rpms/openscap
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import openscap-1.3.7-1.el8

Browse Source
This commit is contained in:
CentOS Sources 2023-03-28 12:23:43 +00:00 committed by Stepan Oksanichenko
parent c8d7fd5549
commit d74f208a58
10 changed files with 9 additions and 582 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/openscap-1.3.6.tar.gz SOURCES/openscap-1.3.7.tar.gz

2
.openscap.metadata
View File

@ -1 +1 @@
8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz 238acbe6e18162b54cbdd0083c52511c00faa268 SOURCES/openscap-1.3.7.tar.gz

104
SOURCES/openscap-1.3.7-PR-1841-coverity.patch
View File

@ -1,104 +0,0 @@
From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:00:33 +0100
Subject: [PATCH 1/3] Fix shellcheck warning
Addressing:
Error: SHELLCHECK_WARNING (CWE-138): [#def1]
/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
108| args+=( "--remediate" )
109| args+=( "${OSCAP_REMEDIATE_DS}" )
110|-> log "Args: ${args[@]}"
111|
112| # Now we are good to go
---
utils/oscap-remediate | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/utils/oscap-remediate b/utils/oscap-remediate
index fc0b7715f..52e29aa66 100755
--- a/utils/oscap-remediate
+++ b/utils/oscap-remediate
@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
args+=( "--progress-full" )
args+=( "--remediate" )
args+=( "${OSCAP_REMEDIATE_DS}" )
-log "Args: ${args[@]}"
+log "Args: ${args[*]}"
# Now we are good to go
header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:09:02 +0100
Subject: [PATCH 2/3] Remove superfluous strdup
We can do this because xccdf_session_set_rule calls strdup on the rule
parameter internally.
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
4148| char *n_rule = strdup(rule);
4149| xccdf_session_set_rule(sess, n_rule);
4150|-> }
4151|
4152| void xccdf_session_free_py(struct xccdf_session *sess){
---
swig/openscap.i | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/swig/openscap.i b/swig/openscap.i
index 2fe1cce99..158a22675 100644
--- a/swig/openscap.i
+++ b/swig/openscap.i
@@ -559,8 +559,7 @@ struct xccdf_session {
};
void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) {
- char *n_rule = strdup(rule);
- xccdf_session_set_rule(sess, n_rule);
+ xccdf_session_set_rule(sess, rule);
}
void xccdf_session_free_py(struct xccdf_session *sess){
From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:16:02 +0100
Subject: [PATCH 3/3] Add a missing free
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
2148| oscap_seterr(OSCAP_EFAMILY_XCCDF,
2149| "Rule '%s' not found in selected profile.", rule_id);
2150|-> return NULL;
2151| }
2152| }
---
src/XCCDF_POLICY/xccdf_policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
index b63853a38..4d4b7ad0a 100644
--- a/src/XCCDF_POLICY/xccdf_policy.c
+++ b/src/XCCDF_POLICY/xccdf_policy.c
@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
oscap_seterr(OSCAP_EFAMILY_XCCDF,
"Rule '%s' not found in selected profile.", rule_id);
+ oscap_htable_iterator_free(rit);
return NULL;
}
}

32
SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
View File

@ -1,32 +0,0 @@
From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 31 Jan 2022 13:45:15 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
The SOURCE_DATE_EPOCH environment variable is effective only when it's
set to a value that's older than mtime of the processed file. See the
implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
However, the file in our test suite has originally been created before
(in 2019) and this mtime can be used when a tarball is produced. To
avoid the test failing, we can modify the mtime using the touch command
just before we run the tests.
---
tests/DS/test_ds_misc.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index 159007518..cffbef303 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -269,6 +269,8 @@ function test_source_date_epoch() {
local timestamp="2020-03-05T12:09:37"
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
+ # ensure the file mtime is always newer than the $timestamp
+ touch -c "$xccdf"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"
--
2.34.1

27
SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
View File

@ -1,27 +0,0 @@
From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 1 Feb 2022 15:06:33 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
Other files from which the datastream is composed might also
affect the timestamp attributes in result document depending
on their mtime.
---
tests/DS/test_ds_misc.sh | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index cffbef303..1777c44f4 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -270,7 +270,9 @@ function test_source_date_epoch() {
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
# ensure the file mtime is always newer than the $timestamp
- touch -c "$xccdf"
+ touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
+ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
+ touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"

22
SOURCES/openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
View File

@ -1,22 +0,0 @@
From 12f9c02a612bb1687676b74a4739126b1913b1fe Mon Sep 17 00:00:00 2001
From: Ajay Nair <ajaynair59@gmail.com>
Date: Mon, 9 May 2022 13:31:47 -0400
Subject: [PATCH] Reset errno before call to strtoll
---
src/common/memusage.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/common/memusage.c b/src/common/memusage.c
index c6755f21f1..ffa70b662b 100644
--- a/src/common/memusage.c
+++ b/src/common/memusage.c
@@ -71,6 +71,8 @@ static int read_common_sizet(void *szp, char *strval)
return (-1);
*end = '\0';
+
+ errno = 0;
*(size_t *)szp = strtoll(strval, NULL, 10);
if (errno == EINVAL ||

233
SOURCES/openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
View File

@ -1,233 +0,0 @@
From 07486e9033d8cc1fd03962994b3359cb611a9ac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 22 Jul 2022 16:50:01 +0200
Subject: [PATCH 1/3] Add unit test for read_common_sizet function
The unit test will cover the missing set errno
to 0 which was the root cause of:
https://github.com/OpenSCAP/openscap/issues/1867
Therefore, this test can be used during verification of:
https://bugzilla.redhat.com/show_bug.cgi?id=2109485
---
tests/API/probes/CMakeLists.txt | 9 +++++
tests/API/probes/test_memusage.c | 67 +++++++++++++++++++++++++++++++
tests/API/probes/test_memusage.sh | 9 +++++
3 files changed, 85 insertions(+)
create mode 100644 tests/API/probes/test_memusage.c
create mode 100755 tests/API/probes/test_memusage.sh
diff --git a/tests/API/probes/CMakeLists.txt b/tests/API/probes/CMakeLists.txt
index ae3c7212a0..2ac4081ac2 100644
--- a/tests/API/probes/CMakeLists.txt
+++ b/tests/API/probes/CMakeLists.txt
@@ -38,3 +38,12 @@ target_include_directories(oval_fts_list PUBLIC
)
target_link_libraries(oval_fts_list openscap)
add_oscap_test("fts.sh")
+
+add_oscap_test_executable(test_memusage
+ "test_memusage.c"
+ "${CMAKE_SOURCE_DIR}/src/common/bfind.c"
+)
+target_include_directories(test_memusage PUBLIC
+ "${CMAKE_SOURCE_DIR}/src/common"
+)
+add_oscap_test("test_memusage.sh")
diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
new file mode 100644
index 0000000000..5dced98f03
--- /dev/null
+++ b/tests/API/probes/test_memusage.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2022 Red Hat Inc., Durham, North Carolina.
+ * All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ *
+ * Authors:
+ * "Jan Černý" <jcerny@redhat.com>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include "memusage.h"
+#include "memusage.c"
+#define OS_LINUX
+
+static int test_basic()
+{
+ size_t size;
+ char *strval = strdup("17 MB");
+ read_common_sizet(&size, strval);
+ free(strval);
+ return (size == 17);
+}
+
+static int test_errno()
+{
+ size_t size;
+ char *strval = strdup("17 MB");
+
+ /* Test that setting errno outside of the read_common_sizet function
+ * doesn't influence the function and doesn't make the function fail.
+ */
+ errno = EINVAL;
+
+ int ret = read_common_sizet(&size, strval);
+ free(strval);
+ return (ret != -1);
+}
+
+int main(int argc, char *argv[])
+{
+ if (!test_basic()) {
+ fprintf(stderr, "test_basic has failed\n");
+ return 1;
+ }
+ if (!test_errno()) {
+ fprintf(stderr, "test_errno has failed\n");
+ return 1;
+ }
+ return 0;
+}
diff --git a/tests/API/probes/test_memusage.sh b/tests/API/probes/test_memusage.sh
new file mode 100755
index 0000000000..4c76bdc0ac
--- /dev/null
+++ b/tests/API/probes/test_memusage.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+. $builddir/tests/test_common.sh
+
+if [ -n "${CUSTOM_OSCAP+x}" ] ; then
+ exit 255
+fi
+
+./test_memusage
From 2cc649d5e9fbf337bbfca69c21313657a5b8a7cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 25 Jul 2022 09:00:36 +0200
Subject: [PATCH 2/3] Replace license by SPDX ID
---
tests/API/probes/test_memusage.c | 22 +---------------------
1 file changed, 1 insertion(+), 21 deletions(-)
diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
index 5dced98f03..db2915f6d5 100644
--- a/tests/API/probes/test_memusage.c
+++ b/tests/API/probes/test_memusage.c
@@ -1,24 +1,4 @@
-/*
- * Copyright 2022 Red Hat Inc., Durham, North Carolina.
- * All Rights Reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- *
- * Authors:
- * "Jan Černý" <jcerny@redhat.com>
- */
+// SPDX-License-Identifier: LGPL-2.1-or-later
#ifdef HAVE_CONFIG_H
#include <config.h>
From caadd89e61f5d70e251180055686a3b52c763c66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 25 Jul 2022 09:00:45 +0200
Subject: [PATCH 3/3] Improve unit test for read_common_sizet
Check for multiple different situations.
---
tests/API/probes/test_memusage.c | 34 ++++++++++++++++++++++++++++----
1 file changed, 30 insertions(+), 4 deletions(-)
diff --git a/tests/API/probes/test_memusage.c b/tests/API/probes/test_memusage.c
index db2915f6d5..b9db865d45 100644
--- a/tests/API/probes/test_memusage.c
+++ b/tests/API/probes/test_memusage.c
@@ -12,16 +12,34 @@
static int test_basic()
{
size_t size;
- char *strval = strdup("17 MB");
- read_common_sizet(&size, strval);
+ char *strval = strdup("17 kB\n");
+ int ret = read_common_sizet(&size, strval);
free(strval);
- return (size == 17);
+ return (size == 17 && ret == 0);
+}
+
+static int test_no_unit()
+{
+ size_t size;
+ char *strval = strdup("42");
+ int ret = read_common_sizet(&size, strval);
+ free(strval);
+ return (ret == -1);
+}
+
+static int test_invalid_number()
+{
+ size_t size;
+ char *strval = strdup("www kB\n");
+ int ret = read_common_sizet(&size, strval);
+ free(strval);
+ return (size == 0 && ret == 0);
}
static int test_errno()
{
size_t size;
- char *strval = strdup("17 MB");
+ char *strval = strdup("17 kB\n");
/* Test that setting errno outside of the read_common_sizet function
* doesn't influence the function and doesn't make the function fail.
@@ -39,6 +57,14 @@ int main(int argc, char *argv[])
fprintf(stderr, "test_basic has failed\n");
return 1;
}
+ if (!test_no_unit()) {
+ fprintf(stderr, "test_no_unit has failed\n");
+ return 1;
+ }
+ if (!test_invalid_number()) {
+ fprintf(stderr, "test_invalid_number has failed\n");
+ return 1;
+ }
if (!test_errno()) {
fprintf(stderr, "test_errno has failed\n");
return 1;

71
SOURCES/openscap-1.3.7-PR-1875-reset-errno-strtol.patch
View File

@ -1,71 +0,0 @@
From 55b09ba184c1803a5e1454c44e9e9a5c578dd741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 25 Jul 2022 17:10:17 +0200
Subject: [PATCH] Reset errno before strtol
This sets errno to 0 before strotol calls after which the errno
is being checked.
Per man 3 strtol:
Since strtol() can legitimately return 0, LONG_MAX, or
LONG_MIN (LLONG_MAX or LLONG_MIN for strtoll()) on both success and
failure, the calling program should set errno to 0 before the call, and
then determine if an error occurred by checking whether errno has a
nonzero value after the call.
This is inspired by https://github.com/OpenSCAP/openscap/pull/1861.
---
src/OVAL/probes/independent/sql57_probe.c | 1 +
src/OVAL/probes/independent/sql_probe.c | 1 +
src/OVAL/probes/oval_fts.c | 1 +
src/OVAL/probes/unix/xinetd_probe.c | 1 +
4 files changed, 4 insertions(+)
diff --git a/src/OVAL/probes/independent/sql57_probe.c b/src/OVAL/probes/independent/sql57_probe.c
index ce1466635c..2b35750ee2 100644
--- a/src/OVAL/probes/independent/sql57_probe.c
+++ b/src/OVAL/probes/independent/sql57_probe.c
@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
matchitem1(tok, 'c',
"onnecttimeout", tmp);
if (tmp != NULL) {
+ errno = 0;
info->conn_timeout = strtol(tmp, NULL, 10);
if (errno == ERANGE || errno == EINVAL)
diff --git a/src/OVAL/probes/independent/sql_probe.c b/src/OVAL/probes/independent/sql_probe.c
index 2ede89d031..71ba3c08c3 100644
--- a/src/OVAL/probes/independent/sql_probe.c
+++ b/src/OVAL/probes/independent/sql_probe.c
@@ -216,6 +216,7 @@ static int dbURIInfo_parse(dbURIInfo_t *info, const char *conn)
matchitem1(tok, 'c',
"onnecttimeout", tmp);
if (tmp != NULL) {
+ errno = 0;
info->conn_timeout = strtol(tmp, NULL, 10);
if (errno == ERANGE || errno == EINVAL)
diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c
index 1364159c90..f9d0a0c1fd 100644
--- a/src/OVAL/probes/oval_fts.c
+++ b/src/OVAL/probes/oval_fts.c
@@ -729,6 +729,7 @@ OVAL_FTS *oval_fts_open_prefixed(const char *prefix, SEXP_t *path, SEXP_t *filen
/* max_depth */
PROBE_ENT_AREF(behaviors, r0, "max_depth", return NULL;);
SEXP_string_cstr_r(r0, cstr_buff, sizeof cstr_buff - 1);
+ errno = 0;
max_depth = strtol(cstr_buff, NULL, 10);
if (errno == EINVAL || errno == ERANGE) {
dE("Invalid value of the `%s' attribute: %s", "recurse_direction", cstr_buff);
diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c
index b3375500db..703a07f513 100644
--- a/src/OVAL/probes/unix/xinetd_probe.c
+++ b/src/OVAL/probes/unix/xinetd_probe.c
@@ -1280,6 +1280,7 @@ int op_assign_bool(void *var, char *val)
*((bool *)(var)) = false;
} else {
char *endptr = NULL;
+ errno = 0;
*((bool *)(var)) = (bool) strtol (val, &endptr, 2);
if (errno == EINVAL || errno == ERANGE) {
return -1;

82
SOURCES/openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
View File

@ -1,82 +0,0 @@
From 140d60bc751e6c0e4138ab3a2e8e9b130264f905 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Wed, 27 Jul 2022 09:40:29 +0200
Subject: [PATCH] Add CMake option to disable oscap-remediate service
This patch introduces a new CMake build option
ENABLE_OSCAP_REMEDIATE_SERVICE which can be used to disable the
installation of the files related to the oscap-remediate systemd
service. Downstream packagers can use this option to disable shipping
the oscap-remediate service in their RPM spec files.
Resolves: rhbz#2111358
Resolves: rhbz#2111360
---
CMakeLists.txt | 15 +++++++++------
utils/CMakeLists.txt | 20 +++++++++++---------
2 files changed, 20 insertions(+), 15 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 61c57d7a3e..48e19e5203 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -327,6 +327,7 @@ cmake_dependent_option(ENABLE_OSCAP_UTIL_VM "enables the oscap-vm utility, this
cmake_dependent_option(ENABLE_OSCAP_UTIL_PODMAN "enables the oscap-podman utility, this lets you scan Podman containers and container images" ON "NOT WIN32" OFF)
cmake_dependent_option(ENABLE_OSCAP_UTIL_CHROOT "enables the oscap-chroot utility, this lets you scan entire chroots using offline scanning" ON "NOT WIN32" OFF)
option(ENABLE_OSCAP_UTIL_AUTOTAILOR "enables the autotailor utility that is able to perform command-line tailoring" TRUE)
+option(ENABLE_OSCAP_REMEDIATE_SERVICE "enables the oscap-remediate service" TRUE)
# ---------- TEST-SUITE SWITCHES
@@ -609,12 +610,14 @@ if(NOT WIN32)
DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
)
if(WITH_SYSTEMD)
- # systemd service for offline (boot-time) remediation
- configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
- install(FILES
- ${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
- DESTINATION ${SYSTEMD_UNITDIR}
- )
+ if(ENABLE_OSCAP_REMEDIATE_SERVICE)
+ # systemd service for offline (boot-time) remediation
+ configure_file("oscap-remediate.service.in" "oscap-remediate.service" @ONLY)
+ install(FILES
+ ${CMAKE_CURRENT_BINARY_DIR}/oscap-remediate.service
+ DESTINATION ${SYSTEMD_UNITDIR}
+ )
+ endif()
endif()
endif()
diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt
index 3f199eaabc..93ce1f2a9d 100644
--- a/utils/CMakeLists.txt
+++ b/utils/CMakeLists.txt
@@ -59,15 +59,17 @@ if(ENABLE_OSCAP_UTIL)
)
if(WITH_SYSTEMD)
- install(PROGRAMS "oscap-remediate"
- DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
- )
- install(PROGRAMS "oscap-remediate-offline"
- DESTINATION ${CMAKE_INSTALL_BINDIR}
- )
- install(FILES "oscap-remediate-offline.8"
- DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
- )
+ if (ENABLE_OSCAP_REMEDIATE_SERVICE)
+ install(PROGRAMS "oscap-remediate"
+ DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}
+ )
+ install(PROGRAMS "oscap-remediate-offline"
+ DESTINATION ${CMAKE_INSTALL_BINDIR}
+ )
+ install(FILES "oscap-remediate-offline.8"
+ DESTINATION "${CMAKE_INSTALL_MANDIR}/man8"
+ )
+ endif()
endif()
endif()
endif()

16
SPECS/openscap.spec
View File

@ -1,18 +1,11 @@
Name: openscap Name: openscap
Version: 1.3.6 Version: 1.3.7
Release: 4%{?dist} Release: 1%{?dist}
Summary: Set of open source libraries enabling integration of the SCAP line of standards Summary: Set of open source libraries enabling integration of the SCAP line of standards
Group: System Environment/Libraries Group: System Environment/Libraries
License: LGPLv2+ License: LGPLv2+
URL: http://www.open-scap.org/ URL: http://www.open-scap.org/
Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
Patch1: openscap-1.3.7-PR-1841-coverity.patch
Patch2: openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
Patch3: openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
Patch4: openscap-1.3.7-PR-1861-failed-to-check-available-memory.patch
Patch5: openscap-1.3.7-PR-1874-unit-test-read-common-sizet.patch
Patch6: openscap-1.3.7-PR-1875-reset-errno-strtol.patch
Patch7: openscap-1.3.7-PR-1876-disable-oscap-remediate.patch
BuildRequires: cmake >= 2.6 BuildRequires: cmake >= 2.6
BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser BuildRequires: swig libxml2-devel libxslt-devel perl-generators perl-XML-Parser
BuildRequires: rpm-devel BuildRequires: rpm-devel
@ -222,6 +215,11 @@ rm -rf $RPM_BUILD_ROOT
%{_bindir}/oscap-run-sce-script %{_bindir}/oscap-run-sce-script
%changelog %changelog
* Fri Jan 27 2023 Jan Černý <jcerny@redhat.com> - 1.3.7-1
- Upgrade to the latest upstream release (rhbz#2159290)
- Fix error when processing OVAL filters (rhbz#2126882)
- Don't emit xmlfilecontent items if XPath doesn't match (rhbz#2139060)
* Thu Jul 21 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-4 * Thu Jul 21 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-4
- Fix potential invalid scan results in OpenSCAP (rhbz#2111040) - Fix potential invalid scan results in OpenSCAP (rhbz#2111040)
- Remove oscap-remediate service (rhbz#2111360) - Remove oscap-remediate service (rhbz#2111360)