From 4c570ce99b00f7754df54dd0701bd1037ca68237 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 10 May 2022 03:03:53 -0400 Subject: [PATCH 1/3] import openscap-1.3.6-3.el8 --- .gitignore | 2 +- .openscap.metadata | 2 +- ...enscap-1.3.6-PR-1745-waive-hugepages.patch | 43 ----- SOURCES/openscap-1.3.6-PR-1748-covscan.patch | 52 ------ ...openscap-1.3.6-PR-1749-blueprint-fix.patch | 64 -------- SOURCES/openscap-1.3.6-PR-1753-getlogin.patch | 36 ----- .../openscap-1.3.6-PR-1756-yaml-nulls.patch | 150 ------------------ ...-1.3.6-PR-1779-initialize-crapi-once.patch | 136 ---------------- ...nscap-1.3.6-PR-1788-test-rhbz1959570.patch | 97 ----------- SOURCES/openscap-1.3.7-PR-1841-coverity.patch | 104 ++++++++++++ ...nscap-1.3.7-PR-1843-fix-test-ds-misc.patch | 32 ++++ ...cap-1.3.7-PR-1844-fix-test-ds-misc-2.patch | 27 ++++ SPECS/openscap.spec | 53 +++++-- 13 files changed, 209 insertions(+), 589 deletions(-) delete mode 100644 SOURCES/openscap-1.3.6-PR-1745-waive-hugepages.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1748-covscan.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1749-blueprint-fix.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1753-getlogin.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1756-yaml-nulls.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1779-initialize-crapi-once.patch delete mode 100644 SOURCES/openscap-1.3.6-PR-1788-test-rhbz1959570.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1841-coverity.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch diff --git a/.gitignore b/.gitignore index 0223773..33a3f05 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/openscap-1.3.5.tar.gz +SOURCES/openscap-1.3.6.tar.gz diff --git a/.openscap.metadata b/.openscap.metadata index 38345b6..5048b38 100644 --- a/.openscap.metadata +++ b/.openscap.metadata @@ -1 +1 @@ -77494383980082f8bc625a6e196a6760d30a5107 SOURCES/openscap-1.3.5.tar.gz +8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz diff --git a/SOURCES/openscap-1.3.6-PR-1745-waive-hugepages.patch b/SOURCES/openscap-1.3.6-PR-1745-waive-hugepages.patch deleted file mode 100644 index 4272a78..0000000 --- a/SOURCES/openscap-1.3.6-PR-1745-waive-hugepages.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 192f908562779fe4c9b7e5cc7605840976a06c85 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Mon, 26 Apr 2021 13:13:26 +0200 -Subject: [PATCH] Waive the known issue with hugepages on ppc64/ppc64le - -The known issue has been reported in -https://bugzilla.redhat.com/show_bug.cgi?id=1642995 - -This modification is currently applied as a patch applied during setup -phase of Sanity/smoke-test in Fedora CI gating. -https://src.fedoraproject.org/tests/openscap/blob/main/f/Sanity/smoke-test -The patched file got changed recetly so the patch doesn't apply anymore -which causes the Rawhide gating to fail. -We have decided to propose the change to upstream to avoid the need -for modifying the patch in the tests and to prevent similar problems -in the future. ---- - tests/probes/sysctl/test_sysctl_probe_all.sh | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/tests/probes/sysctl/test_sysctl_probe_all.sh b/tests/probes/sysctl/test_sysctl_probe_all.sh -index 2280ff7ae..c79d7ed18 100755 ---- a/tests/probes/sysctl/test_sysctl_probe_all.sh -+++ b/tests/probes/sysctl/test_sysctl_probe_all.sh -@@ -73,6 +73,10 @@ if [ "$procps_ver" != "$lowest_ver" ]; then - sed -i '/.*vm.stat_refresh/d' "$sysctlNames" - fi - -+if ! grep -q "hugepages" "$ourNames"; then -+ sed -i "/^.*hugepages.*$/d" "$sysctlNames" -+fi -+ - echo "Diff (sysctlNames / ourNames): ------" - diff "$sysctlNames" "$ourNames" - echo "-------------------------------------" -@@ -84,6 +88,7 @@ sed -i -E "/^E: oscap: +Can't read sysctl value from /d" "$stderr" - # that can't fit into 8K buffer and result in errno 14 - # (for example /proc/sys/kernel/spl/hostid could be the case) - sed -i -E "/^E: oscap: +An error.*14, Bad address/d" "$stderr" -+sed -i "/^.*hugepages.*$/d" "$stderr" - - echo "Errors (without messages related to permissions):" - cat "$stderr" diff --git a/SOURCES/openscap-1.3.6-PR-1748-covscan.patch b/SOURCES/openscap-1.3.6-PR-1748-covscan.patch deleted file mode 100644 index 9d5661a..0000000 --- a/SOURCES/openscap-1.3.6-PR-1748-covscan.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 378ef5e438a2f5af7a50374d2bd23bdd3403201f Mon Sep 17 00:00:00 2001 -From: Evgeny Kolesnikov -Date: Tue, 4 May 2021 08:41:06 +0200 -Subject: [PATCH] Fix covscan-reported issues in yamlfilecontent probe and - schematron - -Error: FORWARD_NULL (CWE-476): [#def1] -/OVAL/probes/independent/yamlfilecontent_probe.c:392: var_compare_op: Comparing "yaml_file" to null implies that "yaml_file" might be null. -/OVAL/probes/independent/yamlfilecontent_probe.c:417: var_deref_model: Passing null pointer "yaml_file" to "fclose", which dereferences it. -# 416| cleanup: -# 417|-> fclose(yaml_file); -# 418| yaml_parser_delete(&parser); - -Error: RESOURCE_LEAK (CWE-772): [#def2] [important] -/source/schematron.c:549: alloc_fn: Storage is returned from allocation function "xmlXPathNodeEval". -/source/schematron.c:549: var_assign: Assigning: "component_refs" = storage returned from "xmlXPathNodeEval(data_stream_node, (xmlChar *)"ds:checklists/ds:component-ref", context)". -/source/schematron.c:551: leaked_storage: Variable "component_refs" going out of scope leaks the storage it points to. -# 550| if (component_refs == NULL || component_refs->nodesetval == NULL) { -# 551|-> return res; -# 552| } ---- - src/OVAL/probes/independent/yamlfilecontent_probe.c | 3 ++- - src/source/schematron.c | 2 ++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c -index ed5ce0d68..62a8f4ff2 100644 ---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c -+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c -@@ -414,7 +414,8 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f - } - - cleanup: -- fclose(yaml_file); -+ if (yaml_file != NULL) -+ fclose(yaml_file); - yaml_parser_delete(&parser); - free(filepath_with_prefix); - free(filepath); -diff --git a/src/source/schematron.c b/src/source/schematron.c -index 6cb22658b..c32d5aed6 100644 ---- a/src/source/schematron.c -+++ b/src/source/schematron.c -@@ -548,6 +548,8 @@ static bool _req_src_346_1_sub1(xmlNodePtr data_stream_node, xmlXPathContextPtr - /* every $m in ds:checklists/ds:component-ref satisfies ... */ - xmlXPathObjectPtr component_refs = xmlXPathNodeEval(data_stream_node, BAD_CAST "ds:checklists/ds:component-ref", context); - if (component_refs == NULL || component_refs->nodesetval == NULL) { -+ if (component_refs != NULL) -+ xmlXPathFreeObject(component_refs); - return res; - } - for (int i = 0; i < component_refs->nodesetval->nodeNr; i++) { diff --git a/SOURCES/openscap-1.3.6-PR-1749-blueprint-fix.patch b/SOURCES/openscap-1.3.6-PR-1749-blueprint-fix.patch deleted file mode 100644 index 0e44989..0000000 --- a/SOURCES/openscap-1.3.6-PR-1749-blueprint-fix.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 5f0a9033b466d929613a2a55a1524ec75c09b5b0 Mon Sep 17 00:00:00 2001 -From: Evgeny Kolesnikov -Date: Thu, 6 May 2021 08:14:12 +0200 -Subject: [PATCH] Introduce OSBuild Blueprint fix type - ---- - utils/oscap-xccdf.c | 7 +++++-- - utils/oscap.8 | 2 +- - xsl/xccdf-share.xsl | 1 + - 3 files changed, 7 insertions(+), 3 deletions(-) - -diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c -index 95c1c7658d..801e54fa35 100644 ---- a/utils/oscap-xccdf.c -+++ b/utils/oscap-xccdf.c -@@ -275,7 +275,8 @@ static struct oscap_module XCCDF_GEN_FIX = { - .usage = "[options] xccdf-file.xml", - .help = GEN_OPTS - "\nFix Options:\n" -- " --fix-type - Fix type. Should be one of: bash, ansible, puppet, anaconda (default: bash).\n" -+ " --fix-type - Fix type. Should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes,\n" -+ " blueprint (default: bash).\n" - " --output - Write the script into file.\n" - " --result-id - Fixes will be generated for failed rule-results of the specified TestResult.\n" - " --template - Fix template. (default: bash)\n" -@@ -887,10 +888,12 @@ int app_generate_fix(const struct oscap_action *action) - template = "urn:xccdf:fix:script:ignition"; - } else if (strcmp(action->fix_type, "kubernetes") == 0) { - template = "urn:xccdf:fix:script:kubernetes"; -+ } else if (strcmp(action->fix_type, "blueprint") == 0) { -+ template = "urn:redhat:osbuild:blueprint"; - } else { - fprintf(stderr, - "Unknown fix type '%s'.\n" -- "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes.\n" -+ "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint.\n" - "Or provide a custom template using '--template' instead.\n", - action->fix_type); - return OSCAP_ERROR; -diff --git a/utils/oscap.8 b/utils/oscap.8 -index 240b829d7b..6cae0ffe8a 100644 ---- a/utils/oscap.8 -+++ b/utils/oscap.8 -@@ -395,7 +395,7 @@ Result-oriented fixes are generated using result-id provided to select only the - Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes. - .TP - \fB\-\-fix-type TYPE\fR --Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN. -+Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN. - .TP - \fB\-\-output FILE\fR - Write the report to this file instead of standard output. -diff --git a/xsl/xccdf-share.xsl b/xsl/xccdf-share.xsl -index 9f8e587676..d7a9f3b7e2 100644 ---- a/xsl/xccdf-share.xsl -+++ b/xsl/xccdf-share.xsl -@@ -295,6 +295,7 @@ Authors: - Puppet snippet - Anaconda snippet - Kubernetes snippet -+ OSBuild Blueprint snippet - script - - diff --git a/SOURCES/openscap-1.3.6-PR-1753-getlogin.patch b/SOURCES/openscap-1.3.6-PR-1753-getlogin.patch deleted file mode 100644 index a63f094..0000000 --- a/SOURCES/openscap-1.3.6-PR-1753-getlogin.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b31cff1bc3a298cfa36a10476f2d633c290b6741 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Tue, 11 May 2021 13:20:18 +0200 -Subject: [PATCH] Replace getlogin by cuserid - -The getlogin() is used here to fill in the xccdf:identity element which -shall contain information about the system identity or user employed -during application of the benchmark. But, the getlogin() can return NULL -when there is no controlling terminal. This happened when testing oscap -on a test system with no pty. As an alternative, the system provides -also cuserid() function which gets the effective user ID of the process. -However, these 2 values differ when the program is executed under sudo. -From the user experience point of view, it would be better to have -displayed there the user logged in on the controlling terminal. As a -compromise, we will first attempt to obtain the name using getlogin() -and if that fails we will run cuserid(). ---- - src/XCCDF/result.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c -index cd03e6bd8f..cbe016c44a 100644 ---- a/src/XCCDF/result.c -+++ b/src/XCCDF/result.c -@@ -217,7 +217,10 @@ static inline void _xccdf_result_fill_identity(struct xccdf_result *result) - xccdf_identity_set_authenticated(id, 0); - xccdf_identity_set_privileged(id, 0); - #ifdef OSCAP_UNIX -- xccdf_identity_set_name(id, getlogin()); -+ char *name = getlogin(); -+ if (name == NULL) -+ name = cuserid(NULL); -+ xccdf_identity_set_name(id, name); - #elif defined(OS_WINDOWS) - GetUserName((TCHAR *) w32_username, &w32_usernamesize); /* XXX: Check the return value? */ - xccdf_identity_set_name(id, w32_username); diff --git a/SOURCES/openscap-1.3.6-PR-1756-yaml-nulls.patch b/SOURCES/openscap-1.3.6-PR-1756-yaml-nulls.patch deleted file mode 100644 index 9489211..0000000 --- a/SOURCES/openscap-1.3.6-PR-1756-yaml-nulls.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 89f99834ba183284a7d75835932a0c0ea4eb9007 Mon Sep 17 00:00:00 2001 -From: Evgeny Kolesnikov -Date: Mon, 17 May 2021 08:40:17 +0200 -Subject: [PATCH] oval/yamlfilecontent: Add 'null' values handling - -For now null values would be represented as string '(null)' as -record's field could not be attributed as nil="true" yet. ---- - .../independent/yamlfilecontent_probe.c | 9 ++++ - .../test_probes_yamlfilecontent_types.sh | 5 ++ - .../test_probes_yamlfilecontent_types.xml | 52 +++++++++++++++++++ - tests/probes/yamlfilecontent/types.yaml | 4 ++ - 4 files changed, 70 insertions(+) - -diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c -index 62a8f4ff29..2d0cac6991 100644 ---- a/src/OVAL/probes/independent/yamlfilecontent_probe.c -+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c -@@ -41,6 +41,7 @@ - #define OSCAP_YAML_BOOL_TAG "tag:yaml.org,2002:bool" - #define OSCAP_YAML_FLOAT_TAG "tag:yaml.org,2002:float" - #define OSCAP_YAML_INT_TAG "tag:yaml.org,2002:int" -+#define OSCAP_YAML_NULL_TAG "tag:yaml.org,2002:null" - - #define OVECCOUNT 30 /* should be a multiple of 3 */ - -@@ -135,6 +136,14 @@ static SEXP_t *yaml_scalar_event_to_sexp(yaml_event_t *event) - return NULL; - } - } -+ if (question || !strcmp(tag, OSCAP_YAML_NULL_TAG)) { -+ if (match_regex("^(null|Null|NULL|~|)$", value)) { -+ // TODO: Return real NULL when record's field will support nil="true" -+ return SEXP_string_new("(null)", strlen("(null)")); -+ } else if (!question) { -+ return NULL; -+ } -+ } - - return SEXP_string_new(value, strlen(value)); - } -diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh -index 4f110f6eb7..e445771d03 100755 ---- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh -+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh -@@ -60,6 +60,11 @@ function test_probes_yamlfilecontent_types { - assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="boolean" and text()="true"]' - # string_number - assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="int" and text()="81"]' -+ # string_null -+ assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="null"]' -+ -+ # null_1_2_3 -+ assert_exists 3 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="(null)"]' - - # bool_error_cast, int_error_cast, float_error_cast - co='/oval_results/results/system/oval_system_characteristics/collected_objects' -diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml -index adf96571b8..503ec2d4a4 100644 ---- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml -+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml -@@ -262,6 +262,19 @@ - - - -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ - - - -@@ -364,6 +377,21 @@ - - - -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ - - - -@@ -517,6 +545,30 @@ - types.yaml - .float_error_cast - -+ -+ -+ /tmp -+ types.yaml -+ .null_1 -+ -+ -+ -+ /tmp -+ types.yaml -+ .null_2 -+ -+ -+ -+ /tmp -+ types.yaml -+ .null_3 -+ -+ -+ -+ /tmp -+ types.yaml -+ .string_null -+ - - - -diff --git a/tests/probes/yamlfilecontent/types.yaml b/tests/probes/yamlfilecontent/types.yaml -index f05fa3a967..fb26eab5f0 100644 ---- a/tests/probes/yamlfilecontent/types.yaml -+++ b/tests/probes/yamlfilecontent/types.yaml -@@ -19,7 +19,11 @@ bool_false_cast: !!bool "false" - int_cast: !!int "369" - float_cast: !!float "978.65" - string_true: "true" -+string_null: "null" - string_number: "81" - bool_error_cast: !!bool "falsee" - int_error_cast: !!int "50%" - float_error_cast: !!float "58.41$" -+null_1: null -+null_2: -+null_3: !!null "null" diff --git a/SOURCES/openscap-1.3.6-PR-1779-initialize-crapi-once.patch b/SOURCES/openscap-1.3.6-PR-1779-initialize-crapi-once.patch deleted file mode 100644 index 94cc375..0000000 --- a/SOURCES/openscap-1.3.6-PR-1779-initialize-crapi-once.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 5c422226df442855a7dc9834eb4ff74865394a92 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 8 Jul 2021 14:28:16 +0200 -Subject: [PATCH 1/3] Initialize crypto API only once - -The function `crapi_init` calls `gcry_check_version` which must be -called before any other function from the Libgcrypt library. That might -be violated when multiple threads executing multiple probes are running. -The mitigation proposed in this PR is to call `crapi_init` only once -when the session is initialized which means before any threads are -spawned. - -See also: https://www.gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading - -Resolves: RHBZ#1959570 ---- - src/OVAL/oval_probe_session.c | 5 +++++ - src/OVAL/probes/independent/filehash58_probe.c | 6 ------ - src/OVAL/probes/independent/filehash_probe.c | 6 ------ - src/OVAL/probes/independent/filemd5_probe.c | 6 ------ - 4 files changed, 5 insertions(+), 18 deletions(-) - -diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c -index 435ca148fd..6f6d7ad426 100644 ---- a/src/OVAL/oval_probe_session.c -+++ b/src/OVAL/oval_probe_session.c -@@ -93,6 +93,11 @@ static void oval_probe_session_libinit(void) - SEXP_free((SEXP_t *)exp); - - ncache_libinit(); -+ /* -+ * Initialize crypto API -+ */ -+ if (crapi_init (NULL) != 0) -+ return (NULL); - } - - /** -diff --git a/src/OVAL/probes/independent/filehash58_probe.c b/src/OVAL/probes/independent/filehash58_probe.c -index ff1e065746..32a38562bd 100644 ---- a/src/OVAL/probes/independent/filehash58_probe.c -+++ b/src/OVAL/probes/independent/filehash58_probe.c -@@ -210,12 +210,6 @@ int filehash58_probe_offline_mode_supported() - - void *filehash58_probe_init(void) - { -- /* -- * Initialize crypto API -- */ -- if (crapi_init (NULL) != 0) -- return (NULL); -- - /* - * Initialize mutex. - */ -diff --git a/src/OVAL/probes/independent/filehash_probe.c b/src/OVAL/probes/independent/filehash_probe.c -index 522d976512..6d8780dc95 100644 ---- a/src/OVAL/probes/independent/filehash_probe.c -+++ b/src/OVAL/probes/independent/filehash_probe.c -@@ -190,12 +190,6 @@ int filehash_probe_offline_mode_supported() - - void *filehash_probe_init(void) - { -- /* -- * Initialize crypto API -- */ -- if (crapi_init (NULL) != 0) -- return (NULL); -- - /* - * Initialize mutex. - */ -diff --git a/src/OVAL/probes/independent/filemd5_probe.c b/src/OVAL/probes/independent/filemd5_probe.c -index d0de402d8b..99913581f0 100644 ---- a/src/OVAL/probes/independent/filemd5_probe.c -+++ b/src/OVAL/probes/independent/filemd5_probe.c -@@ -163,12 +163,6 @@ int probe_offline_mode_supported() - - void *probe_init (void) - { -- /* -- * Initialize crypto API -- */ -- if (crapi_init (NULL) != 0) -- return (NULL); -- - /* - * Initialize mutex. - */ - -From c4c26d99a59205d744befe52be4e81bcf5f55d9c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Tue, 13 Jul 2021 13:03:21 +0200 -Subject: [PATCH 2/3] Add a missing include - ---- - src/OVAL/oval_probe_session.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c -index 6f6d7ad426..295782b536 100644 ---- a/src/OVAL/oval_probe_session.c -+++ b/src/OVAL/oval_probe_session.c -@@ -48,6 +48,7 @@ - #include "oval_probe_ext.h" - #include "probe-table.h" - #include "oval_types.h" -+#include "crapi/crapi.h" - - #if defined(OSCAP_THREAD_SAFE) - #include - -From 6241a8835574429a787e0dd48d2c0ac2a71499b8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Thu, 15 Jul 2021 14:21:00 +0200 -Subject: [PATCH 3/3] Don't initialize crypto on Windows - ---- - src/OVAL/oval_probe_session.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c -index 295782b536..b443cbcc80 100644 ---- a/src/OVAL/oval_probe_session.c -+++ b/src/OVAL/oval_probe_session.c -@@ -97,8 +97,10 @@ static void oval_probe_session_libinit(void) - /* - * Initialize crypto API - */ -+#ifndef OS_WINDOWS - if (crapi_init (NULL) != 0) - return (NULL); -+#endif - } - - /** diff --git a/SOURCES/openscap-1.3.6-PR-1788-test-rhbz1959570.patch b/SOURCES/openscap-1.3.6-PR-1788-test-rhbz1959570.patch deleted file mode 100644 index 2c175b8..0000000 --- a/SOURCES/openscap-1.3.6-PR-1788-test-rhbz1959570.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 05faede8f6602b7b71d71fd965276225a986fb1f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= -Date: Wed, 28 Jul 2021 13:06:25 +0200 -Subject: [PATCH] Add a regression test for rhbz#1959570 - -The bug was a segmentation fault in filehash58 probe which happened -in openscap-1.3.3-6.el8_3. - -The bug was fixed by https://github.com/OpenSCAP/openscap/pull/1779 -and this patch adds a very small test. ---- - tests/probes/filehash58/CMakeLists.txt | 1 + - .../probes/filehash58/rhbz1959570_segfault.sh | 19 +++++++++ - .../rhbz1959570_segfault_reproducer.xml | 39 +++++++++++++++++++ - 3 files changed, 59 insertions(+) - create mode 100755 tests/probes/filehash58/rhbz1959570_segfault.sh - create mode 100644 tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml - -diff --git a/tests/probes/filehash58/CMakeLists.txt b/tests/probes/filehash58/CMakeLists.txt -index b26d8171fb..cdec0792eb 100644 ---- a/tests/probes/filehash58/CMakeLists.txt -+++ b/tests/probes/filehash58/CMakeLists.txt -@@ -1,3 +1,4 @@ - if(ENABLE_PROBES_INDEPENDENT) - add_oscap_test("test_probes_filehash58.sh") -+ add_oscap_test("rhbz1959570_segfault.sh") - endif() -diff --git a/tests/probes/filehash58/rhbz1959570_segfault.sh b/tests/probes/filehash58/rhbz1959570_segfault.sh -new file mode 100755 -index 0000000000..0c32cc79f1 ---- /dev/null -+++ b/tests/probes/filehash58/rhbz1959570_segfault.sh -@@ -0,0 +1,19 @@ -+#!/usr/bin/env bash -+ -+# Copyright 2021 Red Hat Inc., Durham, North Carolina. -+# All Rights Reserved. -+# -+# OpenSCAP Probes Test Suite. -+# -+# Authors: -+# Jan Černý, -+ -+set -e -o pipefail -+. $builddir/tests/test_common.sh -+ -+# Test Cases -+ -+stderr="$(mktemp)" -+$OSCAP oval eval --id oval:x:def:1 "$srcdir/rhbz1959570_segfault_reproducer.xml" 2> "$stderr" -+[ ! -s "$stderr" ] -+rm "$stderr" -diff --git a/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml -new file mode 100644 -index 0000000000..4b3fc4863a ---- /dev/null -+++ b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml -@@ -0,0 +1,39 @@ -+ -+ -+ -+ jcerny -+ 1 -+ 5.11 -+ 2021-07-28T07:40:55 -+ -+ -+ -+ -+ title -+ description -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ /etc/os-release -+ SHA-256 -+ -+ -+ -+ -+ /etc/os-release -+ SHA-256 -+ 6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af -+ -+ -+ diff --git a/SOURCES/openscap-1.3.7-PR-1841-coverity.patch b/SOURCES/openscap-1.3.7-PR-1841-coverity.patch new file mode 100644 index 0000000..ce3e58d --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1841-coverity.patch @@ -0,0 +1,104 @@ +From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 27 Jan 2022 15:00:33 +0100 +Subject: [PATCH 1/3] Fix shellcheck warning + +Addressing: + +Error: SHELLCHECK_WARNING (CWE-138): [#def1] +/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument. + 108| args+=( "--remediate" ) + 109| args+=( "${OSCAP_REMEDIATE_DS}" ) + 110|-> log "Args: ${args[@]}" + 111| + 112| # Now we are good to go +--- + utils/oscap-remediate | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/utils/oscap-remediate b/utils/oscap-remediate +index fc0b7715f..52e29aa66 100755 +--- a/utils/oscap-remediate ++++ b/utils/oscap-remediate +@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}" + args+=( "--progress-full" ) + args+=( "--remediate" ) + args+=( "${OSCAP_REMEDIATE_DS}" ) +-log "Args: ${args[@]}" ++log "Args: ${args[*]}" + + # Now we are good to go + header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..." + +From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 27 Jan 2022 15:09:02 +0100 +Subject: [PATCH 2/3] Remove superfluous strdup + +We can do this because xccdf_session_set_rule calls strdup on the rule +parameter internally. + +Addressing: + +Error: RESOURCE_LEAK (CWE-772): [#def2] [important] +openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup". +openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)". +openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule". +openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to. + 4148| char *n_rule = strdup(rule); + 4149| xccdf_session_set_rule(sess, n_rule); + 4150|-> } + 4151| + 4152| void xccdf_session_free_py(struct xccdf_session *sess){ +--- + swig/openscap.i | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/swig/openscap.i b/swig/openscap.i +index 2fe1cce99..158a22675 100644 +--- a/swig/openscap.i ++++ b/swig/openscap.i +@@ -559,8 +559,7 @@ struct xccdf_session { + }; + + void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) { +- char *n_rule = strdup(rule); +- xccdf_session_set_rule(sess, n_rule); ++ xccdf_session_set_rule(sess, rule); + } + + void xccdf_session_free_py(struct xccdf_session *sess){ + +From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Thu, 27 Jan 2022 15:16:02 +0100 +Subject: [PATCH 3/3] Add a missing free + +Addressing: +Error: RESOURCE_LEAK (CWE-772): [#def4] [important] +openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new". +openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)". +openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more". +openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key". +openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to. + 2148| oscap_seterr(OSCAP_EFAMILY_XCCDF, + 2149| "Rule '%s' not found in selected profile.", rule_id); + 2150|-> return NULL; + 2151| } + 2152| } +--- + src/XCCDF_POLICY/xccdf_policy.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c +index b63853a38..4d4b7ad0a 100644 +--- a/src/XCCDF_POLICY/xccdf_policy.c ++++ b/src/XCCDF_POLICY/xccdf_policy.c +@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy) + if (oscap_htable_get(policy->rules_found, rule_id) == NULL) { + oscap_seterr(OSCAP_EFAMILY_XCCDF, + "Rule '%s' not found in selected profile.", rule_id); ++ oscap_htable_iterator_free(rit); + return NULL; + } + } diff --git a/SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch b/SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch new file mode 100644 index 0000000..8b09b47 --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch @@ -0,0 +1,32 @@ +From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Mon, 31 Jan 2022 13:45:15 +0100 +Subject: [PATCH] Prevent fails of test_ds_misc.sh + +The SOURCE_DATE_EPOCH environment variable is effective only when it's +set to a value that's older than mtime of the processed file. See the +implementation in ds_sds_compose_add_component_internal in src/DS/sds.c. +However, the file in our test suite has originally been created before +(in 2019) and this mtime can be used when a tarball is produced. To +avoid the test failing, we can modify the mtime using the touch command +just before we run the tests. +--- + tests/DS/test_ds_misc.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh +index 159007518..cffbef303 100755 +--- a/tests/DS/test_ds_misc.sh ++++ b/tests/DS/test_ds_misc.sh +@@ -269,6 +269,8 @@ function test_source_date_epoch() { + local timestamp="2020-03-05T12:09:37" + export SOURCE_DATE_EPOCH="1583410177" + export TZ=UTC ++ # ensure the file mtime is always newer than the $timestamp ++ touch -c "$xccdf" + $OSCAP ds sds-compose "$xccdf" "$result" + assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]' + rm -f "$result" +-- +2.34.1 + diff --git a/SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch b/SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch new file mode 100644 index 0000000..25c9e3a --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch @@ -0,0 +1,27 @@ +From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Tue, 1 Feb 2022 15:06:33 +0100 +Subject: [PATCH] Prevent fails of test_ds_misc.sh + +Other files from which the datastream is composed might also +affect the timestamp attributes in result document depending +on their mtime. +--- + tests/DS/test_ds_misc.sh | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh +index cffbef303..1777c44f4 100755 +--- a/tests/DS/test_ds_misc.sh ++++ b/tests/DS/test_ds_misc.sh +@@ -270,7 +270,9 @@ function test_source_date_epoch() { + export SOURCE_DATE_EPOCH="1583410177" + export TZ=UTC + # ensure the file mtime is always newer than the $timestamp +- touch -c "$xccdf" ++ touch -c "$srcdir/sds_multiple_oval/first-oval.xml" ++ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml" ++ touch -c "$srcdir/sds_multiple_oval/second-oval.xml" + $OSCAP ds sds-compose "$xccdf" "$result" + assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]' + rm -f "$result" diff --git a/SPECS/openscap.spec b/SPECS/openscap.spec index 900978e..8dc5352 100644 --- a/SPECS/openscap.spec +++ b/SPECS/openscap.spec @@ -1,18 +1,14 @@ Name: openscap -Version: 1.3.5 -Release: 6%{?dist} +Version: 1.3.6 +Release: 3%{?dist} Summary: Set of open source libraries enabling integration of the SCAP line of standards Group: System Environment/Libraries License: LGPLv2+ URL: http://www.open-scap.org/ Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz -Patch1: openscap-1.3.6-PR-1745-waive-hugepages.patch -Patch2: openscap-1.3.6-PR-1748-covscan.patch -Patch3: openscap-1.3.6-PR-1749-blueprint-fix.patch -Patch4: openscap-1.3.6-PR-1753-getlogin.patch -Patch5: openscap-1.3.6-PR-1756-yaml-nulls.patch -Patch6: openscap-1.3.6-PR-1779-initialize-crapi-once.patch -Patch7: openscap-1.3.6-PR-1788-test-rhbz1959570.patch +Patch1: openscap-1.3.7-PR-1841-coverity.patch +Patch2: openscap-1.3.7-PR-1843-fix-test-ds-misc.patch +Patch3: openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch BuildRequires: cmake >= 2.6 BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser BuildRequires: rpm-devel @@ -162,6 +158,12 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' # fix python shebangs pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm +# enable oscap-remediate.service here for now +# https://github.com/hughsie/PackageKit/issues/401 +# https://bugzilla.redhat.com/show_bug.cgi?id=1833176 +mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/ +ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service + %clean rm -rf $RPM_BUILD_ROOT @@ -201,7 +203,12 @@ rm -rf $RPM_BUILD_ROOT %{_bindir}/oscap %{_mandir}/man8/oscap-chroot.8.gz %{_bindir}/oscap-chroot +%{_mandir}/man8/oscap-remediate-offline.8.gz +%{_bindir}/oscap-remediate-offline %{_sysconfdir}/bash_completion.d +%{_libexecdir}/oscap-remediate +%{_unitdir}/oscap-remediate.service +%{_unitdir}/system-update.target.wants/ %files utils %doc docs/oscap-scan.cron @@ -221,6 +228,34 @@ rm -rf $RPM_BUILD_ROOT %{_bindir}/oscap-run-sce-script %changelog +* Wed Feb 02 2022 Jan Černý - 1.3.6-3 +- Prevent fails of test_ds_misc.sh + +* Mon Jan 31 2022 Jan Černý - 1.3.6-2 +- Fix coverity issues +- Prevent fails of test_ds_misc.sh + +* Thu Jan 20 2022 Jan Černý - 1.3.6-1 +- Upgrade to the latest upstream release (rhbz#2041781) +- Select and exclude groups of rules on the command line +- The boot-time remediation service for systemd's Offline Update mode + +* Fri Nov 19 2021 Jan Černý - 1.3.5-10 +- Print warning for local files + +* Wed Nov 10 2021 Jan Černý - 1.3.5-9 +- Lower memory limits and improve their checking (rhbz#2021851) +- Remove timestamp from the user manual (rhbz#2022364) + +* Tue Nov 09 2021 Jan Černý - 1.3.5-8 +- Allow local DS components (rhbz#1970529) +- Fix hostname detection in offline scan of UBI 9 images (rhbz#1893888) +- Add an alternative source of hostname (rhbz#1977668) +- Fix oscap-chroot errors in process58_probe caused by empty /proc (rhbz#2008922) + +* Thu Nov 04 2021 Evgenii Kolesnikov - 1.3.5-7 +- Introduce support for Image Builder's Blueprint remediation type (rhbz#2020050) + * Wed Jul 28 2021 Jan Černý - 1.3.5-6 - Initialize crypto API only once (rhbz#1959570) From 1b77493170eed77a46896099f2295a0c468ffcd9 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 8 Nov 2022 01:49:16 -0500 Subject: [PATCH 2/3] import openscap-1.3.6-4.el8 --- ...861-failed-to-check-available-memory.patch | 22 ++ ...-PR-1874-unit-test-read-common-sizet.patch | 233 ++++++++++++++++++ ...cap-1.3.7-PR-1875-reset-errno-strtol.patch | 71 ++++++ ....3.7-PR-1876-disable-oscap-remediate.patch | 82 ++++++ SPECS/openscap.spec | 22 +- 5 files changed, 418 insertions(+), 12 deletions(-) create mode 100644 SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch create mode 100644 SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch diff --git a/SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch b/SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch new file mode 100644 index 0000000..b2951ff --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch @@ -0,0 +1,22 @@ +From 12f9c02a612bb1687676b74a4739126b1913b1fe Mon Sep 17 00:00:00 2001 +From: Ajay Nair +Date: Mon, 9 May 2022 13:31:47 -0400 +Subject: [PATCH] Reset errno before call to strtoll + +--- + src/common/memusage.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/common/memusage.c b/src/common/memusage.c +index c6755f21f1..ffa70b662b 100644 +--- a/src/common/memusage.c ++++ b/src/common/memusage.c +@@ -71,6 +71,8 @@ static int read_common_sizet(void *szp, char *strval) + return (-1); + + *end = '\0'; ++ ++ errno = 0; + *(size_t *)szp = strtoll(strval, NULL, 10); + + if (errno == EINVAL || diff --git a/SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch b/SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch new file mode 100644 index 0000000..7e1fbc3 --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch @@ -0,0 +1,233 @@ +From 07486e9033d8cc1fd03962994b3359cb611a9ac9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Fri, 22 Jul 2022 16:50:01 +0200 +Subject: [PATCH 1/3] Add unit test for read_common_sizet function + +The unit test will cover the missing set errno +to 0 which was the root cause of: +https://github.com/OpenSCAP/openscap/issues/1867 + +Therefore, this test can be used during verification of: +https://bugzilla.redhat.com/show_bug.cgi?id=2109485 +--- + tests/API/probes/CMakeLists.txt | 9 +++++ + tests/API/probes/test_memusage.c | 67 +++++++++++++++++++++++++++++++ + tests/API/probes/test_memusage.sh | 9 +++++ + 3 files changed, 85 insertions(+) + create mode 100644 tests/API/probes/test_memusage.c + create mode 100755 tests/API/probes/test_memusage.sh + +diff --git a/tests/API/probes/CMakeLists.txt b/tests/API/probes/CMakeLists.txt +index ae3c7212a0..2ac4081ac2 100644 +--- a/tests/API/probes/CMakeLists.txt ++++ b/tests/API/probes/CMakeLists.txt +@@ -38,3 +38,12 @@ target_include_directories(oval_fts_list PUBLIC + ) + target_link_libraries(oval_fts_list openscap) + add_oscap_test("fts.sh") ++ ++add_oscap_test_executable(test_memusage ++ "test_memusage.c" ++ "${CMAKE_SOURCE_DIR}/src/common/bfind.c" ++) ++target_include_directories(test_memusage PUBLIC ++ "${CMAKE_SOURCE_DIR}/src/common" ++) ++add_oscap_test("test_memusage.sh") +diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c +new file mode 100644 +index 0000000000..5dced98f03 +--- /dev/null ++++ b/tests/API/probes/test_memusage.c +@@ -0,0 +1,67 @@ ++/* ++ * Copyright 2022 Red Hat Inc., Durham, North Carolina. ++ * All Rights Reserved. ++ * ++ * This library is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU Lesser General Public ++ * License as published by the Free Software Foundation; either ++ * version 2.1 of the License, or (at your option) any later version. ++ * ++ * This library is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ * Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public ++ * License along with this library; if not, write to the Free Software ++ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA ++ * ++ * Authors: ++ * "Jan Černý" ++ */ ++ ++#ifdef HAVE_CONFIG_H ++#include ++#endif ++ ++#include ++#include "memusage.h" ++#include "memusage.c" ++#define OS_LINUX ++ ++static int test_basic() ++{ ++ size_t size; ++ char *strval = strdup("17 MB"); ++ read_common_sizet(&size, strval); ++ free(strval); ++ return (size == 17); ++} ++ ++static int test_errno() ++{ ++ size_t size; ++ char *strval = strdup("17 MB"); ++ ++ /* Test that setting errno outside of the read_common_sizet function ++ * doesn't influence the function and doesn't make the function fail. ++ */ ++ errno = EINVAL; ++ ++ int ret = read_common_sizet(&size, strval); ++ free(strval); ++ return (ret != -1); ++} ++ ++int main(int argc, char *argv[]) ++{ ++ if (!test_basic()) { ++ fprintf(stderr, "test_basic has failed\n"); ++ return 1; ++ } ++ if (!test_errno()) { ++ fprintf(stderr, "test_errno has failed\n"); ++ return 1; ++ } ++ return 0; ++} +diff --git a/tests/API/probes/test_memusage.sh b/tests/API/probes/test_memusage.sh +new file mode 100755 +index 0000000000..4c76bdc0ac +--- /dev/null ++++ b/tests/API/probes/test_memusage.sh +@@ -0,0 +1,9 @@ ++#!/usr/bin/env bash ++ ++. $builddir/tests/test_common.sh ++ ++if [ -n "${CUSTOM_OSCAP+x}" ] ; then ++ exit 255 ++fi ++ ++./test_memusage + +From 2cc649d5e9fbf337bbfca69c21313657a5b8a7cf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Mon, 25 Jul 2022 09:00:36 +0200 +Subject: [PATCH 2/3] Replace license by SPDX ID + +--- + tests/API/probes/test_memusage.c | 22 +--------------------- + 1 file changed, 1 insertion(+), 21 deletions(-) + +diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c +index 5dced98f03..db2915f6d5 100644 +--- a/tests/API/probes/test_memusage.c ++++ b/tests/API/probes/test_memusage.c +@@ -1,24 +1,4 @@ +-/* +- * Copyright 2022 Red Hat Inc., Durham, North Carolina. +- * All Rights Reserved. +- * +- * This library is free software; you can redistribute it and/or +- * modify it under the terms of the GNU Lesser General Public +- * License as published by the Free Software Foundation; either +- * version 2.1 of the License, or (at your option) any later version. +- * +- * This library is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +- * Lesser General Public License for more details. +- * +- * You should have received a copy of the GNU Lesser General Public +- * License along with this library; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +- * +- * Authors: +- * "Jan Černý" +- */ ++// SPDX-License-Identifier: LGPL-2.1-or-later + + #ifdef HAVE_CONFIG_H + #include + +From caadd89e61f5d70e251180055686a3b52c763c66 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Mon, 25 Jul 2022 09:00:45 +0200 +Subject: [PATCH 3/3] Improve unit test for read_common_sizet + +Check for multiple different situations. +--- + tests/API/probes/test_memusage.c | 34 ++++++++++++++++++++++++++++---- + 1 file changed, 30 insertions(+), 4 deletions(-) + +diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c +index db2915f6d5..b9db865d45 100644 +--- a/tests/API/probes/test_memusage.c ++++ b/tests/API/probes/test_memusage.c +@@ -12,16 +12,34 @@ + static int test_basic() + { + size_t size; +- char *strval = strdup("17 MB"); +- read_common_sizet(&size, strval); ++ char *strval = strdup("17 kB\n"); ++ int ret = read_common_sizet(&size, strval); + free(strval); +- return (size == 17); ++ return (size == 17 && ret == 0); ++} ++ ++static int test_no_unit() ++{ ++ size_t size; ++ char *strval = strdup("42"); ++ int ret = read_common_sizet(&size, strval); ++ free(strval); ++ return (ret == -1); ++} ++ ++static int test_invalid_number() ++{ ++ size_t size; ++ char *strval = strdup("www kB\n"); ++ int ret = read_common_sizet(&size, strval); ++ free(strval); ++ return (size == 0 && ret == 0); + } + + static int test_errno() + { + size_t size; +- char *strval = strdup("17 MB"); ++ char *strval = strdup("17 kB\n"); + + /* Test that setting errno outside of the read_common_sizet function + * doesn't influence the function and doesn't make the function fail. +@@ -39,6 +57,14 @@ int main(int argc, char *argv[]) + fprintf(stderr, "test_basic has failed\n"); + return 1; + } ++ if (!test_no_unit()) { ++ fprintf(stderr, "test_no_unit has failed\n"); ++ return 1; ++ } ++ if (!test_invalid_number()) { ++ fprintf(stderr, "test_invalid_number has failed\n"); ++ return 1; ++ } + if (!test_errno()) { + fprintf(stderr, "test_errno has failed\n"); + return 1; diff --git a/SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch b/SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch new file mode 100644 index 0000000..b02507d --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch @@ -0,0 +1,71 @@ +From 55b09ba184c1803a5e1454c44e9e9a5c578dd741 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Mon, 25 Jul 2022 17:10:17 +0200 +Subject: [PATCH] Reset errno before strtol + +This sets errno to 0 before strotol calls after which the errno +is being checked. + +Per man 3 strtol: +Since strtol() can legitimately return 0, LONG_MAX, or +LONG_MIN (LLONG_MAX or LLONG_MIN for strtoll()) on both success and +failure, the calling program should set errno to 0 before the call, and +then determine if an error occurred by checking whether errno has a +nonzero value after the call. + +This is inspired by https://github.com/OpenSCAP/openscap/pull/1861. +--- + src/OVAL/probes/independent/sql57_probe.c | 1 + + src/OVAL/probes/independent/sql_probe.c | 1 + + src/OVAL/probes/oval_fts.c | 1 + + src/OVAL/probes/unix/xinetd_probe.c | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/src/OVAL/probes/independent/sql57_probe.c b/src/OVAL/probes/independent/sql57_probe.c +index ce1466635c..2b35750ee2 100644 +--- a/src/OVAL/probes/independent/sql57_probe.c ++++ b/src/OVAL/probes/independent/sql57_probe.c +@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn) + matchitem1(tok, 'c', + "onnecttimeout", tmp); + if (tmp != NULL) { ++ errno = 0; + info->conn_timeout = strtol(tmp, NULL, 10); + + if (errno == ERANGE || errno == EINVAL) +diff --git a/src/OVAL/probes/independent/sql_probe.c b/src/OVAL/probes/independent/sql_probe.c +index 2ede89d031..71ba3c08c3 100644 +--- a/src/OVAL/probes/independent/sql_probe.c ++++ b/src/OVAL/probes/independent/sql_probe.c +@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn) + matchitem1(tok, 'c', + "onnecttimeout", tmp); + if (tmp != NULL) { ++ errno = 0; + info->conn_timeout = strtol(tmp, NULL, 10); + + if (errno == ERANGE || errno == EINVAL) +diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c +index 1364159c90..f9d0a0c1fd 100644 +--- a/src/OVAL/probes/oval_fts.c ++++ b/src/OVAL/probes/oval_fts.c +@@ -729,6 +729,7 @@ OVAL_FTS *oval_fts_open_prefixed(const char *prefix, SEXP_t *path, SEXP_t *filen + /* max_depth */ + PROBE_ENT_AREF(behaviors, r0, "max_depth", return NULL;); + SEXP_string_cstr_r(r0, cstr_buff, sizeof cstr_buff - 1); ++ errno = 0; + max_depth = strtol(cstr_buff, NULL, 10); + if (errno == EINVAL || errno == ERANGE) { + dE("Invalid value of the `%s' attribute: %s", "recurse_direction", cstr_buff); +diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c +index b3375500db..703a07f513 100644 +--- a/src/OVAL/probes/unix/xinetd_probe.c ++++ b/src/OVAL/probes/unix/xinetd_probe.c +@@ -1280,6 +1280,7 @@ int op_assign_bool(void *var, char *val) + *((bool *)(var)) = false; + } else { + char *endptr = NULL; ++ errno = 0; + *((bool *)(var)) = (bool) strtol (val, &endptr, 2); + if (errno == EINVAL || errno == ERANGE) { + return -1; diff --git a/SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch b/SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch new file mode 100644 index 0000000..a6b3345 --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch @@ -0,0 +1,82 @@ +From 140d60bc751e6c0e4138ab3a2e8e9b130264f905 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Wed, 27 Jul 2022 09:40:29 +0200 +Subject: [PATCH] Add CMake option to disable oscap-remediate service + +This patch introduces a new CMake build option +ENABLE_OSCAP_REMEDIATE_SERVICE which can be used to disable the +installation of the files related to the oscap-remediate systemd +service. Downstream packagers can use this option to disable shipping +the oscap-remediate service in their RPM spec files. + +Resolves: rhbz#2111358 +Resolves: rhbz#2111360 +--- + CMakeLists.txt | 15 +++++++++------ + utils/CMakeLists.txt | 20 +++++++++++--------- + 2 files changed, 20 insertions(+), 15 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 61c57d7a3e..48e19e5203 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -327,6 +327,7 @@ cmake_dependent_option(ENABLE_OSCAP_UTIL_VM "enables the oscap-vm utility, this + cmake_dependent_option(ENABLE_OSCAP_UTIL_PODMAN "enables the oscap-podman utility, this lets you scan Podman containers and container images" ON "NOT WIN32" OFF) + cmake_dependent_option(ENABLE_OSCAP_UTIL_CHROOT "enables the oscap-chroot utility, this lets you scan entire chroots using offline scanning" ON "NOT WIN32" OFF) + option(ENABLE_OSCAP_UTIL_AUTOTAILOR "enables the autotailor utility that is able to perform command-line tailoring" TRUE) ++option(ENABLE_OSCAP_REMEDIATE_SERVICE "enables the oscap-remediate service" TRUE) + + # ---------- TEST-SUITE SWITCHES + +@@ -609,12 +610,14 @@ if(NOT WIN32) + DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig + ) + if(WITH_SYSTEMD) +- # systemd service for offline (boot-time) remediation +- configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY) +- install(FILES +- ${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service +- DESTINATION ${SYSTEMD_UNITDIR} +- ) ++ if(ENABLE_OSCAP_REMEDIATE_SERVICE) ++ # systemd service for offline (boot-time) remediation ++ configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY) ++ install(FILES ++ ${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service ++ DESTINATION ${SYSTEMD_UNITDIR} ++ ) ++ endif() + endif() + endif() + +diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt +index 3f199eaabc..93ce1f2a9d 100644 +--- a/utils/CMakeLists.txt ++++ b/utils/CMakeLists.txt +@@ -59,15 +59,17 @@ if(ENABLE_OSCAP_UTIL) + ) + + if(WITH_SYSTEMD) +- install(PROGRAMS "oscap-remediate" +- DESTINATION ${CMAKE_INSTALL_LIBEXECDIR} +- ) +- install(PROGRAMS "oscap-remediate-offline" +- DESTINATION ${CMAKE_INSTALL_BINDIR} +- ) +- install(FILES "oscap-remediate-offline.8" +- DESTINATION "${CMAKE_INSTALL_MANDIR}/man8" +- ) ++ if (ENABLE_OSCAP_REMEDIATE_SERVICE) ++ install(PROGRAMS "oscap-remediate" ++ DESTINATION ${CMAKE_INSTALL_LIBEXECDIR} ++ ) ++ install(PROGRAMS "oscap-remediate-offline" ++ DESTINATION ${CMAKE_INSTALL_BINDIR} ++ ) ++ install(FILES "oscap-remediate-offline.8" ++ DESTINATION "${CMAKE_INSTALL_MANDIR}/man8" ++ ) ++ endif() + endif() + endif() + endif() diff --git a/SPECS/openscap.spec b/SPECS/openscap.spec index 8dc5352..d0f066b 100644 --- a/SPECS/openscap.spec +++ b/SPECS/openscap.spec @@ -1,6 +1,6 @@ Name: openscap Version: 1.3.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Set of open source libraries enabling integration of the SCAP line of standards Group: System Environment/Libraries License: LGPLv2+ @@ -9,6 +9,10 @@ Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version} Patch1: openscap-1.3.7-PR-1841-coverity.patch Patch2: openscap-1.3.7-PR-1843-fix-test-ds-misc.patch Patch3: openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch +Patch4: openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch +Patch5: openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch +Patch6: openscap-1.3.7-PR-1875-reset-errno-strtol.patch +Patch7: openscap-1.3.7-PR-1876-disable-oscap-remediate.patch BuildRequires: cmake >= 2.6 BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser BuildRequires: rpm-devel @@ -140,6 +144,7 @@ cd build -DENABLE_OSCAP_UTIL_CHROOT=ON \ -DENABLE_OSCAP_UTIL_PODMAN=ON \ -DENABLE_OSCAP_UTIL_VM=ON \ + -DENABLE_OSCAP_REMEDIATE_SERVICE=OFF \ .. make %{?_smp_mflags} make docs @@ -158,12 +163,6 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' # fix python shebangs pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm -# enable oscap-remediate.service here for now -# https://github.com/hughsie/PackageKit/issues/401 -# https://bugzilla.redhat.com/show_bug.cgi?id=1833176 -mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/ -ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service - %clean rm -rf $RPM_BUILD_ROOT @@ -203,12 +202,7 @@ rm -rf $RPM_BUILD_ROOT %{_bindir}/oscap %{_mandir}/man8/oscap-chroot.8.gz %{_bindir}/oscap-chroot -%{_mandir}/man8/oscap-remediate-offline.8.gz -%{_bindir}/oscap-remediate-offline %{_sysconfdir}/bash_completion.d -%{_libexecdir}/oscap-remediate -%{_unitdir}/oscap-remediate.service -%{_unitdir}/system-update.target.wants/ %files utils %doc docs/oscap-scan.cron @@ -228,6 +222,10 @@ rm -rf $RPM_BUILD_ROOT %{_bindir}/oscap-run-sce-script %changelog +* Thu Jul 21 2022 Jan Černý - 1.3.6-4 +- Fix potential invalid scan results in OpenSCAP (rhbz#2111040) +- Remove oscap-remediate service (rhbz#2111360) + * Wed Feb 02 2022 Jan Černý - 1.3.6-3 - Prevent fails of test_ds_misc.sh From cc3c270e0148bfa63ff5f8f2e7df935cbce941c3 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 21 Feb 2023 08:49:45 +0000 Subject: [PATCH 3/3] import openscap-1.3.6-5.el8_7 --- ...penscap-1.3.7-PR-1891-xmlfilecontent.patch | 132 ++++++++++++++++++ SPECS/openscap.spec | 6 +- 2 files changed, 137 insertions(+), 1 deletion(-) create mode 100644 SOURCES/openscap-1.3.7-PR-1891-xmlfilecontent.patch diff --git a/SOURCES/openscap-1.3.7-PR-1891-xmlfilecontent.patch b/SOURCES/openscap-1.3.7-PR-1891-xmlfilecontent.patch new file mode 100644 index 0000000..caa356b --- /dev/null +++ b/SOURCES/openscap-1.3.7-PR-1891-xmlfilecontent.patch @@ -0,0 +1,132 @@ +From 9c2052febe494ca5fe8e3fef7996fd2c2c736785 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= +Date: Wed, 2 Nov 2022 09:04:25 +0100 +Subject: [PATCH] Don't emit items if XPath doesn't match + +This commit fixes the behavior of the xmlfilecontent probe in situation +when the XPath query in xmlfilecontent_object doesn't match any node in +the given XML file and the query returns an empty node set. Currently, +in this situation, we emit an item in which we add an empty value_of +element. However, this value_of element has its datatype attribute set +to an empty string, which is invalid according to the OVAL schema. When +we try to make the OVAL results valid, we face the problem that it isn't +clear what should be the value of the datatype attribute for empty +elements. But as we can realize the XPath doesn't match anything means +that the requested object doesn't exist on the system, so a better +behavior would be to not produce a xmlfilecontent54_item. That is +consistent with eg. situation when a regular expression matched nothing +in textfilecontent54_object. This commit therefore stops the item +generation in this situation. + +This commit also extends the existing test to cover the situation +of XPath queries for nonexistent element and nonexistent attribute. + +Fixes: #1890, rhbz#2138884, rhbz#2139060 +--- + .../probes/independent/xmlfilecontent_probe.c | 5 +-- + .../test_xmlfilecontent_probe.sh | 6 +++ + .../test_xmlfilecontent_probe.xml | 38 +++++++++++++++++++ + 3 files changed, 46 insertions(+), 3 deletions(-) + +diff --git a/src/OVAL/probes/independent/xmlfilecontent_probe.c b/src/OVAL/probes/independent/xmlfilecontent_probe.c +index 6c70b359ba..5d56afa0d4 100644 +--- a/src/OVAL/probes/independent/xmlfilecontent_probe.c ++++ b/src/OVAL/probes/independent/xmlfilecontent_probe.c +@@ -296,10 +296,9 @@ static int process_file(const char *prefix, const char *path, const char *filena + + node_cnt = nodes->nodeNr; + dD("node_cnt: %d.", node_cnt); +- if (node_cnt == 0) { +- probe_item_setstatus(item, SYSCHAR_STATUS_DOES_NOT_EXIST); +- probe_item_ent_add(item, "value_of", NULL, NULL); +- probe_itement_setstatus(item, "value_of", 1, SYSCHAR_STATUS_DOES_NOT_EXIST); ++ if (node_cnt <= 0) { ++ ret = -5; ++ goto cleanup; + } else { + node_tab = nodes->nodeTab; + for (i = 0; i < node_cnt; ++i) { +diff --git a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh +index e3c56a8606..68138dad75 100755 +--- a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh ++++ b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh +@@ -6,9 +6,15 @@ set -e -o pipefail + cp $srcdir/example.xml /tmp/ + result=$(mktemp) + $OSCAP oval eval --results $result $srcdir/test_xmlfilecontent_probe.xml ++# Even if OSCAP_FULL_VALIDATION is set, an invalid OVAL result doesn't cause ++# the "oscap oval eval" to return a non-zero value, so let's run validation ++# as a separate command ++$OSCAP oval validate "$result" + assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:1" and @result="true"]' + assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:2" and @result="true"]' + assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:3" and @result="true"]' + assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:4" and @result="true"]' + assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:5" and @result="true"]' ++assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:6" and @result="true"]' ++assert_exists 1 '/oval_results/results/system/definitions/definition[@definition_id="oval:x:def:7" and @result="true"]' + rm -f $result +\ No newline at end of file +diff --git a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml +index 3350df0c49..0a9708d4b6 100644 +--- a/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml ++++ b/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.xml +@@ -66,6 +66,30 @@ + + + ++ ++ ++ A simple test OVAL for xmlfilecontent test - check nonexisting attribute ++ x ++ ++ x ++ ++ ++ ++ ++ ++ ++ ++ ++ A simple test OVAL for xmlfilecontent test - check nonexisting element ++ x ++ ++ x ++ ++ ++ ++ ++ ++ + + + +@@ -89,6 +113,12 @@ + + + ++ ++ ++ ++ ++ ++ + + + +@@ -112,6 +142,14 @@ + /tmp/example.xml + //*[@regid="mycoyote.com"]/@name + ++ ++ /tmp/example.xml ++ /SoftwareIdentity/@thisattributedoesnotexist ++ ++ ++ /tmp/example.xml ++ /SoftwareIdentity/thiselementdoesnotexist ++ + + + diff --git a/SPECS/openscap.spec b/SPECS/openscap.spec index d0f066b..9a479dd 100644 --- a/SPECS/openscap.spec +++ b/SPECS/openscap.spec @@ -1,6 +1,6 @@ Name: openscap Version: 1.3.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Set of open source libraries enabling integration of the SCAP line of standards Group: System Environment/Libraries License: LGPLv2+ @@ -13,6 +13,7 @@ Patch4: openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch Patch5: openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch Patch6: openscap-1.3.7-PR-1875-reset-errno-strtol.patch Patch7: openscap-1.3.7-PR-1876-disable-oscap-remediate.patch +Patch8: openscap-1.3.7-PR-1891-xmlfilecontent.patch BuildRequires: cmake >= 2.6 BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser BuildRequires: rpm-devel @@ -222,6 +223,9 @@ rm -rf $RPM_BUILD_ROOT %{_bindir}/oscap-run-sce-script %changelog +* Mon Jan 30 2023 Jan Černý - 1.3.6-5 +- Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2165577) + * Thu Jul 21 2022 Jan Černý - 1.3.6-4 - Fix potential invalid scan results in OpenSCAP (rhbz#2111040) - Remove oscap-remediate service (rhbz#2111360)