESULT_MEMCHECK_MAXRATIO) {
|
||||
- dW("Memory usage ratio limit reached! limit=%f, current=%f",
|
||||
- PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio);
|
||||
+ dW("Memory usage ratio limit reached! limit=%f, current=%f, used=%ld MB, free=%ld MB, total=%ld MB, count of items=%ld",
|
||||
+ PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
|
||||
errno = ENOMEM;
|
||||
return (1);
|
||||
}
|
||||
|
||||
- if ((mu_sys.mu_realfree / 1024) < PROBE_RESULT_MEMCHECK_MINFREEMEM) {
|
||||
- dW("Minimum free memory limit reached! limit=%zu, current=%zu",
|
||||
- PROBE_RESULT_MEMCHECK_MINFREEMEM, mu_sys.mu_realfree / 1024);
|
||||
- errno = ENOMEM;
|
||||
- return (1);
|
||||
- }
|
||||
}
|
||||
|
||||
return (0);
|
||||
@@ -547,6 +540,7 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
|
||||
{
|
||||
SEXP_t *cobj_content;
|
||||
size_t cobj_itemcnt;
|
||||
+ int memcheck_ret;
|
||||
|
||||
if (ctx == NULL || ctx->probe_out == NULL || item == NULL) {
|
||||
return -1;
|
||||
@@ -556,7 +550,12 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
|
||||
cobj_itemcnt = SEXP_list_length(cobj_content);
|
||||
SEXP_free(cobj_content);
|
||||
|
||||
- if (probe_cobj_memcheck(cobj_itemcnt) != 0) {
|
||||
+ memcheck_ret = probe_cobj_memcheck(cobj_itemcnt);
|
||||
+ if (memcheck_ret == -1) {
|
||||
+ dE("Failed to check available memory");
|
||||
+ return -1;
|
||||
+ }
|
||||
+ if (memcheck_ret == 1) {
|
||||
|
||||
/*
|
||||
* Don't set the message again if the collected object is
|
||||
diff --git a/src/common/memusage.c b/src/common/memusage.c
|
||||
index fc6909e6fb..c6755f21f1 100644
|
||||
--- a/src/common/memusage.c
|
||||
+++ b/src/common/memusage.c
|
||||
@@ -137,8 +137,6 @@ static int read_status(const char *source, void *base, struct stat_parser *spt,
|
||||
sp = oscap_bfind(spt, spt_size, sizeof(struct stat_parser),
|
||||
linebuf, (int(*)(void *, void *))&cmpkey);
|
||||
|
||||
- dD("spt: %s", linebuf);
|
||||
-
|
||||
if (sp == NULL) {
|
||||
/* drop end of unread line */
|
||||
while (strchr(strval, '\n') == NULL) {
|
||||
|
||||
From ded3d58cd62259b217a9ab35030827ac3cb8dd45 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 7 Sep 2021 13:52:50 +0200
|
||||
Subject: [PATCH 2/3] Allow to set memory ratio by environment variable
|
||||
|
||||
If the probe memory usage ratio limit will be too small or too big
|
||||
in some situation, the user will be able to modify the limit easily
|
||||
by setting the environment variable OSCAP_PROBE_MEMORY_USAGE_RATIO
|
||||
to a different value. This can also help users when debugging memory
|
||||
problems.
|
||||
---
|
||||
docs/manual/manual.adoc | 1 +
|
||||
src/OVAL/probes/probe/icache.c | 9 ++++-----
|
||||
src/OVAL/probes/probe/probe.h | 1 +
|
||||
src/OVAL/probes/probe/worker.c | 12 ++++++++++++
|
||||
4 files changed, 18 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc
|
||||
index 90e2cc2c63..825844bc71 100644
|
||||
--- a/docs/manual/manual.adoc
|
||||
+++ b/docs/manual/manual.adoc
|
||||
@@ -1613,6 +1613,7 @@ not considered local by the scanner:
|
||||
* `OSCAP_PROBE_ROOT` - Path to a directory which contains mounted filesystem to be evaluated. Used for offline scanning.
|
||||
* `SEXP_VALIDATE_DISABLE` - If set, `oscap` will not validate SEXP expressions during its execution.
|
||||
* `SOURCE_DATE_EPOCH` - Timestamp in seconds since epoch. This timestamp will be used instead of the current time to populate `timestamp` attributes in SCAP source data streams created by `oscap ds sds-compose` sub-module. This is used for reproducible builds of data streams.
|
||||
+* `OSCAP_PROBE_MEMORY_USAGE_RATIO` - maximum memory usage ratio (used/total) for OpenSCAP probes, default: 0.1
|
||||
|
||||
Also, OpenSCAP uses `libcurl` library which also can be configured using environment variables. See https://curl.se/libcurl/c/libcurl-env.html[the list of libcurl environment variables].
|
||||
|
||||
diff --git a/src/OVAL/probes/probe/icache.c b/src/OVAL/probes/probe/icache.c
|
||||
index af7b528372..a397d35ec2 100644
|
||||
--- a/src/OVAL/probes/probe/icache.c
|
||||
+++ b/src/OVAL/probes/probe/icache.c
|
||||
@@ -488,13 +488,12 @@ int probe_icache_nop(probe_icache_t *cache)
|
||||
}
|
||||
|
||||
#define PROBE_RESULT_MEMCHECK_CTRESHOLD 1000 /* item count */
|
||||
-#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.1 /* max. memory usage ratio - used/total */
|
||||
|
||||
/**
|
||||
* Returns 0 if the memory constraints are not reached. Otherwise, 1 is returned.
|
||||
* In case of an error, -1 is returned.
|
||||
*/
|
||||
-static int probe_cobj_memcheck(size_t item_cnt)
|
||||
+static int probe_cobj_memcheck(size_t item_cnt, double max_ratio)
|
||||
{
|
||||
if (item_cnt > PROBE_RESULT_MEMCHECK_CTRESHOLD) {
|
||||
struct proc_memusage mu_proc;
|
||||
@@ -509,9 +508,9 @@ static int probe_cobj_memcheck(size_t item_cnt)
|
||||
|
||||
c_ratio = (double)mu_proc.mu_rss/(double)(mu_sys.mu_total);
|
||||
|
||||
- if (c_ratio > PROBE_RESULT_MEMCHECK_MAXRATIO) {
|
||||
+ if (c_ratio > max_ratio) {
|
||||
dW("Memory usage ratio limit reached! limit=%f, current=%f, used=%ld MB, free=%ld MB, total=%ld MB, count of items=%ld",
|
||||
- PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
|
||||
+ max_ratio, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
|
||||
errno = ENOMEM;
|
||||
return (1);
|
||||
}
|
||||
@@ -550,7 +549,7 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
|
||||
cobj_itemcnt = SEXP_list_length(cobj_content);
|
||||
SEXP_free(cobj_content);
|
||||
|
||||
- memcheck_ret = probe_cobj_memcheck(cobj_itemcnt);
|
||||
+ memcheck_ret = probe_cobj_memcheck(cobj_itemcnt, ctx->max_mem_ratio);
|
||||
if (memcheck_ret == -1) {
|
||||
dE("Failed to check available memory");
|
||||
return -1;
|
||||
diff --git a/src/OVAL/probes/probe/probe.h b/src/OVAL/probes/probe/probe.h
|
||||
index 1c7a3b1b00..d3a488c4d5 100644
|
||||
--- a/src/OVAL/probes/probe/probe.h
|
||||
+++ b/src/OVAL/probes/probe/probe.h
|
||||
@@ -83,6 +83,7 @@ struct probe_ctx {
|
||||
SEXP_t *filters; /**< object filters (OVAL 5.8 and higher) */
|
||||
probe_icache_t *icache; /**< item cache */
|
||||
int offline_mode;
|
||||
+ double max_mem_ratio;
|
||||
};
|
||||
|
||||
typedef enum {
|
||||
diff --git a/src/OVAL/probes/probe/worker.c b/src/OVAL/probes/probe/worker.c
|
||||
index 94fe5c2037..3ef489b40d 100644
|
||||
--- a/src/OVAL/probes/probe/worker.c
|
||||
+++ b/src/OVAL/probes/probe/worker.c
|
||||
@@ -52,6 +52,10 @@ extern int chroot(const char *);
|
||||
#include "probe-table.h"
|
||||
#include "probe.h"
|
||||
|
||||
+/* default max. memory usage ratio - used/total */
|
||||
+/* can be overridden by environment variable OSCAP_PROBE_MEMORY_USAGE_RATIO */
|
||||
+#define OSCAP_PROBE_MEMORY_USAGE_RATIO_DEFAULT 0.1
|
||||
+
|
||||
extern bool OSCAP_GSYM(varref_handling);
|
||||
extern void *OSCAP_GSYM(probe_arg);
|
||||
|
||||
@@ -1064,6 +1068,14 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
|
||||
|
||||
pctx.offline_mode = probe->selected_offline_mode;
|
||||
|
||||
+ pctx.max_mem_ratio = OSCAP_PROBE_MEMORY_USAGE_RATIO_DEFAULT;
|
||||
+ char *max_ratio_str = getenv("OSCAP_PROBE_MEMORY_USAGE_RATIO");
|
||||
+ if (max_ratio_str != NULL) {
|
||||
+ double max_ratio = strtod(max_ratio_str, NULL);
|
||||
+ if (max_ratio != 0)
|
||||
+ pctx.max_mem_ratio = max_ratio;
|
||||
+ }
|
||||
+
|
||||
/* simple object */
|
||||
pctx.icache = probe->icache;
|
||||
pctx.filters = probe_prepare_filters(probe, probe_in);
|
||||
|
||||
From 0f5cf5b09f469920616a2037d0f9c81cf0868a58 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Wed, 15 Sep 2021 14:41:30 +0200
|
||||
Subject: [PATCH 3/3] Update src/OVAL/probes/probe/worker.c
|
||||
|
||||
Co-authored-by: Evgeny Kolesnikov <evgenyz@gmail.com>
|
||||
---
|
||||
src/OVAL/probes/probe/worker.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/OVAL/probes/probe/worker.c b/src/OVAL/probes/probe/worker.c
|
||||
index 3ef489b40d..1183ed06bf 100644
|
||||
--- a/src/OVAL/probes/probe/worker.c
|
||||
+++ b/src/OVAL/probes/probe/worker.c
|
||||
@@ -1072,7 +1072,7 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
|
||||
char *max_ratio_str = getenv("OSCAP_PROBE_MEMORY_USAGE_RATIO");
|
||||
if (max_ratio_str != NULL) {
|
||||
double max_ratio = strtod(max_ratio_str, NULL);
|
||||
- if (max_ratio != 0)
|
||||
+ if (max_ratio > 0)
|
||||
pctx.max_mem_ratio = max_ratio;
|
||||
}
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
From 27a946ade5db2356415878626509fd7e21d8c1c8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Wed, 10 Nov 2021 14:42:11 +0100
|
||||
Subject: [PATCH] Do not put footer to the user manual
|
||||
|
||||
The footer contains the date of the last build.
|
||||
|
||||
Different date can cause this problem of rpmdeplint:
|
||||
Undeclared file conflicts:
|
||||
openscap-1.3.5-8.el8.i686 provides /usr/share/doc/openscap/manual/manual.html which is also provided by openscap-1.3.5-8.el8.x86_64
|
||||
openscap-1.3.5-8.el8.x86_64 provides /usr/share/doc/openscap/manual/manual.html which is also provided by openscap-1.3.5-8.el8.i686
|
||||
|
||||
We can avoid it by simply removing the date.
|
||||
---
|
||||
docs/manual/manual.adoc | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc
|
||||
index 90e2cc2c6..993e1dadc 100644
|
||||
--- a/docs/manual/manual.adoc
|
||||
+++ b/docs/manual/manual.adoc
|
||||
@@ -29,6 +29,7 @@
|
||||
:toclevels: 4
|
||||
:toc-placement: preamble
|
||||
:numbered:
|
||||
+:footer-style: none
|
||||
|
||||
image::vertical-logo.png[align="center"]
|
||||
|
||||
104
SOURCES/openscap-1.3.7-PR-1841-coverity.patch
Normal file
104
SOURCES/openscap-1.3.7-PR-1841-coverity.patch
Normal file
@ -0,0 +1,104 @@
|
||||
From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 27 Jan 2022 15:00:33 +0100
|
||||
Subject: [PATCH 1/3] Fix shellcheck warning
|
||||
|
||||
Addressing:
|
||||
|
||||
Error: SHELLCHECK_WARNING (CWE-138): [#def1]
|
||||
/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
|
||||
108| args+=( "--remediate" )
|
||||
109| args+=( "${OSCAP_REMEDIATE_DS}" )
|
||||
110|-> log "Args: ${args[@]}"
|
||||
111|
|
||||
112| # Now we are good to go
|
||||
---
|
||||
utils/oscap-remediate | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/utils/oscap-remediate b/utils/oscap-remediate
|
||||
index fc0b7715f..52e29aa66 100755
|
||||
--- a/utils/oscap-remediate
|
||||
+++ b/utils/oscap-remediate
|
||||
@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
|
||||
args+=( "--progress-full" )
|
||||
args+=( "--remediate" )
|
||||
args+=( "${OSCAP_REMEDIATE_DS}" )
|
||||
-log "Args: ${args[@]}"
|
||||
+log "Args: ${args[*]}"
|
||||
|
||||
# Now we are good to go
|
||||
header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
|
||||
|
||||
From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 27 Jan 2022 15:09:02 +0100
|
||||
Subject: [PATCH 2/3] Remove superfluous strdup
|
||||
|
||||
We can do this because xccdf_session_set_rule calls strdup on the rule
|
||||
parameter internally.
|
||||
|
||||
Addressing:
|
||||
|
||||
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
|
||||
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
|
||||
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
|
||||
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
|
||||
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
|
||||
4148| char *n_rule = strdup(rule);
|
||||
4149| xccdf_session_set_rule(sess, n_rule);
|
||||
4150|-> }
|
||||
4151|
|
||||
4152| void xccdf_session_free_py(struct xccdf_session *sess){
|
||||
---
|
||||
swig/openscap.i | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/swig/openscap.i b/swig/openscap.i
|
||||
index 2fe1cce99..158a22675 100644
|
||||
--- a/swig/openscap.i
|
||||
+++ b/swig/openscap.i
|
||||
@@ -559,8 +559,7 @@ struct xccdf_session {
|
||||
};
|
||||
|
||||
void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) {
|
||||
- char *n_rule = strdup(rule);
|
||||
- xccdf_session_set_rule(sess, n_rule);
|
||||
+ xccdf_session_set_rule(sess, rule);
|
||||
}
|
||||
|
||||
void xccdf_session_free_py(struct xccdf_session *sess){
|
||||
|
||||
From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Thu, 27 Jan 2022 15:16:02 +0100
|
||||
Subject: [PATCH 3/3] Add a missing free
|
||||
|
||||
Addressing:
|
||||
Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
|
||||
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
|
||||
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
|
||||
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
|
||||
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
|
||||
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
|
||||
2148| oscap_seterr(OSCAP_EFAMILY_XCCDF,
|
||||
2149| "Rule '%s' not found in selected profile.", rule_id);
|
||||
2150|-> return NULL;
|
||||
2151| }
|
||||
2152| }
|
||||
---
|
||||
src/XCCDF_POLICY/xccdf_policy.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
|
||||
index b63853a38..4d4b7ad0a 100644
|
||||
--- a/src/XCCDF_POLICY/xccdf_policy.c
|
||||
+++ b/src/XCCDF_POLICY/xccdf_policy.c
|
||||
@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
|
||||
if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
|
||||
oscap_seterr(OSCAP_EFAMILY_XCCDF,
|
||||
"Rule '%s' not found in selected profile.", rule_id);
|
||||
+ oscap_htable_iterator_free(rit);
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
32
SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
Normal file
32
SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
Normal file
@ -0,0 +1,32 @@
|
||||
From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Mon, 31 Jan 2022 13:45:15 +0100
|
||||
Subject: [PATCH] Prevent fails of test_ds_misc.sh
|
||||
|
||||
The SOURCE_DATE_EPOCH environment variable is effective only when it's
|
||||
set to a value that's older than mtime of the processed file. See the
|
||||
implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
|
||||
However, the file in our test suite has originally been created before
|
||||
(in 2019) and this mtime can be used when a tarball is produced. To
|
||||
avoid the test failing, we can modify the mtime using the touch command
|
||||
just before we run the tests.
|
||||
---
|
||||
tests/DS/test_ds_misc.sh | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
|
||||
index 159007518..cffbef303 100755
|
||||
--- a/tests/DS/test_ds_misc.sh
|
||||
+++ b/tests/DS/test_ds_misc.sh
|
||||
@@ -269,6 +269,8 @@ function test_source_date_epoch() {
|
||||
local timestamp="2020-03-05T12:09:37"
|
||||
export SOURCE_DATE_EPOCH="1583410177"
|
||||
export TZ=UTC
|
||||
+ # ensure the file mtime is always newer than the $timestamp
|
||||
+ touch -c "$xccdf"
|
||||
$OSCAP ds sds-compose "$xccdf" "$result"
|
||||
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
|
||||
rm -f "$result"
|
||||
--
|
||||
2.34.1
|
||||
|
||||
27
SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
Normal file
27
SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
Normal file
@ -0,0 +1,27 @@
|
||||
From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
|
||||
Date: Tue, 1 Feb 2022 15:06:33 +0100
|
||||
Subject: [PATCH] Prevent fails of test_ds_misc.sh
|
||||
|
||||
Other files from which the datastream is composed might also
|
||||
affect the timestamp attributes in result document depending
|
||||
on their mtime.
|
||||
---
|
||||
tests/DS/test_ds_misc.sh | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
|
||||
index cffbef303..1777c44f4 100755
|
||||
--- a/tests/DS/test_ds_misc.sh
|
||||
+++ b/tests/DS/test_ds_misc.sh
|
||||
@@ -270,7 +270,9 @@ function test_source_date_epoch() {
|
||||
export SOURCE_DATE_EPOCH="1583410177"
|
||||
export TZ=UTC
|
||||
# ensure the file mtime is always newer than the $timestamp
|
||||
- touch -c "$xccdf"
|
||||
+ touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
|
||||
+ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
|
||||
+ touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
|
||||
$OSCAP ds sds-compose "$xccdf" "$result"
|
||||
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
|
||||
rm -f "$result"
|
||||
@ -1,27 +1,14 @@
|
||||
Name: openscap
|
||||
Version: 1.3.5
|
||||
Release: 10%{?dist}
|
||||
Version: 1.3.6
|
||||
Release: 3%{?dist}
|
||||
Summary: Set of open source libraries enabling integration of the SCAP line of standards
|
||||
Group: System Environment/Libraries
|
||||
License: LGPLv2+
|
||||
URL: http://www.open-scap.org/
|
||||
Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
|
||||
Patch1: openscap-1.3.6-PR-1745-waive-hugepages.patch
|
||||
Patch2: openscap-1.3.6-PR-1748-covscan.patch
|
||||
Patch3: openscap-1.3.6-PR-1749-blueprint-fix.patch
|
||||
Patch4: openscap-1.3.6-PR-1753-getlogin.patch
|
||||
Patch5: openscap-1.3.6-PR-1756-yaml-nulls.patch
|
||||
Patch6: openscap-1.3.6-PR-1779-initialize-crapi-once.patch
|
||||
Patch7: openscap-1.3.6-PR-1788-test-rhbz1959570.patch
|
||||
Patch8: openscap-1.3.6-PR-1810-blueprint-fix-extra.patch
|
||||
Patch9: openscap-1.3.6-PR-1769-local-ds-components.patch
|
||||
Patch10: openscap-1.3.6-PR-1786-document-local-files-in-oscap-ssh-man-page.patch
|
||||
Patch11: openscap-1.3.6-PR-1772-UBI9.patch
|
||||
Patch12: openscap-1.3.6-PR-1806-alternative-hostname.patch
|
||||
Patch13: openscap-1.3.6-PR-1812-oscap-chroot-process58-empty-proc.patch
|
||||
Patch14: openscap-1.3.6-PR-1827-memory-limit.patch
|
||||
Patch15: openscap-1.3.6-PR-1828-remove-timestamp-from-user-manual.patch
|
||||
Patch16: openscap-1.3.6-PR-1826-warning-local-files.patch
|
||||
Patch1: openscap-1.3.7-PR-1841-coverity.patch
|
||||
Patch2: openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
|
||||
Patch3: openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
|
||||
BuildRequires: cmake >= 2.6
|
||||
BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
|
||||
BuildRequires: rpm-devel
|
||||
@ -171,6 +158,12 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
|
||||
# fix python shebangs
|
||||
pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
|
||||
|
||||
# enable oscap-remediate.service here for now
|
||||
# https://github.com/hughsie/PackageKit/issues/401
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1833176
|
||||
mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/
|
||||
ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service
|
||||
|
||||
%clean
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
@ -210,7 +203,12 @@ rm -rf $RPM_BUILD_ROOT
|
||||
%{_bindir}/oscap
|
||||
%{_mandir}/man8/oscap-chroot.8.gz
|
||||
%{_bindir}/oscap-chroot
|
||||
%{_mandir}/man8/oscap-remediate-offline.8.gz
|
||||
%{_bindir}/oscap-remediate-offline
|
||||
%{_sysconfdir}/bash_completion.d
|
||||
%{_libexecdir}/oscap-remediate
|
||||
%{_unitdir}/oscap-remediate.service
|
||||
%{_unitdir}/system-update.target.wants/
|
||||
|
||||
%files utils
|
||||
%doc docs/oscap-scan.cron
|
||||
@ -230,6 +228,18 @@ rm -rf $RPM_BUILD_ROOT
|
||||
%{_bindir}/oscap-run-sce-script
|
||||
|
||||
%changelog
|
||||
* Wed Feb 02 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-3
|
||||
- Prevent fails of test_ds_misc.sh
|
||||
|
||||
* Mon Jan 31 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-2
|
||||
- Fix coverity issues
|
||||
- Prevent fails of test_ds_misc.sh
|
||||
|
||||
* Thu Jan 20 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-1
|
||||
- Upgrade to the latest upstream release (rhbz#2041781)
|
||||
- Select and exclude groups of rules on the command line
|
||||
- The boot-time remediation service for systemd's Offline Update mode
|
||||
|
||||
* Fri Nov 19 2021 Jan Černý <jcerny@redhat.com> - 1.3.5-10
|
||||
- Print warning for local files
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user