From a08adbff226e354181ed5afa37b713b61c41d57d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 26 Jan 2023 17:35:40 +0100 Subject: [PATCH] openscap-1.3.7 --- ...1.3.7-pr-1841-fix-shellcheck-warning.patch | 104 ----- ...-pr-1843-prevent-fails-of-epoch-test.patch | 29 -- ...r-1844-prevent-fails-of-epoch-test-2.patch | 27 -- ...1846-prevent-file-permissions-errors.patch | 393 ------------------ openscap-1.3.7-pr-1850-relocate-rpmdb.patch | 50 --- openscap-1.3.7-pr-1864-rpm-includes.patch | 81 ---- openscap.spec | 13 +- sources | 2 +- 8 files changed, 6 insertions(+), 693 deletions(-) delete mode 100644 openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch delete mode 100644 openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch delete mode 100644 openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch delete mode 100644 openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch delete mode 100644 openscap-1.3.7-pr-1850-relocate-rpmdb.patch delete mode 100644 openscap-1.3.7-pr-1864-rpm-includes.patch diff --git a/openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch b/openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch deleted file mode 100644 index ce3e58d..0000000 --- a/openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch +++ /dev/null @@ -1,104 +0,0 @@ -From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 27 Jan 2022 15:00:33 +0100 -Subject: [PATCH 1/3] Fix shellcheck warning - -Addressing: - -Error: SHELLCHECK_WARNING (CWE-138): [#def1] -/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument. - 108| args+=( "--remediate" ) - 109| args+=( "${OSCAP_REMEDIATE_DS}" ) - 110|-> log "Args: ${args[@]}" - 111| - 112| # Now we are good to go ---- - utils/oscap-remediate | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/utils/oscap-remediate b/utils/oscap-remediate -index fc0b7715f..52e29aa66 100755 ---- a/utils/oscap-remediate -+++ b/utils/oscap-remediate -@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}" - args+=( "--progress-full" ) - args+=( "--remediate" ) - args+=( "${OSCAP_REMEDIATE_DS}" ) --log "Args: ${args[@]}" -+log "Args: ${args[*]}" - - # Now we are good to go - header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..." - -From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 27 Jan 2022 15:09:02 +0100 -Subject: [PATCH 2/3] Remove superfluous strdup - -We can do this because xccdf_session_set_rule calls strdup on the rule -parameter internally. - -Addressing: - -Error: RESOURCE_LEAK (CWE-772): [#def2] [important] -openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup". -openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)". -openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule". -openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to. - 4148| char *n_rule = strdup(rule); - 4149| xccdf_session_set_rule(sess, n_rule); - 4150|-> } - 4151| - 4152| void xccdf_session_free_py(struct xccdf_session *sess){ ---- - swig/openscap.i | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/swig/openscap.i b/swig/openscap.i -index 2fe1cce99..158a22675 100644 ---- a/swig/openscap.i -+++ b/swig/openscap.i -@@ -559,8 +559,7 @@ struct xccdf_session { - }; - - void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) { -- char *n_rule = strdup(rule); -- xccdf_session_set_rule(sess, n_rule); -+ xccdf_session_set_rule(sess, rule); - } - - void xccdf_session_free_py(struct xccdf_session *sess){ - -From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 27 Jan 2022 15:16:02 +0100 -Subject: [PATCH 3/3] Add a missing free - -Addressing: -Error: RESOURCE_LEAK (CWE-772): [#def4] [important] -openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new". -openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)". -openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more". -openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key". -openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to. - 2148| oscap_seterr(OSCAP_EFAMILY_XCCDF, - 2149| "Rule '%s' not found in selected profile.", rule_id); - 2150|-> return NULL; - 2151| } - 2152| } ---- - src/XCCDF_POLICY/xccdf_policy.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c -index b63853a38..4d4b7ad0a 100644 ---- a/src/XCCDF_POLICY/xccdf_policy.c -+++ b/src/XCCDF_POLICY/xccdf_policy.c -@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy) - if (oscap_htable_get(policy->rules_found, rule_id) == NULL) { - oscap_seterr(OSCAP_EFAMILY_XCCDF, - "Rule '%s' not found in selected profile.", rule_id); -+ oscap_htable_iterator_free(rit); - return NULL; - } - } diff --git a/openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch b/openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch deleted file mode 100644 index d630fa3..0000000 --- a/openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch +++ /dev/null @@ -1,29 +0,0 @@ -From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Mon, 31 Jan 2022 13:45:15 +0100 -Subject: [PATCH] Prevent fails of test_ds_misc.sh - -The SOURCE_DATE_EPOCH environment variable is effective only when it's -set to a value that's older than mtime of the processed file. See the -implementation in ds_sds_compose_add_component_internal in src/DS/sds.c. -However, the file in our test suite has originally been created before -(in 2019) and this mtime can be used when a tarball is produced. To -avoid the test failing, we can modify the mtime using the touch command -just before we run the tests. ---- - tests/DS/test_ds_misc.sh | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh -index 159007518..cffbef303 100755 ---- a/tests/DS/test_ds_misc.sh -+++ b/tests/DS/test_ds_misc.sh -@@ -269,6 +269,8 @@ function test_source_date_epoch() { - local timestamp="2020-03-05T12:09:37" - export SOURCE_DATE_EPOCH="1583410177" - export TZ=UTC -+ # ensure the file mtime is always newer than the $timestamp -+ touch -c "$xccdf" - $OSCAP ds sds-compose "$xccdf" "$result" - assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]' - rm -f "$result" diff --git a/openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch b/openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch deleted file mode 100644 index 25c9e3a..0000000 --- a/openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Tue, 1 Feb 2022 15:06:33 +0100 -Subject: [PATCH] Prevent fails of test_ds_misc.sh - -Other files from which the datastream is composed might also -affect the timestamp attributes in result document depending -on their mtime. ---- - tests/DS/test_ds_misc.sh | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh -index cffbef303..1777c44f4 100755 ---- a/tests/DS/test_ds_misc.sh -+++ b/tests/DS/test_ds_misc.sh -@@ -270,7 +270,9 @@ function test_source_date_epoch() { - export SOURCE_DATE_EPOCH="1583410177" - export TZ=UTC - # ensure the file mtime is always newer than the $timestamp -- touch -c "$xccdf" -+ touch -c "$srcdir/sds_multiple_oval/first-oval.xml" -+ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml" -+ touch -c "$srcdir/sds_multiple_oval/second-oval.xml" - $OSCAP ds sds-compose "$xccdf" "$result" - assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]' - rm -f "$result" diff --git a/openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch b/openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch deleted file mode 100644 index ff32d68..0000000 --- a/openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch +++ /dev/null @@ -1,393 +0,0 @@ -From d000375944e8ec965486cf019c3f75f4c06a4e10 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 3 Feb 2022 14:14:21 +0100 -Subject: [PATCH 1/5] Prevent file permissions errors - -The sysctl setting `fs.protected_regular` doesn't allow `O_CREAT` open -on regular files that we don't own in world writable sticky directories -(think `/tmp`). This causes permission denied error when writing HTML -report to a temporary files created by the `mktemp` command executed as -a normal user and then executing `sudo oscap`. - -See https://bugzilla.redhat.com/show_bug.cgi?id=2048571 - -If OpenSCAP fails to open the file because of permissions, it will retry -to open the file without O_CREAT flag. - -This fixes only creation of the HTML report using the `--report` option, -We will have to create a similar patch also for other output options -such as `--results` or `--results-arf`. ---- - src/source/xslt.c | 40 ++++++++++++++++++++++++++++------------ - 1 file changed, 28 insertions(+), 12 deletions(-) - -diff --git a/src/source/xslt.c b/src/source/xslt.c -index 24c4c46e9..7a3a3f328 100644 ---- a/src/source/xslt.c -+++ b/src/source/xslt.c -@@ -22,6 +22,7 @@ - #include - #endif - -+#include - #include - #include - #include -@@ -82,23 +83,38 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node) - - static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile) - { -- FILE *f = NULL; -- if (outfile) -- f = fopen(outfile, "w"); -- else -- f = stdout; -- -- if (f == NULL) { -- oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not open output file '%s'", outfile ? outfile : "stdout"); -- return -1; -+ int fd = STDOUT_FILENO; -+ if (outfile) { -+#ifdef OS_WINDOWS -+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE); -+#else -+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); -+#endif -+ if (fd == -1) { -+ if (errno == EACCES) { -+ /* File already exists and we aren't allowed to create a new one -+ with the same name */ -+#ifdef OS_WINDOWS -+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE); -+#else -+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); -+#endif -+ } -+ if (fd == -1) { -+ oscap_seterr(OSCAP_EFAMILY_OSCAP, -+ "Could not open output file '%s': %s", -+ outfile, strerror(errno)); -+ return -1; -+ } -+ } - } - -- int ret = xsltSaveResultToFile(f, resulting_doc, stylesheet); -+ int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet); - if (ret < 0) { - oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document"); - } -- if (outfile && f) -- fclose(f); -+ if (fd != STDOUT_FILENO) -+ close(fd); - return ret; - } - - -From ad3c89a72c0aeb6c6ceab0873c51b07deba45701 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 3 Feb 2022 15:08:52 +0100 -Subject: [PATCH 2/5] Prevent permission access issues - -Very similar to the previous commit, but this time for saving XML -documents. ---- - src/common/elements.c | 19 ++++++++++++++++--- - 1 file changed, 16 insertions(+), 3 deletions(-) - -diff --git a/src/common/elements.c b/src/common/elements.c -index e512f5e3d..d0d9170f1 100644 ---- a/src/common/elements.c -+++ b/src/common/elements.c -@@ -233,9 +233,22 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc) - int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, - S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); - #endif -- if (fd < 0) { -- oscap_seterr(OSCAP_EFAMILY_GLIBC, "%s '%s'", strerror(errno), filename); -- return -1; -+ if (fd == -1) { -+ if (errno == EACCES) { -+ /* File already exists and we aren't allowed to create a new one -+ with the same name */ -+#ifdef OS_WINDOWS -+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE); -+#else -+ fd = open(filename, O_WRONLY|O_TRUNC, -+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); -+#endif -+ } -+ if (fd == -1) { -+ oscap_seterr(OSCAP_EFAMILY_GLIBC, -+ "%s '%s'", strerror(errno), filename); -+ return -1; -+ } - } - - buff = xmlOutputBufferCreateFd(fd, NULL); - -From b2dc90fb80419e30d05676660a2069050693078d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 3 Feb 2022 15:37:31 +0100 -Subject: [PATCH 3/5] Add a missing include - ---- - src/source/xslt.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/source/xslt.c b/src/source/xslt.c -index 7a3a3f328..a763d6b59 100644 ---- a/src/source/xslt.c -+++ b/src/source/xslt.c -@@ -30,6 +30,8 @@ - #include - #include - #include -+#include -+ - #ifdef OS_WINDOWS - #include - #else - -From 13ff98bd744ea542bc782e388fdedb5b7f66e54b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 3 Feb 2022 16:22:56 +0100 -Subject: [PATCH 4/5] Fix missing STDOUT_FILENO on Windows - ---- - src/source/xslt.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/src/source/xslt.c b/src/source/xslt.c -index a763d6b59..799d5170d 100644 ---- a/src/source/xslt.c -+++ b/src/source/xslt.c -@@ -85,7 +85,11 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node) - - static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile) - { -+#ifdef OS_WINDOWS -+ int fd = _fileno(stdout); -+#else - int fd = STDOUT_FILENO; -+#endif - if (outfile) { - #ifdef OS_WINDOWS - fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE); -@@ -115,7 +119,11 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl - if (ret < 0) { - oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document"); - } -+#ifdef OS_WINDOWS -+ if (fd != _fileno(stdout)) -+#else - if (fd != STDOUT_FILENO) -+#endif - close(fd); - return ret; - } - -From f00831513ec2cdde13c12820ff6cc0eef8105c65 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Fri, 4 Feb 2022 12:19:50 +0100 -Subject: [PATCH 5/5] Refactor: extract function oscap_open_writable - ---- - src/common/elements.c | 26 ++-------------- - src/common/util.c | 31 +++++++++++++++++++ - src/common/util.h | 14 ++++++++- - src/source/xslt.c | 27 ++-------------- - tests/API/XCCDF/unittests/CMakeLists.txt | 2 ++ - tests/API/XCCDF/unittests/test_oscap_common.c | 1 + - 6 files changed, 53 insertions(+), 48 deletions(-) - -diff --git a/src/common/elements.c b/src/common/elements.c -index d0d9170f1..de4be88f1 100644 ---- a/src/common/elements.c -+++ b/src/common/elements.c -@@ -227,29 +227,9 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc) - xmlCode = xmlSaveFormatFileEnc(filename, doc, "UTF-8", 1); - } - else { --#ifdef OS_WINDOWS -- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, S_IREAD|S_IWRITE); --#else -- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, -- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); --#endif -- if (fd == -1) { -- if (errno == EACCES) { -- /* File already exists and we aren't allowed to create a new one -- with the same name */ --#ifdef OS_WINDOWS -- fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE); --#else -- fd = open(filename, O_WRONLY|O_TRUNC, -- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); --#endif -- } -- if (fd == -1) { -- oscap_seterr(OSCAP_EFAMILY_GLIBC, -- "%s '%s'", strerror(errno), filename); -- return -1; -- } -- } -+ int fd = oscap_open_writable(filename); -+ if (fd == -1) -+ return -1; - - buff = xmlOutputBufferCreateFd(fd, NULL); - if (buff == NULL) { -diff --git a/src/common/util.c b/src/common/util.c -index 8f9f751e2..8ca2ad130 100644 ---- a/src/common/util.c -+++ b/src/common/util.c -@@ -25,12 +25,14 @@ - #include - #endif - -+#include - #include - #include - #include - #include - #include - #include -+#include - - #include "util.h" - #include "_error.h" -@@ -482,3 +484,32 @@ char *oscap_windows_error_message(unsigned long error_code) - return error_message; - } - #endif -+ -+int oscap_open_writable(const char *filename) -+{ -+#ifdef OS_WINDOWS -+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE); -+#else -+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, -+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); -+#endif -+ if (fd == -1) { -+ if (errno == EACCES) { -+ /* File already exists and we aren't allowed to create a new one -+ with the same name */ -+#ifdef OS_WINDOWS -+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE); -+#else -+ fd = open(filename, O_WRONLY|O_TRUNC, -+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); -+#endif -+ } -+ if (fd == -1) { -+ oscap_seterr(OSCAP_EFAMILY_OSCAP, -+ "Could not open output file '%s': %s", -+ filename, strerror(errno)); -+ return -1; -+ } -+ } -+ return fd; -+} -diff --git a/src/common/util.h b/src/common/util.h -index c48d92a52..5712f2f0b 100644 ---- a/src/common/util.h -+++ b/src/common/util.h -@@ -524,4 +524,16 @@ wchar_t *oscap_windows_str_to_wstr(const char *str); - char *oscap_windows_error_message(unsigned long error_code); - #endif - --#endif /* OSCAP_UTIL_H_ */ -+/** -+ * Open a file for writing. -+ * The main difference from fopen() is that if the file exists but its opening -+ * for writing fails as permission denied, it will attempt to open it again -+ * without the O_CREAT flag. This is useful when writing to world-writeable -+ * directories with sticky bit such as /tmp on systems with fs.protected_regular -+ * turned on. -+ * @param filename name of the file to be opened -+ * @return file descriptor or -1 on error -+ */ -+int oscap_open_writable(const char *filename); -+ -+#endif /* OSCAP_UTIL_H_ */ -diff --git a/src/source/xslt.c b/src/source/xslt.c -index 799d5170d..906bfabdb 100644 ---- a/src/source/xslt.c -+++ b/src/source/xslt.c -@@ -22,7 +22,6 @@ - #include - #endif - --#include - #include - #include - #include -@@ -30,7 +29,6 @@ - #include - #include - #include --#include - - #ifdef OS_WINDOWS - #include -@@ -91,29 +89,10 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl - int fd = STDOUT_FILENO; - #endif - if (outfile) { --#ifdef OS_WINDOWS -- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE); --#else -- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); --#endif -- if (fd == -1) { -- if (errno == EACCES) { -- /* File already exists and we aren't allowed to create a new one -- with the same name */ --#ifdef OS_WINDOWS -- fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE); --#else -- fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); --#endif -- } -- if (fd == -1) { -- oscap_seterr(OSCAP_EFAMILY_OSCAP, -- "Could not open output file '%s': %s", -- outfile, strerror(errno)); -- return -1; -- } -- } -+ fd = oscap_open_writable(outfile); - } -+ if (fd == -1) -+ return -1; - - int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet); - if (ret < 0) { -diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt -index 97e1ab09f..a1c7da67f 100644 ---- a/tests/API/XCCDF/unittests/CMakeLists.txt -+++ b/tests/API/XCCDF/unittests/CMakeLists.txt -@@ -2,6 +2,8 @@ add_oscap_test_executable(test_oscap_common - "test_oscap_common.c" - ${CMAKE_SOURCE_DIR}/src/common/util.c - ${CMAKE_SOURCE_DIR}/src/common/list.c -+ ${CMAKE_SOURCE_DIR}/src/common/error.c -+ ${CMAKE_SOURCE_DIR}/src/common/err_queue.c - ) - - add_oscap_test_executable(test_xccdf_overrides -diff --git a/tests/API/XCCDF/unittests/test_oscap_common.c b/tests/API/XCCDF/unittests/test_oscap_common.c -index 26ff51d48..939ba8750 100644 ---- a/tests/API/XCCDF/unittests/test_oscap_common.c -+++ b/tests/API/XCCDF/unittests/test_oscap_common.c -@@ -28,6 +28,7 @@ - #include - #include "common/list.h" - #include "common/util.h" -+#include "common/_error.h" - #include "oscap_assert.h" - - #define SEEN_LEN 9 diff --git a/openscap-1.3.7-pr-1850-relocate-rpmdb.patch b/openscap-1.3.7-pr-1850-relocate-rpmdb.patch deleted file mode 100644 index ab1db0b..0000000 --- a/openscap-1.3.7-pr-1850-relocate-rpmdb.patch +++ /dev/null @@ -1,50 +0,0 @@ -From b0d013aedab978e7d945ae8016e0df0a9dd0bf68 Mon Sep 17 00:00:00 2001 -From: Matus Marhefka -Date: Mon, 21 Mar 2022 16:12:35 +0100 -Subject: [PATCH] tests/probes/rpm/rpm_common.sh: update wrt Fedora 36 RPM DB - change - -Since Fedora 36 RPM database location changed, see -https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr ---- - tests/probes/rpm/rpm_common.sh | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/tests/probes/rpm/rpm_common.sh b/tests/probes/rpm/rpm_common.sh -index 2438272557..31b3f3fcd1 100755 ---- a/tests/probes/rpm/rpm_common.sh -+++ b/tests/probes/rpm/rpm_common.sh -@@ -9,6 +9,13 @@ RPMBASE="${builddir}/tests/probes/rpm" - RPMTEST="${RPMBASE}/root" - RPMBUILD="${RPMBASE}/build" - -+# Since Fedora 36 RPM database location changed, see -+# https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr -+if [ -d "/usr/lib/sysimage/rpm/" ]; then -+ RPMDB_PATH="/usr/lib/sysimage/rpm/" -+else -+ RPMDB_PATH="/var/lib/rpm/" -+fi - - function rpm_build { - require "rpmbuild" || return 255 -@@ -28,8 +35,8 @@ function rpm_prepare_offline { - cp /usr/lib/rpm/rpmrc ${RPMTEST}/usr/lib/rpm/rpmrc - cp /usr/lib/rpm/macros ${RPMTEST}/usr/lib/rpm/macros - rpm_build -- rpm -i ${RPMBUILD}/RPMS/noarch/foobar-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}/var/lib/rpm/" -- rpm -i ${RPMBUILD}/RPMS/noarch/foo-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}/var/lib/rpm/" -+ rpm -i ${RPMBUILD}/RPMS/noarch/foobar-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}${RPMDB_PATH}" -+ rpm -i ${RPMBUILD}/RPMS/noarch/foo-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}${RPMDB_PATH}" - } - - function rpm_cleanup_offline { -@@ -40,7 +47,7 @@ function rpm_cleanup_offline { - function rpm_query { - require "rpm" || return 255 - if [ -d "$OSCAP_PROBE_ROOT" ]; then -- DB="--dbpath=$OSCAP_PROBE_ROOT/var/lib/rpm/" -+ DB="--dbpath=${OSCAP_PROBE_ROOT}${RPMDB_PATH}" - fi - rpm $DB --qf "%{$2}\n" -q $1 | head - - } diff --git a/openscap-1.3.7-pr-1864-rpm-includes.patch b/openscap-1.3.7-pr-1864-rpm-includes.patch deleted file mode 100644 index 68b6ad0..0000000 --- a/openscap-1.3.7-pr-1864-rpm-includes.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 8dec1bb5e9546e75ae6e7b7cf94cf00197ce3e5d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Tue, 24 May 2022 12:15:44 +0200 -Subject: [PATCH 1/2] Use correct includes - -rpmvercmp is defined in rpm/rpmver.h -risdigit is defined in rpm/rpmstring.h - -Resolves: rhbz#2080210 ---- - cmake/FindRPM.cmake | 3 +++ - config.h.in | 1 + - src/OVAL/results/oval_cmp_evr_string.c | 5 +++++ - 3 files changed, 9 insertions(+) - -diff --git a/cmake/FindRPM.cmake b/cmake/FindRPM.cmake -index a666942eae..369d153fcc 100644 ---- a/cmake/FindRPM.cmake -+++ b/cmake/FindRPM.cmake -@@ -30,6 +30,9 @@ set(RPM_VERSION ${RPM_PKGCONF_VERSION}) - if(RPM_VERSION) - string(COMPARE GREATER "4.6" ${RPM_VERSION} RPM46_FOUND) - string(COMPARE GREATER "4.7" ${RPM_VERSION} RPM47_FOUND) -+ if(NOT (RPM_VERSION VERSION_LESS "4.18")) -+ set(RPM418_FOUND 1) -+ endif() - endif() - - # Set the include dir variables and the libraries and let libfind_process do the rest. -diff --git a/config.h.in b/config.h.in -index 1b72855822..bb1428afc8 100644 ---- a/config.h.in -+++ b/config.h.in -@@ -44,6 +44,7 @@ - #cmakedefine HAVE_RPMVERCMP - #cmakedefine RPM46_FOUND - #cmakedefine RPM47_FOUND -+#cmakedefine RPM418_FOUND - - #cmakedefine BZIP2_FOUND - -diff --git a/src/OVAL/results/oval_cmp_evr_string.c b/src/OVAL/results/oval_cmp_evr_string.c -index 3bfc8ce5f9..3ba0fa0cbd 100644 ---- a/src/OVAL/results/oval_cmp_evr_string.c -+++ b/src/OVAL/results/oval_cmp_evr_string.c -@@ -37,7 +37,12 @@ - #include "common/_error.h" - - #ifdef HAVE_RPMVERCMP -+#ifdef RPM418_FOUND -+#include -+#include -+#else - #include -+#endif - #else - #ifdef OS_WINDOWS - #include - -From bd41965d8e467dd0d3603e7e5594a698aa6a415c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Mon, 30 May 2022 11:32:35 +0200 -Subject: [PATCH 2/2] Use VERSION_GREATER_EQUAL - ---- - cmake/FindRPM.cmake | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cmake/FindRPM.cmake b/cmake/FindRPM.cmake -index 369d153fcc..22875a463b 100644 ---- a/cmake/FindRPM.cmake -+++ b/cmake/FindRPM.cmake -@@ -30,7 +30,7 @@ set(RPM_VERSION ${RPM_PKGCONF_VERSION}) - if(RPM_VERSION) - string(COMPARE GREATER "4.6" ${RPM_VERSION} RPM46_FOUND) - string(COMPARE GREATER "4.7" ${RPM_VERSION} RPM47_FOUND) -- if(NOT (RPM_VERSION VERSION_LESS "4.18")) -+ if(RPM_VERSION VERSION_GREATER_EQUAL "4.18") - set(RPM418_FOUND 1) - endif() - endif() diff --git a/openscap.spec b/openscap.spec index b0af1d2..f627de8 100644 --- a/openscap.spec +++ b/openscap.spec @@ -1,18 +1,12 @@ Name: openscap -Version: 1.3.6 -Release: 12%{?dist} +Version: 1.3.7 +Release: 1%{?dist} Epoch: 1 Summary: Set of open source libraries enabling integration of the SCAP line of standards License: LGPLv2+ URL: http://www.open-scap.org/ VCS: https://github.com/OpenSCAP/openscap Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz -Patch1: openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch -Patch2: openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch -Patch3: openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch -Patch4: openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch -Patch5: openscap-1.3.7-pr-1864-rpm-includes.patch -Patch6: openscap-1.3.7-pr-1850-relocate-rpmdb.patch BuildRequires: make BuildRequires: cmake >= 2.6 BuildRequires: gcc @@ -220,6 +214,9 @@ ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.w %{_mandir}/man8/oscap-podman.8* %changelog +* Thu Jan 26 2023 Jan Černý - 1:1.3.7-1 +- Upgrade to the latest upstream release + * Thu Jan 19 2023 Fedora Release Engineering - 1:1.3.6-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 00dc4d3..d9b3062 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openscap-1.3.6.tar.gz) = 5e4d6c4addc15b2a0245b5caef80fda3020f1cac83ed4aa436ef3f1703d1d761060c931c2536fa68de7ad5bab002b79c8b2d1e5f7695d46249f4562f5a1569a0 +SHA512 (openscap-1.3.7.tar.gz) = 64dcceadbbb5b6045d2ebaca89287c80c26e05d7247fc0dd31cd9bff98398c7a26d6ed0e9191dcd2fd01f0711181f15d34fe9784bd043ccd0854baa17397cd88