rpms/openscap
7
0
Fork 0
Code Issues Pull Requests Releases Activity

openscap-1.3.7

Browse Source
This commit is contained in:
Jan Černý 2023-01-26 17:35:40 +01:00
parent 6f004c50ef
commit a08adbff22
8 changed files with 6 additions and 693 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch
View File

@ -1,104 +0,0 @@
From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:00:33 +0100
Subject: [PATCH 1/3] Fix shellcheck warning
Addressing:
Error: SHELLCHECK_WARNING (CWE-138): [#def1]
/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
108| args+=( "--remediate" )
109| args+=( "${OSCAP_REMEDIATE_DS}" )
110|-> log "Args: ${args[@]}"
111|
112| # Now we are good to go
---
utils/oscap-remediate | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/utils/oscap-remediate b/utils/oscap-remediate
index fc0b7715f..52e29aa66 100755
--- a/utils/oscap-remediate
+++ b/utils/oscap-remediate
@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
args+=( "--progress-full" )
args+=( "--remediate" )
args+=( "${OSCAP_REMEDIATE_DS}" )
-log "Args: ${args[@]}"
+log "Args: ${args[*]}"
# Now we are good to go
header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:09:02 +0100
Subject: [PATCH 2/3] Remove superfluous strdup
We can do this because xccdf_session_set_rule calls strdup on the rule
parameter internally.
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
4148| char *n_rule = strdup(rule);
4149| xccdf_session_set_rule(sess, n_rule);
4150|-> }
4151|
4152| void xccdf_session_free_py(struct xccdf_session *sess){
---
swig/openscap.i | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/swig/openscap.i b/swig/openscap.i
index 2fe1cce99..158a22675 100644
--- a/swig/openscap.i
+++ b/swig/openscap.i
@@ -559,8 +559,7 @@ struct xccdf_session {
};
void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) {
- char *n_rule = strdup(rule);
- xccdf_session_set_rule(sess, n_rule);
+ xccdf_session_set_rule(sess, rule);
}
void xccdf_session_free_py(struct xccdf_session *sess){
From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:16:02 +0100
Subject: [PATCH 3/3] Add a missing free
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
2148| oscap_seterr(OSCAP_EFAMILY_XCCDF,
2149| "Rule '%s' not found in selected profile.", rule_id);
2150|-> return NULL;
2151| }
2152| }
---
src/XCCDF_POLICY/xccdf_policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
index b63853a38..4d4b7ad0a 100644
--- a/src/XCCDF_POLICY/xccdf_policy.c
+++ b/src/XCCDF_POLICY/xccdf_policy.c
@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
oscap_seterr(OSCAP_EFAMILY_XCCDF,
"Rule '%s' not found in selected profile.", rule_id);
+ oscap_htable_iterator_free(rit);
return NULL;
}
}

29
openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch
View File

@ -1,29 +0,0 @@
From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 31 Jan 2022 13:45:15 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
The SOURCE_DATE_EPOCH environment variable is effective only when it's
set to a value that's older than mtime of the processed file. See the
implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
However, the file in our test suite has originally been created before
(in 2019) and this mtime can be used when a tarball is produced. To
avoid the test failing, we can modify the mtime using the touch command
just before we run the tests.
---
tests/DS/test_ds_misc.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index 159007518..cffbef303 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -269,6 +269,8 @@ function test_source_date_epoch() {
local timestamp="2020-03-05T12:09:37"
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
+ # ensure the file mtime is always newer than the $timestamp
+ touch -c "$xccdf"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"

27
openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch
View File

@ -1,27 +0,0 @@
From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 1 Feb 2022 15:06:33 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
Other files from which the datastream is composed might also
affect the timestamp attributes in result document depending
on their mtime.
---
tests/DS/test_ds_misc.sh | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index cffbef303..1777c44f4 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -270,7 +270,9 @@ function test_source_date_epoch() {
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
# ensure the file mtime is always newer than the $timestamp
- touch -c "$xccdf"
+ touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
+ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
+ touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"

393
openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch
View File

@ -1,393 +0,0 @@
From d000375944e8ec965486cf019c3f75f4c06a4e10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 14:14:21 +0100
Subject: [PATCH 1/5] Prevent file permissions errors
The sysctl setting `fs.protected_regular` doesn't allow `O_CREAT` open
on regular files that we don't own in world writable sticky directories
(think `/tmp`). This causes permission denied error when writing HTML
report to a temporary files created by the `mktemp` command executed as
a normal user and then executing `sudo oscap`.
See https://bugzilla.redhat.com/show_bug.cgi?id=2048571
If OpenSCAP fails to open the file because of permissions, it will retry
to open the file without O_CREAT flag.
This fixes only creation of the HTML report using the `--report` option,
We will have to create a similar patch also for other output options
such as `--results` or `--results-arf`.
---
src/source/xslt.c | 40 ++++++++++++++++++++++++++++------------
1 file changed, 28 insertions(+), 12 deletions(-)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 24c4c46e9..7a3a3f328 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -22,6 +22,7 @@
#include <config.h>
#endif
+#include <fcntl.h>
#include <libxml/parser.h>
#include <libxslt/xslt.h>
#include <libxslt/xsltInternals.h>
@@ -82,23 +83,38 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
{
- FILE *f = NULL;
- if (outfile)
- f = fopen(outfile, "w");
- else
- f = stdout;
-
- if (f == NULL) {
- oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not open output file '%s'", outfile ? outfile : "stdout");
- return -1;
+ int fd = STDOUT_FILENO;
+ if (outfile) {
+#ifdef OS_WINDOWS
+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_OSCAP,
+ "Could not open output file '%s': %s",
+ outfile, strerror(errno));
+ return -1;
+ }
+ }
}
- int ret = xsltSaveResultToFile(f, resulting_doc, stylesheet);
+ int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
if (ret < 0) {
oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
}
- if (outfile && f)
- fclose(f);
+ if (fd != STDOUT_FILENO)
+ close(fd);
return ret;
}
From ad3c89a72c0aeb6c6ceab0873c51b07deba45701 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 15:08:52 +0100
Subject: [PATCH 2/5] Prevent permission access issues
Very similar to the previous commit, but this time for saving XML
documents.
---
src/common/elements.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/src/common/elements.c b/src/common/elements.c
index e512f5e3d..d0d9170f1 100644
--- a/src/common/elements.c
+++ b/src/common/elements.c
@@ -233,9 +233,22 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
#endif
- if (fd < 0) {
- oscap_seterr(OSCAP_EFAMILY_GLIBC, "%s '%s'", strerror(errno), filename);
- return -1;
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(filename, O_WRONLY|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_GLIBC,
+ "%s '%s'", strerror(errno), filename);
+ return -1;
+ }
}
buff = xmlOutputBufferCreateFd(fd, NULL);
From b2dc90fb80419e30d05676660a2069050693078d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 15:37:31 +0100
Subject: [PATCH 3/5] Add a missing include
---
src/source/xslt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 7a3a3f328..a763d6b59 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -30,6 +30,8 @@
#include <libxslt/xsltutils.h>
#include <libexslt/exslt.h>
#include <string.h>
+#include <sys/stat.h>
+
#ifdef OS_WINDOWS
#include <io.h>
#else
From 13ff98bd744ea542bc782e388fdedb5b7f66e54b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 16:22:56 +0100
Subject: [PATCH 4/5] Fix missing STDOUT_FILENO on Windows
---
src/source/xslt.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index a763d6b59..799d5170d 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -85,7 +85,11 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
{
+#ifdef OS_WINDOWS
+ int fd = _fileno(stdout);
+#else
int fd = STDOUT_FILENO;
+#endif
if (outfile) {
#ifdef OS_WINDOWS
fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
@@ -115,7 +119,11 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
if (ret < 0) {
oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
}
+#ifdef OS_WINDOWS
+ if (fd != _fileno(stdout))
+#else
if (fd != STDOUT_FILENO)
+#endif
close(fd);
return ret;
}
From f00831513ec2cdde13c12820ff6cc0eef8105c65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 4 Feb 2022 12:19:50 +0100
Subject: [PATCH 5/5] Refactor: extract function oscap_open_writable
---
src/common/elements.c | 26 ++--------------
src/common/util.c | 31 +++++++++++++++++++
src/common/util.h | 14 ++++++++-
src/source/xslt.c | 27 ++--------------
tests/API/XCCDF/unittests/CMakeLists.txt | 2 ++
tests/API/XCCDF/unittests/test_oscap_common.c | 1 +
6 files changed, 53 insertions(+), 48 deletions(-)
diff --git a/src/common/elements.c b/src/common/elements.c
index d0d9170f1..de4be88f1 100644
--- a/src/common/elements.c
+++ b/src/common/elements.c
@@ -227,29 +227,9 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
xmlCode = xmlSaveFormatFileEnc(filename, doc, "UTF-8", 1);
}
else {
-#ifdef OS_WINDOWS
- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, S_IREAD|S_IWRITE);
-#else
- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- if (fd == -1) {
- if (errno == EACCES) {
- /* File already exists and we aren't allowed to create a new one
- with the same name */
-#ifdef OS_WINDOWS
- fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(filename, O_WRONLY|O_TRUNC,
- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- }
- if (fd == -1) {
- oscap_seterr(OSCAP_EFAMILY_GLIBC,
- "%s '%s'", strerror(errno), filename);
- return -1;
- }
- }
+ int fd = oscap_open_writable(filename);
+ if (fd == -1)
+ return -1;
buff = xmlOutputBufferCreateFd(fd, NULL);
if (buff == NULL) {
diff --git a/src/common/util.c b/src/common/util.c
index 8f9f751e2..8ca2ad130 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -25,12 +25,14 @@
#include <config.h>
#endif
+#include <fcntl.h>
#include <string.h>
#include <ctype.h>
#include <limits.h>
#include <stdarg.h>
#include <math.h>
#include <pcre.h>
+#include <sys/stat.h>
#include "util.h"
#include "_error.h"
@@ -482,3 +484,32 @@ char *oscap_windows_error_message(unsigned long error_code)
return error_message;
}
#endif
+
+int oscap_open_writable(const char *filename)
+{
+#ifdef OS_WINDOWS
+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(filename, O_WRONLY|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_OSCAP,
+ "Could not open output file '%s': %s",
+ filename, strerror(errno));
+ return -1;
+ }
+ }
+ return fd;
+}
diff --git a/src/common/util.h b/src/common/util.h
index c48d92a52..5712f2f0b 100644
--- a/src/common/util.h
+++ b/src/common/util.h
@@ -524,4 +524,16 @@ wchar_t *oscap_windows_str_to_wstr(const char *str);
char *oscap_windows_error_message(unsigned long error_code);
#endif
-#endif /* OSCAP_UTIL_H_ */
+/**
+ * Open a file for writing.
+ * The main difference from fopen() is that if the file exists but its opening
+ * for writing fails as permission denied, it will attempt to open it again
+ * without the O_CREAT flag. This is useful when writing to world-writeable
+ * directories with sticky bit such as /tmp on systems with fs.protected_regular
+ * turned on.
+ * @param filename name of the file to be opened
+ * @return file descriptor or -1 on error
+ */
+int oscap_open_writable(const char *filename);
+
+#endif /* OSCAP_UTIL_H_ */
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 799d5170d..906bfabdb 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -22,7 +22,6 @@
#include <config.h>
#endif
-#include <fcntl.h>
#include <libxml/parser.h>
#include <libxslt/xslt.h>
#include <libxslt/xsltInternals.h>
@@ -30,7 +29,6 @@
#include <libxslt/xsltutils.h>
#include <libexslt/exslt.h>
#include <string.h>
-#include <sys/stat.h>
#ifdef OS_WINDOWS
#include <io.h>
@@ -91,29 +89,10 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
int fd = STDOUT_FILENO;
#endif
if (outfile) {
-#ifdef OS_WINDOWS
- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- if (fd == -1) {
- if (errno == EACCES) {
- /* File already exists and we aren't allowed to create a new one
- with the same name */
-#ifdef OS_WINDOWS
- fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- }
- if (fd == -1) {
- oscap_seterr(OSCAP_EFAMILY_OSCAP,
- "Could not open output file '%s': %s",
- outfile, strerror(errno));
- return -1;
- }
- }
+ fd = oscap_open_writable(outfile);
}
+ if (fd == -1)
+ return -1;
int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
if (ret < 0) {
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
index 97e1ab09f..a1c7da67f 100644
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
@@ -2,6 +2,8 @@ add_oscap_test_executable(test_oscap_common
"test_oscap_common.c"
${CMAKE_SOURCE_DIR}/src/common/util.c
${CMAKE_SOURCE_DIR}/src/common/list.c
+ ${CMAKE_SOURCE_DIR}/src/common/error.c
+ ${CMAKE_SOURCE_DIR}/src/common/err_queue.c
)
add_oscap_test_executable(test_xccdf_overrides
diff --git a/tests/API/XCCDF/unittests/test_oscap_common.c b/tests/API/XCCDF/unittests/test_oscap_common.c
index 26ff51d48..939ba8750 100644
--- a/tests/API/XCCDF/unittests/test_oscap_common.c
+++ b/tests/API/XCCDF/unittests/test_oscap_common.c
@@ -28,6 +28,7 @@
#include <string.h>
#include "common/list.h"
#include "common/util.h"
+#include "common/_error.h"
#include "oscap_assert.h"
#define SEEN_LEN 9

50
openscap-1.3.7-pr-1850-relocate-rpmdb.patch
View File

@ -1,50 +0,0 @@
From b0d013aedab978e7d945ae8016e0df0a9dd0bf68 Mon Sep 17 00:00:00 2001
From: Matus Marhefka <mmarhefk@redhat.com>
Date: Mon, 21 Mar 2022 16:12:35 +0100
Subject: [PATCH] tests/probes/rpm/rpm_common.sh: update wrt Fedora 36 RPM DB
change
Since Fedora 36 RPM database location changed, see
https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr
---
tests/probes/rpm/rpm_common.sh | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/tests/probes/rpm/rpm_common.sh b/tests/probes/rpm/rpm_common.sh
index 2438272557..31b3f3fcd1 100755
--- a/tests/probes/rpm/rpm_common.sh
+++ b/tests/probes/rpm/rpm_common.sh
@@ -9,6 +9,13 @@ RPMBASE="${builddir}/tests/probes/rpm"
RPMTEST="${RPMBASE}/root"
RPMBUILD="${RPMBASE}/build"
+# Since Fedora 36 RPM database location changed, see
+# https://fedoraproject.org/wiki/Changes/RelocateRPMToUsr
+if [ -d "/usr/lib/sysimage/rpm/" ]; then
+ RPMDB_PATH="/usr/lib/sysimage/rpm/"
+else
+ RPMDB_PATH="/var/lib/rpm/"
+fi
function rpm_build {
require "rpmbuild" || return 255
@@ -28,8 +35,8 @@ function rpm_prepare_offline {
cp /usr/lib/rpm/rpmrc ${RPMTEST}/usr/lib/rpm/rpmrc
cp /usr/lib/rpm/macros ${RPMTEST}/usr/lib/rpm/macros
rpm_build
- rpm -i ${RPMBUILD}/RPMS/noarch/foobar-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}/var/lib/rpm/"
- rpm -i ${RPMBUILD}/RPMS/noarch/foo-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}/var/lib/rpm/"
+ rpm -i ${RPMBUILD}/RPMS/noarch/foobar-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}${RPMDB_PATH}"
+ rpm -i ${RPMBUILD}/RPMS/noarch/foo-1.0-1.noarch.rpm --badreloc --relocate="/etc=${RPMTEST}/etc/" --dbpath="${RPMTEST}${RPMDB_PATH}"
}
function rpm_cleanup_offline {
@@ -40,7 +47,7 @@ function rpm_cleanup_offline {
function rpm_query {
require "rpm" || return 255
if [ -d "$OSCAP_PROBE_ROOT" ]; then
- DB="--dbpath=$OSCAP_PROBE_ROOT/var/lib/rpm/"
+ DB="--dbpath=${OSCAP_PROBE_ROOT}${RPMDB_PATH}"
fi
rpm $DB --qf "%{$2}\n" -q $1 | head -
}

81
openscap-1.3.7-pr-1864-rpm-includes.patch
View File

@ -1,81 +0,0 @@
From 8dec1bb5e9546e75ae6e7b7cf94cf00197ce3e5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 24 May 2022 12:15:44 +0200
Subject: [PATCH 1/2] Use correct includes
rpmvercmp is defined in rpm/rpmver.h
risdigit is defined in rpm/rpmstring.h
Resolves: rhbz#2080210
---
cmake/FindRPM.cmake | 3 +++
config.h.in | 1 +
src/OVAL/results/oval_cmp_evr_string.c | 5 +++++
3 files changed, 9 insertions(+)
diff --git a/cmake/FindRPM.cmake b/cmake/FindRPM.cmake
index a666942eae..369d153fcc 100644
--- a/cmake/FindRPM.cmake
+++ b/cmake/FindRPM.cmake
@@ -30,6 +30,9 @@ set(RPM_VERSION ${RPM_PKGCONF_VERSION})
if(RPM_VERSION)
string(COMPARE GREATER "4.6" ${RPM_VERSION} RPM46_FOUND)
string(COMPARE GREATER "4.7" ${RPM_VERSION} RPM47_FOUND)
+ if(NOT (RPM_VERSION VERSION_LESS "4.18"))
+ set(RPM418_FOUND 1)
+ endif()
endif()
# Set the include dir variables and the libraries and let libfind_process do the rest.
diff --git a/config.h.in b/config.h.in
index 1b72855822..bb1428afc8 100644
--- a/config.h.in
+++ b/config.h.in
@@ -44,6 +44,7 @@
#cmakedefine HAVE_RPMVERCMP
#cmakedefine RPM46_FOUND
#cmakedefine RPM47_FOUND
+#cmakedefine RPM418_FOUND
#cmakedefine BZIP2_FOUND
diff --git a/src/OVAL/results/oval_cmp_evr_string.c b/src/OVAL/results/oval_cmp_evr_string.c
index 3bfc8ce5f9..3ba0fa0cbd 100644
--- a/src/OVAL/results/oval_cmp_evr_string.c
+++ b/src/OVAL/results/oval_cmp_evr_string.c
@@ -37,7 +37,12 @@
#include "common/_error.h"
#ifdef HAVE_RPMVERCMP
+#ifdef RPM418_FOUND
+#include <rpm/rpmver.h>
+#include <rpm/rpmstring.h>
+#else
#include <rpm/rpmlib.h>
+#endif
#else
#ifdef OS_WINDOWS
#include <malloc.h>
From bd41965d8e467dd0d3603e7e5594a698aa6a415c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 30 May 2022 11:32:35 +0200
Subject: [PATCH 2/2] Use VERSION_GREATER_EQUAL
---
cmake/FindRPM.cmake | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cmake/FindRPM.cmake b/cmake/FindRPM.cmake
index 369d153fcc..22875a463b 100644
--- a/cmake/FindRPM.cmake
+++ b/cmake/FindRPM.cmake
@@ -30,7 +30,7 @@ set(RPM_VERSION ${RPM_PKGCONF_VERSION})
if(RPM_VERSION)
string(COMPARE GREATER "4.6" ${RPM_VERSION} RPM46_FOUND)
string(COMPARE GREATER "4.7" ${RPM_VERSION} RPM47_FOUND)
- if(NOT (RPM_VERSION VERSION_LESS "4.18"))
+ if(RPM_VERSION VERSION_GREATER_EQUAL "4.18")
set(RPM418_FOUND 1)
endif()
endif()

13
openscap.spec
View File

@ -1,18 +1,12 @@
Name: openscap Name: openscap
Version: 1.3.6 Version: 1.3.7
Release: 12%{?dist} Release: 1%{?dist}
Epoch: 1 Epoch: 1
Summary: Set of open source libraries enabling integration of the SCAP line of standards Summary: Set of open source libraries enabling integration of the SCAP line of standards
License: LGPLv2+ License: LGPLv2+
URL: http://www.open-scap.org/ URL: http://www.open-scap.org/
VCS: https://github.com/OpenSCAP/openscap VCS: https://github.com/OpenSCAP/openscap
Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
Patch1: openscap-1.3.7-pr-1841-fix-shellcheck-warning.patch
Patch2: openscap-1.3.7-pr-1843-prevent-fails-of-epoch-test.patch
Patch3: openscap-1.3.7-pr-1844-prevent-fails-of-epoch-test-2.patch
Patch4: openscap-1.3.7-pr-1846-prevent-file-permissions-errors.patch
Patch5: openscap-1.3.7-pr-1864-rpm-includes.patch
Patch6: openscap-1.3.7-pr-1850-relocate-rpmdb.patch
BuildRequires: make BuildRequires: make
BuildRequires: cmake >= 2.6 BuildRequires: cmake >= 2.6
BuildRequires: gcc BuildRequires: gcc
@ -220,6 +214,9 @@ ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.w
%{_mandir}/man8/oscap-podman.8* %{_mandir}/man8/oscap-podman.8*
%changelog %changelog
* Thu Jan 26 2023 Jan Černý <jcerny@redhat.com> - 1:1.3.7-1
- Upgrade to the latest upstream release
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.3.6-12 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.3.6-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

2
sources
View File

@ -1 +1 @@
SHA512 (openscap-1.3.6.tar.gz) = 5e4d6c4addc15b2a0245b5caef80fda3020f1cac83ed4aa436ef3f1703d1d761060c931c2536fa68de7ad5bab002b79c8b2d1e5f7695d46249f4562f5a1569a0 SHA512 (openscap-1.3.7.tar.gz) = 64dcceadbbb5b6045d2ebaca89287c80c26e05d7247fc0dd31cd9bff98398c7a26d6ed0e9191dcd2fd01f0711181f15d34fe9784bd043ccd0854baa17397cd88