rpms/openscap
7
0
Fork 0
Code Issues Pull Requests Releases Activity

AlmaLinux changes

Browse Source
This commit is contained in:
eabdullin 2022-04-08 13:01:07 +03:00
commit fd26b90189
28 changed files with 588 additions and 6344 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/openscap-1.3.5.tar.gz
SOURCES/openscap-1.3.6.tar.gz

2
.openscap.metadata
View File

@ -1 +1 @@
77494383980082f8bc625a6e196a6760d30a5107 SOURCES/openscap-1.3.5.tar.gz
8c1b41bb7c32c22d541a6881ab8c5b8bef06890f SOURCES/openscap-1.3.6.tar.gz

72
SOURCES/openscap-1.3.6-alternative-hostname-pr-1806.patch
View File

@ -1,72 +0,0 @@
From d97687c12ba6cbca1d732534ff7394bd14547d92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 10 Sep 2021 14:53:42 +0200
Subject: [PATCH] Add an alternative source of hostname
If /etc/hostname can't be read, we will try to open /proc/sys/kernel/hostname instead.
Resolves: rhbz#1977668
---
src/XCCDF/result.c | 5 ++++
tests/API/XCCDF/unittests/CMakeLists.txt | 1 +
.../XCCDF/unittests/test_results_hostname.sh | 26 +++++++++++++++++++
3 files changed, 32 insertions(+)
create mode 100755 tests/API/XCCDF/unittests/test_results_hostname.sh
diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c
index 91fcc6041d..c0ad4b926f 100644
--- a/src/XCCDF/result.c
+++ b/src/XCCDF/result.c
@@ -271,6 +271,11 @@ static char *_get_etc_hostname(const char *oscap_probe_root)
fp = oscap_fopen_with_prefix(oscap_probe_root, "/etc/hostname");
+ if (fp == NULL) {
+ dD("Trying to use /proc/sys/kernel/hostname instead of /etc/hostname");
+ fp = oscap_fopen_with_prefix(oscap_probe_root, "/proc/sys/kernel/hostname");
+ }
+
if (fp == NULL)
goto fail;
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
index 52645834c4..6549538440 100644
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
@@ -101,3 +101,4 @@ add_oscap_test("test_fix_arf.sh")
add_oscap_test("test_fix_resultid_by_suffix.sh")
add_oscap_test("test_generate_fix_ansible_vars.sh")
add_oscap_test("test_xccdf_requires_conflicts.sh")
+add_oscap_test("test_results_hostname.sh")
diff --git a/tests/API/XCCDF/unittests/test_results_hostname.sh b/tests/API/XCCDF/unittests/test_results_hostname.sh
new file mode 100755
index 0000000000..c4408affbb
--- /dev/null
+++ b/tests/API/XCCDF/unittests/test_results_hostname.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+. $builddir/tests/test_common.sh
+
+set -e
+set -o pipefail
+
+result=$(mktemp)
+tmpdir=$(mktemp -d)
+
+export OSCAP_PROBE_ROOT="$tmpdir"
+
+mkdir -p "$tmpdir/etc"
+echo "hostname_defined_in_etc_hostname" > "$tmpdir/etc/hostname"
+$OSCAP xccdf eval --results "$result" "$srcdir/test_single_rule.ds.xml" || ret=$?
+assert_exists 1 '/Benchmark/TestResult/target[text()="hostname_defined_in_etc_hostname"]'
+assert_exists 0 '/Benchmark/TestResult/target[text()="hostname_defined_in_proc_sys_kernel"]'
+
+rm -rf "$tmpdir/etc/hostname"
+mkdir -p "$tmpdir/proc/sys/kernel/"
+echo "hostname_defined_in_proc_sys_kernel" > "$tmpdir/proc/sys/kernel/hostname"
+$OSCAP xccdf eval --results "$result" "$srcdir/test_single_rule.ds.xml" || ret=$?
+assert_exists 0 '/Benchmark/TestResult/target[text()="hostname_defined_in_etc_hostname"]'
+assert_exists 1 '/Benchmark/TestResult/target[text()="hostname_defined_in_proc_sys_kernel"]'
+
+rm -f "$result"
+rm -rf "$tmpdir"

64
SOURCES/openscap-1.3.6-blueprint-fix-pr-1749.patch
View File

@ -1,64 +0,0 @@
From 5f0a9033b466d929613a2a55a1524ec75c09b5b0 Mon Sep 17 00:00:00 2001
From: Evgeny Kolesnikov <ekolesni@redhat.com>
Date: Thu, 6 May 2021 08:14:12 +0200
Subject: [PATCH] Introduce OSBuild Blueprint fix type
---
utils/oscap-xccdf.c | 7 +++++--
utils/oscap.8 | 2 +-
xsl/xccdf-share.xsl | 1 +
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/utils/oscap-xccdf.c b/utils/oscap-xccdf.c
index 95c1c7658d..801e54fa35 100644
--- a/utils/oscap-xccdf.c
+++ b/utils/oscap-xccdf.c
@@ -275,7 +275,8 @@ static struct oscap_module XCCDF_GEN_FIX = {
.usage = "[options] xccdf-file.xml",
.help = GEN_OPTS
"\nFix Options:\n"
- " --fix-type <type> - Fix type. Should be one of: bash, ansible, puppet, anaconda (default: bash).\n"
+ " --fix-type <type> - Fix type. Should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes,\n"
+ " blueprint (default: bash).\n"
" --output <file> - Write the script into file.\n"
" --result-id <id> - Fixes will be generated for failed rule-results of the specified TestResult.\n"
" --template <id|filename> - Fix template. (default: bash)\n"
@@ -887,10 +888,12 @@ int app_generate_fix(const struct oscap_action *action)
template = "urn:xccdf:fix:script:ignition";
} else if (strcmp(action->fix_type, "kubernetes") == 0) {
template = "urn:xccdf:fix:script:kubernetes";
+ } else if (strcmp(action->fix_type, "blueprint") == 0) {
+ template = "urn:redhat:osbuild:blueprint";
} else {
fprintf(stderr,
"Unknown fix type '%s'.\n"
- "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes.\n"
+ "Please provide one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint.\n"
"Or provide a custom template using '--template' instead.\n",
action->fix_type);
return OSCAP_ERROR;
diff --git a/utils/oscap.8 b/utils/oscap.8
index 240b829d7b..6cae0ffe8a 100644
--- a/utils/oscap.8
+++ b/utils/oscap.8
@@ -395,7 +395,7 @@ Result-oriented fixes are generated using result-id provided to select only the
Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes.
.TP
\fB\-\-fix-type TYPE\fR
-Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
+Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint. Default is bash. This option is mutually exclusive with --template, because fix type already determines the template URN.
.TP
\fB\-\-output FILE\fR
Write the report to this file instead of standard output.
diff --git a/xsl/xccdf-share.xsl b/xsl/xccdf-share.xsl
index 9f8e587676..d7a9f3b7e2 100644
--- a/xsl/xccdf-share.xsl
+++ b/xsl/xccdf-share.xsl
@@ -295,6 +295,7 @@ Authors:
<xsl:when test="$fix/@system = 'urn:xccdf:fix:script:puppet'">Puppet snippet</xsl:when>
<xsl:when test="$fix/@system = 'urn:redhat:anaconda:pre'">Anaconda snippet</xsl:when>
<xsl:when test="$fix/@system = 'urn:xccdf:fix:script:kubernetes'">Kubernetes snippet</xsl:when>
+ <xsl:when test="$fix/@system = 'urn:redhat:osbuild:blueprint'">OSBuild Blueprint snippet</xsl:when>
<xsl:otherwise>script</xsl:otherwise>
</xsl:choose>
</xsl:variable>

583
SOURCES/openscap-1.3.6-blueprint-toml-pr-1810.patch
View File

@ -1,583 +0,0 @@
From b0b7626dca08acd4563ae42c1c27ccc0777b5357 Mon Sep 17 00:00:00 2001
From: Evgeny Kolesnikov <ekolesni@redhat.com>
Date: Thu, 23 Sep 2021 00:58:29 +0200
Subject: [PATCH] Add proper Blueprint's remediation snippets handling for
generation of the final TOML document.
As the final Blueprint could not be created by just gluing up all
the snippets together we have to get a bit more creative.
---
docs/manual/manual.adoc | 15 ++
src/XCCDF_POLICY/xccdf_policy_remediate.c | 216 ++++++++++++++++--
src/common/list.c | 19 ++
src/common/list.h | 1 +
tests/API/XCCDF/unittests/CMakeLists.txt | 1 +
.../unittests/test_remediation_blueprint.sh | 27 +++
.../unittests/test_remediation_blueprint.toml | 45 ++++
.../test_remediation_blueprint.xccdf.xml | 102 +++++++++
8 files changed, 405 insertions(+), 21 deletions(-)
create mode 100755 tests/API/XCCDF/unittests/test_remediation_blueprint.sh
create mode 100644 tests/API/XCCDF/unittests/test_remediation_blueprint.toml
create mode 100644 tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc
index e8664eb920..90e2cc2c63 100644
--- a/docs/manual/manual.adoc
+++ b/docs/manual/manual.adoc
@@ -1084,6 +1084,21 @@ scanned during this command. If you want to generate remediation only for the
failed rules based on scan results, refer to <<_reviewing_remediations,Reviewing
remediations>>.
+=== Generating Image Builder Blueprints
+
+OpenSCAP can also create a remediation in form of Image Builder (OSBuild) Blueprint. This remeditaion
+is intendeded to be used as a bootstrap for image creation and usually it will contain only essential
+elements of the configuration, elements that would be hard or impossible to change after the image
+is created, like partitioning or set of installed packages.
+
+It is recommended to combine this type of remediation with other types, executed on the running system.
+
+For example, to generate a blueprint remediation for RHEL 8 OSPP profile, run:
+
+----
+$ oscap xccdf generate fix --profile ospp --fix-type blueprint /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml > blueprint.toml
+----
+
== Details on SCAP conformance
=== Check Engines
diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c
index 0b3a037a5f..6033c3b54b 100644
--- a/src/XCCDF_POLICY/xccdf_policy_remediate.c
+++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c
@@ -656,6 +656,78 @@ static int _write_fix_missing_warning_to_fd(const char *sys, int output_fd, stru
}
}
+struct blueprint_entries {
+ const char *pattern;
+ struct oscap_list *list;
+ pcre *re;
+};
+
+static inline int _parse_blueprint_fix(const char *fix_text, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
+{
+ const char *err;
+ int errofs;
+ int ret = 0;
+
+ struct blueprint_entries tab[] = {
+ {"\\[customizations\\.services\\]\\s+enabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_enable, NULL},
+ {"\\[customizations\\.services\\]\\s+disabled[=\\s]+\\[([^\\]]+)\\]\\s+", services_disable, NULL},
+ {"\\[customizations\\.kernel\\]\\s+append[=\\s\"]+([^\"]+)[\\s\"]+", kernel_append, NULL},
+ // We do this only to pop the 'distro' entry to the top of the generic list,
+ // effectively placing it to the root of the TOML document.
+ {"\\s+(distro[=\\s\"]+[^\"]+[\\s\"]+)", generic, NULL},
+ {NULL, NULL, NULL}
+ };
+
+ for (int i = 0; tab[i].pattern != NULL; i++) {
+ tab[i].re = pcre_compile(tab[i].pattern, PCRE_UTF8, &err, &errofs, NULL);
+ if (tab[i].re == NULL) {
+ dE("Unable to compile /%s/ regex pattern, pcre_compile() returned error (offset: %d): '%s'.\n", tab[i].pattern, errofs, err);
+ ret = 1;
+ goto exit;
+ }
+ }
+
+ const size_t fix_text_len = strlen(fix_text);
+ size_t start_offset = 0;
+ int ovector[6] = {0};
+
+ for (int i = 0; tab[i].pattern != NULL; i++) {
+ while (true) {
+ const int match = pcre_exec(tab[i].re, NULL, fix_text, fix_text_len, start_offset,
+ 0, ovector, sizeof(ovector) / sizeof(ovector[0]));
+ if (match == -1)
+ break;
+
+ if (match != 2) {
+ dE("Expected 1 capture group matches per entry. Found %i!", match - 1);
+ ret = 1;
+ goto exit;
+ }
+
+ char *val = malloc((ovector[3] - ovector[2] + 1) * sizeof(char));
+ memcpy(val, &fix_text[ovector[2]], ovector[3] - ovector[2]);
+ val[ovector[3] - ovector[2]] = '\0';
+
+ if (!oscap_list_contains(kernel_append, val, (oscap_cmp_func) oscap_streq)) {
+ oscap_list_prepend(tab[i].list, val);
+ } else {
+ free(val);
+ }
+
+ start_offset = ovector[1];
+ }
+ }
+
+ if (start_offset < fix_text_len-1) {
+ oscap_list_add(generic, strdup(fix_text + start_offset));
+ }
+
+exit:
+ for (int i = 0; tab[i].pattern != NULL; i++)
+ pcre_free(tab[i].re);
+
+ return ret;
+}
static inline int _parse_ansible_fix(const char *fix_text, struct oscap_list *variables, struct oscap_list *tasks)
{
@@ -793,6 +865,18 @@ static int _xccdf_policy_rule_generate_fix(struct xccdf_policy *policy, struct x
return ret;
}
+static int _xccdf_policy_rule_generate_blueprint_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct oscap_list *generic, struct oscap_list *services_enable, struct oscap_list *services_disable, struct oscap_list *kernel_append)
+{
+ char *fix_text = NULL;
+ int ret = _xccdf_policy_rule_get_fix_text(policy, rule, template, &fix_text);
+ if (fix_text == NULL) {
+ return ret;
+ }
+ ret = _parse_blueprint_fix(fix_text, generic, services_enable, services_disable, kernel_append);
+ free(fix_text);
+ return ret;
+}
+
static int _xccdf_policy_rule_generate_ansible_fix(struct xccdf_policy *policy, struct xccdf_rule *rule, const char *template, struct oscap_list *variables, struct oscap_list *tasks)
{
char *fix_text = NULL;
@@ -914,25 +998,45 @@ static char *_comment_multiline_text(char *text)
static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_result *result, const char *sys, int output_fd)
{
if (!(oscap_streq(sys, "") || oscap_streq(sys, "urn:xccdf:fix:script:sh") || oscap_streq(sys, "urn:xccdf:fix:commands") ||
- oscap_streq(sys, "urn:xccdf:fix:script:ansible")))
+ oscap_streq(sys, "urn:xccdf:fix:script:ansible") || oscap_streq(sys, "urn:redhat:osbuild:blueprint")))
return 0; // no header required
- const bool ansible_script = strcmp(sys, "urn:xccdf:fix:script:ansible") == 0;
- const char *how_to_apply = ansible_script ?
- "# $ ansible-playbook -i \"localhost,\" -c local playbook.yml\n"
- "# $ ansible-playbook -i \"192.168.1.155,\" playbook.yml\n"
- "# $ ansible-playbook -i inventory.ini playbook.yml" :
- "# $ sudo ./remediation-script.sh";
const char *oscap_version = oscap_get_version();
- const char *format = ansible_script ? "ansible" : "bash";
- const char *remediation_type = ansible_script ? "Ansible Playbook" : "Bash Remediation Script";
- const char *shebang_with_newline = ansible_script ? "" : "#!/usr/bin/env bash\n";
+ char *how_to_apply = "";
+ char *format = (char *)sys;
+ char *remediation_type = "Unknown";
+ char *shebang_with_newline = "";
+
+ if (oscap_streq(sys, "urn:xccdf:fix:script:ansible")) {
+ how_to_apply = "# $ ansible-playbook -i \"localhost,\" -c local playbook.yml\n"
+ "# $ ansible-playbook -i \"192.168.1.155,\" playbook.yml\n"
+ "# $ ansible-playbook -i inventory.ini playbook.yml";
+ format = "ansible";
+ remediation_type = "Ansible Playbook";
+ }
+
+ if (oscap_streq(sys, "urn:redhat:osbuild:blueprint")) {
+ how_to_apply = "# composer-cli blueprints push blueprint.toml";
+ format = "blueprint";
+ remediation_type = "Blueprint";
+ }
+
+ if (oscap_streq(sys, "") || oscap_streq(sys, "urn:xccdf:fix:script:sh") || oscap_streq(sys, "urn:xccdf:fix:commands")) {
+ how_to_apply = "# $ sudo ./remediation-script.sh";
+ format = "bash";
+ remediation_type = "Bash Remediation Script";
+ shebang_with_newline = "#!/usr/bin/env bash\n";
+ }
char *fix_header;
struct xccdf_profile *profile = xccdf_policy_get_profile(policy);
const char *profile_id = xccdf_profile_get_id(profile);
+ struct xccdf_benchmark *benchmark = xccdf_policy_get_benchmark(policy);
+ const char *benchmark_version_info = benchmark ? xccdf_benchmark_get_version(benchmark) : "Unknown";
+ const char *benchmark_id = benchmark ? xccdf_benchmark_get_id(benchmark) : "Unknown";
+
// Title
struct oscap_text_iterator *title_iterator = xccdf_profile_get_title(profile);
char *raw_profile_title = oscap_textlist_get_preferred_plaintext(title_iterator, NULL);
@@ -942,11 +1046,6 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
if (result == NULL) {
// Profile-based remediation fix
- struct xccdf_benchmark *benchmark = xccdf_policy_get_benchmark(policy);
- if (benchmark == NULL) {
- free(profile_title);
- return 1;
- }
// Description
struct oscap_text_iterator *description_iterator = xccdf_profile_get_description(profile);
char *profile_description = description_iterator != NULL ?
@@ -955,10 +1054,8 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
char *commented_profile_description = _comment_multiline_text(profile_description);
free(profile_description);
- const char *benchmark_version_info = xccdf_benchmark_get_version(benchmark);
- const char *benchmark_id = xccdf_benchmark_get_id(benchmark);
- const struct xccdf_version_info *xccdf_version = xccdf_benchmark_get_schema_version(benchmark);
- const char *xccdf_version_name = xccdf_version_info_get_version(xccdf_version);
+ const struct xccdf_version_info *xccdf_version = benchmark ? xccdf_benchmark_get_schema_version(benchmark) : NULL;
+ const char *xccdf_version_name = xccdf_version ? xccdf_version_info_get_version(xccdf_version) : "Unknown";
fix_header = oscap_sprintf(
"%s"
@@ -1026,9 +1123,8 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
result_id, format, remediation_type, remediation_type, how_to_apply
);
}
- free(profile_title);
- if (ansible_script) {
+ if (oscap_streq(sys, "urn:xccdf:fix:script:ansible")) {
char *ansible_fix_header = oscap_sprintf(
"---\n"
"%s\n"
@@ -1036,9 +1132,85 @@ static int _write_script_header_to_fd(struct xccdf_policy *policy, struct xccdf_
fix_header);
free(fix_header);
return _write_text_to_fd_and_free(output_fd, ansible_fix_header);
+ } else if (oscap_streq(sys, "urn:redhat:osbuild:blueprint")) {
+ char *blueprint_fix_header = oscap_sprintf(
+ "%s"
+ "name = \"%s\"\n"
+ "description = \"%s\"\n"
+ "version = \"%s\"\n",
+ fix_header, profile_id, profile_title, benchmark_version_info);
+ free(fix_header);
+ return _write_text_to_fd_and_free(output_fd, blueprint_fix_header);
} else {
return _write_text_to_fd_and_free(output_fd, fix_header);
}
+
+ free(profile_title);
+}
+
+static int _xccdf_policy_generate_fix_blueprint(struct oscap_list *rules_to_fix, struct xccdf_policy *policy, const char *sys, int output_fd)
+{
+ int ret = 0;
+ struct oscap_list *generic = oscap_list_new();
+ struct oscap_list *services_enable = oscap_list_new();
+ struct oscap_list *services_disable = oscap_list_new();
+ struct oscap_list *kernel_append = oscap_list_new();
+ struct oscap_iterator *rules_to_fix_it = oscap_iterator_new(rules_to_fix);
+ while (oscap_iterator_has_more(rules_to_fix_it)) {
+ struct xccdf_rule *rule = (struct xccdf_rule*)oscap_iterator_next(rules_to_fix_it);
+ ret = _xccdf_policy_rule_generate_blueprint_fix(policy, rule, sys, generic, services_enable, services_disable, kernel_append);
+ if (ret != 0)
+ break;
+ }
+ oscap_iterator_free(rules_to_fix_it);
+
+ struct oscap_iterator *generic_it = oscap_iterator_new(generic);
+ while(oscap_iterator_has_more(generic_it)) {
+ char *var_line = (char *) oscap_iterator_next(generic_it);
+ _write_text_to_fd(output_fd, var_line);
+ }
+ _write_text_to_fd(output_fd, "\n");
+ oscap_iterator_free(generic_it);
+ oscap_list_free(generic, free);
+
+ _write_text_to_fd(output_fd, "[customizations.kernel]\nappend = \"");
+ struct oscap_iterator *kernel_append_it = oscap_iterator_new(kernel_append);
+ while(oscap_iterator_has_more(kernel_append_it)) {
+ char *var_line = (char *) oscap_iterator_next(kernel_append_it);
+ _write_text_to_fd(output_fd, var_line);
+ if (oscap_iterator_has_more(kernel_append_it))
+ _write_text_to_fd(output_fd, " ");
+ }
+ _write_text_to_fd(output_fd, "\"\n\n");
+ oscap_iterator_free(kernel_append_it);
+ oscap_list_free(kernel_append, free);
+
+ _write_text_to_fd(output_fd, "[customizations.services]\n");
+ _write_text_to_fd(output_fd, "enabled = [");
+ struct oscap_iterator *services_enable_it = oscap_iterator_new(services_enable);
+ while(oscap_iterator_has_more(services_enable_it)) {
+ char *var_line = (char *) oscap_iterator_next(services_enable_it);
+ _write_text_to_fd(output_fd, var_line);
+ if (oscap_iterator_has_more(services_enable_it))
+ _write_text_to_fd(output_fd, ",");
+ }
+ _write_text_to_fd(output_fd, "]\n");
+ oscap_iterator_free(services_enable_it);
+ oscap_list_free(services_enable, free);
+
+ _write_text_to_fd(output_fd, "disabled = [");
+ struct oscap_iterator *services_disable_it = oscap_iterator_new(services_disable);
+ while(oscap_iterator_has_more(services_disable_it)) {
+ char *var_line = (char *) oscap_iterator_next(services_disable_it);
+ _write_text_to_fd(output_fd, var_line);
+ if (oscap_iterator_has_more(services_disable_it))
+ _write_text_to_fd(output_fd, ",");
+ }
+ _write_text_to_fd(output_fd, "]\n\n");
+ oscap_iterator_free(services_disable_it);
+ oscap_list_free(services_disable, free);
+
+ return ret;
}
static int _xccdf_policy_generate_fix_ansible(struct oscap_list *rules_to_fix, struct xccdf_policy *policy, const char *sys, int output_fd)
@@ -1145,6 +1317,8 @@ int xccdf_policy_generate_fix(struct xccdf_policy *policy, struct xccdf_result *
// in Ansible we have to generate variables first and then tasks
if (strcmp(sys, "urn:xccdf:fix:script:ansible") == 0) {
ret = _xccdf_policy_generate_fix_ansible(rules_to_fix, policy, sys, output_fd);
+ } else if (strcmp(sys, "urn:redhat:osbuild:blueprint") == 0) {
+ ret = _xccdf_policy_generate_fix_blueprint(rules_to_fix, policy, sys, output_fd);
} else {
ret = _xccdf_policy_generate_fix_other(rules_to_fix, policy, sys, output_fd);
}
diff --git a/src/common/list.c b/src/common/list.c
index 2516d0f2f0..90381069f8 100644
--- a/src/common/list.c
+++ b/src/common/list.c
@@ -66,6 +66,25 @@ bool oscap_list_add(struct oscap_list * list, void *value)
return true;
}
+bool oscap_list_prepend(struct oscap_list * list, void *value)
+{
+ __attribute__nonnull__(list);
+ if (value == NULL) return false;
+
+ struct oscap_list_item *item = malloc(sizeof(struct oscap_list_item));
+ item->next = NULL;
+ item->data = value;
+ ++list->itemcount;
+
+ if (list->first == NULL) {
+ list->last = list->first = item;
+ } else {
+ item->next = list->first;
+ list->first = item;
+ }
+ return true;
+}
+
bool oscap_list_push(struct oscap_list *list, void *value)
{
return oscap_list_add(list,value);
diff --git a/src/common/list.h b/src/common/list.h
index 7a0694dc8a..3179c514f0 100644
--- a/src/common/list.h
+++ b/src/common/list.h
@@ -62,6 +62,7 @@ struct oscap_list *oscap_list_new(void);
void oscap_create_lists(struct oscap_list **first, ...);
bool oscap_list_add(struct oscap_list *list, void *value);
bool oscap_list_push(struct oscap_list *list, void *value);
+bool oscap_list_prepend(struct oscap_list *list, void *value);
bool oscap_list_pop(struct oscap_list *list, oscap_destruct_func destructor);
bool oscap_list_remove(struct oscap_list *list, void *value, oscap_cmp_func compare, oscap_destruct_func destructor);
struct oscap_list *oscap_list_clone(const struct oscap_list * list, oscap_clone_func cloner);
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
index 52645834c4..9c17ebb78a 100644
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
@@ -75,6 +75,7 @@ add_oscap_test("test_single_rule_stigw.sh")
add_oscap_test("test_remediation_simple.sh")
add_oscap_test("test_remediation_offline.sh")
add_oscap_test("test_remediation_metadata.sh")
+add_oscap_test("test_remediation_blueprint.sh")
add_oscap_test("test_remediation_bad_fix.sh")
add_oscap_test("test_remediation_subs_plain_text.sh")
add_oscap_test("test_remediation_subs_plain_text_empty.sh")
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.sh b/tests/API/XCCDF/unittests/test_remediation_blueprint.sh
new file mode 100755
index 0000000000..7c79822529
--- /dev/null
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+. $builddir/tests/test_common.sh
+
+set -e
+set -o pipefail
+
+name=$(basename $0 .sh)
+result=$(make_temp_file /tmp ${name}.out)
+stderr=$(make_temp_file /tmp ${name}.out)
+
+ret=0
+
+input_xml="$srcdir/${name}.xccdf.xml"
+valid_toml="$srcdir/${name}.toml"
+
+echo "Stderr file = $stderr"
+echo "Result file = $result"
+[ -f $stderr ]; [ ! -s $stderr ]; :> $stderr
+
+# The $valid_toml file was generated without ' # This file was generated by OpenSCAP 1.3.5 using:' line
+# to make the test independent from the scanner version. We have to filter this line from the output as well.
+
+$OSCAP xccdf generate fix --fix-type blueprint --profile 'common' "$input_xml" | grep -v "OpenSCAP" > "$result"
+
+diff $valid_toml $result
+
+rm "$result"
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.toml b/tests/API/XCCDF/unittests/test_remediation_blueprint.toml
new file mode 100644
index 0000000000..e189adca9d
--- /dev/null
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.toml
@@ -0,0 +1,45 @@
+###############################################################################
+#
+# Blueprint for Profile title on one line
+#
+# Profile Description:
+# Profile description
+#
+# Profile ID: xccdf_moc.elpmaxe.www_profile_common
+# Benchmark ID: xccdf_moc.elpmaxe.www_benchmark_test
+# Benchmark Version: 1.0
+# XCCDF Version: 1.2
+#
+# $ oscap xccdf generate fix --profile xccdf_moc.elpmaxe.www_profile_common --fix-type blueprint xccdf-file.xml
+#
+# It attempts to fix every selected rule, even if the system is already compliant.
+#
+# How to apply this Blueprint:
+# composer-cli blueprints push blueprint.toml
+#
+###############################################################################
+
+name = "xccdf_moc.elpmaxe.www_profile_common"
+description = "Profile title on one line"
+version = "1.0"
+distro = rhel-80
+
+[[packages]]
+name = "aide"
+version = "*"
+
+[[customizations.filesystem]]
+mountpoint = "/home"
+size = 1
+
+[[customizations.filesystem]]
+mountpoint = "/tmp"
+size = 2
+
+[customizations.kernel]
+append = "foo=bar audit=1"
+
+[customizations.services]
+enabled = ["sshd","usbguard"]
+disabled = ["kdump"]
+
diff --git a/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml b/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
new file mode 100644
index 0000000000..e685620dac
--- /dev/null
+++ b/tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_moc.elpmaxe.www_benchmark_test">
+ <status>accepted</status>
+ <version>1.0</version>
+ <Profile id="xccdf_moc.elpmaxe.www_profile_common">
+ <title>Profile title on one line</title>
+ <description>Profile description</description>
+ <select idref="xccdf_moc.elpmaxe.www_rule_1" selected="true"/>
+ </Profile>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_1">
+ <title>Install aide</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[[packages]]
+name = "aide"
+version = "*"
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_2">
+ <title>Define /home</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[[customizations.filesystem]]
+mountpoint = "/home"
+size = 1
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_3">
+ <title>Add audit=1 kernel option</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[customizations.kernel]
+append = "audit=1"
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_4">
+ <title>Add foo=bar kernel option</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[customizations.kernel]
+append = "foo=bar"
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_5">
+ <title>Define /tmp</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[[customizations.filesystem]]
+mountpoint = "/tmp"
+size = 2
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_6">
+ <title>Enable usbguard</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[customizations.services]
+enabled = ["usbguard"]
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_7">
+ <title>Disable kdump</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[customizations.services]
+disabled = ["kdump"]
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_8">
+ <title>Set distro (RHEL 8.0)</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+distro = rhel-80
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+ <Rule selected="true" id="xccdf_moc.elpmaxe.www_rule_9">
+ <title>Enable sshd</title>
+ <fix system="urn:redhat:osbuild:blueprint">
+[customizations.services]
+enabled = ["sshd"]
+</fix>
+ <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+ <check-content-ref href="test_remediation_simple.oval.xml" name="oval:moc.elpmaxe.www:def:1"/>
+ </check>
+ </Rule>
+</Benchmark>

52
SOURCES/openscap-1.3.6-coverity-issues-pr-1748.patch
View File

@ -1,52 +0,0 @@
From 378ef5e438a2f5af7a50374d2bd23bdd3403201f Mon Sep 17 00:00:00 2001
From: Evgeny Kolesnikov <ekolesni@redhat.com>
Date: Tue, 4 May 2021 08:41:06 +0200
Subject: [PATCH] Fix covscan-reported issues in yamlfilecontent probe and
schematron
Error: FORWARD_NULL (CWE-476): [#def1]
/OVAL/probes/independent/yamlfilecontent_probe.c:392: var_compare_op: Comparing "yaml_file" to null implies that "yaml_file" might be null.
/OVAL/probes/independent/yamlfilecontent_probe.c:417: var_deref_model: Passing null pointer "yaml_file" to "fclose", which dereferences it.
# 416| cleanup:
# 417|-> fclose(yaml_file);
# 418| yaml_parser_delete(&parser);
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
/source/schematron.c:549: alloc_fn: Storage is returned from allocation function "xmlXPathNodeEval".
/source/schematron.c:549: var_assign: Assigning: "component_refs" = storage returned from "xmlXPathNodeEval(data_stream_node, (xmlChar *)"ds:checklists/ds:component-ref", context)".
/source/schematron.c:551: leaked_storage: Variable "component_refs" going out of scope leaks the storage it points to.
# 550| if (component_refs == NULL || component_refs->nodesetval == NULL) {
# 551|-> return res;
# 552| }
---
src/OVAL/probes/independent/yamlfilecontent_probe.c | 3 ++-
src/source/schematron.c | 2 ++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
index ed5ce0d68..62a8f4ff2 100644
--- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
@@ -414,7 +414,8 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f
}
cleanup:
- fclose(yaml_file);
+ if (yaml_file != NULL)
+ fclose(yaml_file);
yaml_parser_delete(&parser);
free(filepath_with_prefix);
free(filepath);
diff --git a/src/source/schematron.c b/src/source/schematron.c
index 6cb22658b..c32d5aed6 100644
--- a/src/source/schematron.c
+++ b/src/source/schematron.c
@@ -548,6 +548,8 @@ static bool _req_src_346_1_sub1(xmlNodePtr data_stream_node, xmlXPathContextPtr
/* every $m in ds:checklists/ds:component-ref satisfies ... */
xmlXPathObjectPtr component_refs = xmlXPathNodeEval(data_stream_node, BAD_CAST "ds:checklists/ds:component-ref", context);
if (component_refs == NULL || component_refs->nodesetval == NULL) {
+ if (component_refs != NULL)
+ xmlXPathFreeObject(component_refs);
return res;
}
for (int i = 0; i < component_refs->nodesetval->nodeNr; i++) {

248
SOURCES/openscap-1.3.6-coverity-issues-pr-1778.patch
View File

@ -1,248 +0,0 @@
From 6885a1caaad68f0844715cca90fd0d913e19aba5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 1 Jul 2021 16:06:23 +0200
Subject: [PATCH 1/9] Plug a memory leak
Addressing:
1. openscap-1.3.5/src/OVAL/probes/independent/system_info_probe.c:738:6: warning[unix.Malloc]: Potential leak of memory pointed to by 'hname'
736| hname = strdup(unknown);
737|
738|-> if (__sysinfo_saneval(os_name) < 1 ||
739| __sysinfo_saneval(os_version) < 1 ||
740| __sysinfo_saneval(architecture) < 1 ||
---
src/OVAL/probes/independent/system_info_probe.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/OVAL/probes/independent/system_info_probe.c b/src/OVAL/probes/independent/system_info_probe.c
index 8251e655e..9f680e14d 100644
--- a/src/OVAL/probes/independent/system_info_probe.c
+++ b/src/OVAL/probes/independent/system_info_probe.c
@@ -732,8 +732,13 @@ int system_info_probe_main(probe_ctx *ctx, void *arg)
if (!architecture)
architecture = strdup(unknown);
- if (!hname || *hname == '\0')
+ if (hname && *hname == '\0') {
+ free(hname);
+ hname = NULL;
+ }
+ if (!hname) {
hname = strdup(unknown);
+ }
if (__sysinfo_saneval(os_name) < 1 ||
__sysinfo_saneval(os_version) < 1 ||
From a600fa5d034daa408d277f91ceefd29b5ab10213 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 1 Jul 2021 16:43:46 +0200
Subject: [PATCH 2/9] Fix a possible NULL dereference
Addressing:
openscap-1.3.5/utils/oscap-tool.c:78:11: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL 'to'
---
utils/oscap-tool.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/utils/oscap-tool.c b/utils/oscap-tool.c
index 62c4cde0e..d37fbb0e5 100644
--- a/utils/oscap-tool.c
+++ b/utils/oscap-tool.c
@@ -73,7 +73,8 @@ static size_t paramlist_size(const char **p) { size_t s = 0; if (!p) return s; w
static size_t paramlist_cpy(const char **to, const char **p) {
size_t s = 0;
- if (!p) return s;
+ if (!to || !p)
+ return s;
for (;p && p[s]; s += 2) to[s] = p[s], to[s+1] = p[s+1];
to[s] = p[s];
return s;
From d7bb7e755b262424e5970f2bcc2d2af670f8ac63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 1 Jul 2021 17:03:09 +0200
Subject: [PATCH 3/9] Fix a possible NULL dereference
Addressing:
openscap-1.3.5/src/source/xslt.c:124:21: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL 'strdup(xsltfile)' where non-null expected
---
src/source/xslt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 0d01c535b..24c4c46e9 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -105,7 +105,7 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
static xmlDoc *apply_xslt_path_internal(struct oscap_source *source, const char *xsltfile, const char **params, const char *path_to_xslt, xsltStylesheet **stylesheet)
{
xmlDoc *doc = oscap_source_get_xmlDoc(source);
- if (doc == NULL || stylesheet == NULL) {
+ if (doc == NULL || stylesheet == NULL || xsltfile == NULL) {
return NULL;
}
From a51952f0bc66402c3b68783ee9deaf3b4ecd529e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 10:12:31 +0200
Subject: [PATCH 4/9] Fix possible NULL dereference
Addressing:
openscap-1.3.5/src/XCCDF/xccdf_session.c:1349:15: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL 'to'
---
src/XCCDF/xccdf_session.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/XCCDF/xccdf_session.c b/src/XCCDF/xccdf_session.c
index 9d8f42c44..10735214c 100644
--- a/src/XCCDF/xccdf_session.c
+++ b/src/XCCDF/xccdf_session.c
@@ -1344,7 +1344,8 @@ static size_t _paramlist_size(const char **p) { size_t s = 0; if (!p) return s;
static size_t _paramlist_cpy(const char **to, const char **p) {
size_t s = 0;
- if (!p) return s;
+ if (!to || !p)
+ return s;
for (;p && p[s]; s += 2) to[s] = p[s], to[s+1] = p[s+1];
to[s] = p[s];
return s;
From 2f0ad2e9a7bbd69ecad14b28de6e12d237bcbf9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 10:15:39 +0200
Subject: [PATCH 5/9] Fix possible NULL dereference
Addressing:
openscap-1.3.5/src/OVAL/results/oval_cmp_evr_string.c:132:16: warning[-Wanalyzer-null-dereference]: dereference of NULL 's'
---
src/OVAL/results/oval_cmp_evr_string.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/OVAL/results/oval_cmp_evr_string.c b/src/OVAL/results/oval_cmp_evr_string.c
index 89e51729b..b195a73f7 100644
--- a/src/OVAL/results/oval_cmp_evr_string.c
+++ b/src/OVAL/results/oval_cmp_evr_string.c
@@ -128,6 +128,9 @@ static void parseEVR(char *evr, const char **ep, const char **vp, const char **r
const char *release;
char *s, *se;
+ if (!evr)
+ return;
+
s = evr;
while (*s && risdigit(*s)) s++; /* s points to epoch terminator */
se = strrchr(s, '-'); /* se points to version terminator */
From fe351d432d25d48116ec077671c97f0a2d996c82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 10:26:03 +0200
Subject: [PATCH 6/9] Fix possible NULL dereference
openscap-1.3.5/src/OVAL/probes/unix/xinetd_probe.c:1492:56: warning[-Wanalyzer-null-dereference]: dereference of NULL 'valstr_array'
---
src/OVAL/probes/unix/xinetd_probe.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/OVAL/probes/unix/xinetd_probe.c b/src/OVAL/probes/unix/xinetd_probe.c
index 009fb4c4c..b3375500d 100644
--- a/src/OVAL/probes/unix/xinetd_probe.c
+++ b/src/OVAL/probes/unix/xinetd_probe.c
@@ -1483,6 +1483,10 @@ int op_remove_strl(void *var, char *val)
valstr_array[valstr_array_size-1] = tok;
valstr_array[valstr_array_size] = NULL;
}
+ if (valstr_array == NULL) {
+ free(newstr_array);
+ return -2;
+ }
// Remove the insersection from the string array
newstr_array_size = 0;
From 0ae47d335db49f049ba5bad5ba69c3bdbb0a55bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 10:52:28 +0200
Subject: [PATCH 7/9] Fix possible NULL dereference
The function oval_criteria_node_new can return NULL in multiple situations.
Addressing:
openscap-1.3.5/src/OVAL/oval_criteriaNode.c:390:28: warning[-Wanalyzer-null-dereference]: dereference of NULL 'node'
---
src/OVAL/oval_criteriaNode.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/OVAL/oval_criteriaNode.c b/src/OVAL/oval_criteriaNode.c
index de9081f9d..975a480a4 100644
--- a/src/OVAL/oval_criteriaNode.c
+++ b/src/OVAL/oval_criteriaNode.c
@@ -387,6 +387,11 @@ int oval_criteria_parse_tag(xmlTextReaderPtr reader, struct oval_parser_context
assert(context != NULL); /* This is not asserted as attribute, because we
can pass NULL pointer in case of OVAL_NODETYPE_UNKNOWN */
struct oval_criteria_node *node = oval_criteria_node_new(context->definition_model, type);
+ if (node == NULL) {
+ free(tagname);
+ free(namespace);
+ return 1;
+ }
node->type = type;
char *comm = (char *)xmlTextReaderGetAttribute(reader, BAD_CAST "comment");
if (comm != NULL) {
From 832cba38133f59dc27b0e9f6d2d6eddb7604577a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 11:02:51 +0200
Subject: [PATCH 8/9] Fix possible NULL dereference
Addressing:
openscap-1.3.5/src/OVAL/oval_component.c:2371:83: warning[-Wanalyzer-null-dereference]: dereference of NULL 'vcl_root
---
src/OVAL/oval_component.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/OVAL/oval_component.c b/src/OVAL/oval_component.c
index 96788a471..95004bd80 100644
--- a/src/OVAL/oval_component.c
+++ b/src/OVAL/oval_component.c
@@ -2368,6 +2368,9 @@ static oval_syschar_collection_flag_t _oval_component_evaluate_ARITHMETIC(oval_a
}
oval_component_iterator_free(subcomps);
+ if (vcl_root == NULL) {
+ return SYSCHAR_FLAG_ERROR;
+ }
val_itr = (struct oval_value_iterator *) oval_collection_iterator(vcl_root->val_col);
while (oval_value_iterator_has_more(val_itr)) {
struct oval_value *ov;
From 3fb63f51f45af8edf2b8044445bfc5cb7092b7a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 2 Jul 2021 11:10:03 +0200
Subject: [PATCH 9/9] Fix possible NULL dereference
Addressing:
openscap-1.3.5/src/DS/rds_index.c:124:21: warning[-Wanalyzer-null-argument]: use of NULL 'id' where non-null expected
---
src/DS/rds_index.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/DS/rds_index.c b/src/DS/rds_index.c
index 374b55d64..cc0e2bbed 100644
--- a/src/DS/rds_index.c
+++ b/src/DS/rds_index.c
@@ -117,6 +117,9 @@ struct rds_asset_index* rds_index_get_asset(struct rds_index *rds, const char *i
{
struct rds_asset_index *ret = NULL;
+ if (id == NULL)
+ return ret;
+
struct rds_asset_index_iterator *it = rds_index_get_assets(rds);
while (rds_asset_index_iterator_has_more(it))
{

1954
SOURCES/openscap-1.3.6-disable-sha1-md5-pr-1781.patch
View File

File diff suppressed because it is too large Load Diff

124
SOURCES/openscap-1.3.6-empty-proc-in-offline-pr-1812.patch
View File

@ -1,124 +0,0 @@
From ea87ecab21a54741e64680977521837ccaf0206b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 5 Oct 2021 14:33:37 +0200
Subject: [PATCH] Allow empty /proc in offline mode
When scanning offline file systems the /proc might be empty. Currently,
OpenSCAP thinks that it means a permissions problems, which is often
true if it happens on a real system, but in offline mode it can be a
normal situation. We will not consider empty /proc an error in offline
mode.
The commit also includes a simple test case.
Inspired by eda9881e08f0398d1481f133fbb56c0080cfe9f3
Resolves: RHBZ #2008922
---
src/OVAL/probes/unix/process58_probe.c | 18 ++++++++++----
tests/probes/process58/CMakeLists.txt | 1 +
tests/probes/process58/empty_proc.sh | 33 ++++++++++++++++++++++++++
3 files changed, 47 insertions(+), 5 deletions(-)
create mode 100755 tests/probes/process58/empty_proc.sh
diff --git a/src/OVAL/probes/unix/process58_probe.c b/src/OVAL/probes/unix/process58_probe.c
index d1108fc59..29c582152 100644
--- a/src/OVAL/probes/unix/process58_probe.c
+++ b/src/OVAL/probes/unix/process58_probe.c
@@ -472,7 +472,7 @@ static inline char *make_defunc_str(char* const cmd_buffer){
static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
{
char buf[PATH_MAX];
- int err = PROBE_EACCESS, max_cap_id;
+ int max_cap_id;
DIR *d;
struct dirent *ent;
oval_schema_version_t oval_version;
@@ -501,6 +501,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
cmd_buffer[0] = '[';
// Scan the directories
+ bool any_pid_dir_found = false;
while (( ent = readdir(d) )) {
int fd, len;
char *tmp, state, tty_dev[128];
@@ -562,9 +563,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
}
}
-
- err = PROBE_ESUCCESS; // If we get this far, no permission problems
- dI("Have command: %s", cmd);
+ any_pid_dir_found = true;
cmd_sexp = SEXP_string_newf("%s", cmd);
pid_sexp = SEXP_number_newu_32(pid);
if ((cmd_sexp == NULL || probe_entobj_cmp(cmd_ent, cmd_sexp) == OVAL_RESULT_TRUE) &&
@@ -662,7 +661,16 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)
}
closedir(d);
oscap_buffer_free(cmdline_buffer);
- return err;
+
+ if (!any_pid_dir_found) {
+ dW("No data about processes could be read from '%s'.", buf);
+ }
+ // In offline mode, empty /proc might be a normal situation and doesn't
+ // have to mean permissions problems
+ if (prefix)
+ return PROBE_ESUCCESS;
+ else
+ return any_pid_dir_found ? PROBE_ESUCCESS : PROBE_EACCESS;
}
int process58_probe_offline_mode_supported(void)
diff --git a/tests/probes/process58/CMakeLists.txt b/tests/probes/process58/CMakeLists.txt
index 17261dbb7..947665de6 100644
--- a/tests/probes/process58/CMakeLists.txt
+++ b/tests/probes/process58/CMakeLists.txt
@@ -2,6 +2,7 @@ if(ENABLE_PROBES_UNIX)
add_oscap_test("capability.sh")
add_oscap_test("command_line.sh")
add_oscap_test("dev_to_tty.sh")
+ add_oscap_test("empty_proc.sh")
add_oscap_test("loginuid.sh")
add_oscap_test("selinux_domain_label.sh")
add_oscap_test("sessionid.sh")
diff --git a/tests/probes/process58/empty_proc.sh b/tests/probes/process58/empty_proc.sh
new file mode 100755
index 000000000..2f0334b15
--- /dev/null
+++ b/tests/probes/process58/empty_proc.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# This is regression test of RHBZ #2008922
+
+set -e -o pipefail
+
+. $builddir/tests/test_common.sh
+probecheck "process58" || exit 255
+
+name=$(basename $0 .sh)
+result=$(mktemp ${name}.out.XXXXXX)
+stderr=$(mktemp ${name}.err.XXXXXX)
+
+root=$(mktemp -d)
+
+# create an empty /proc in the offline file system dir
+mkdir -p "$root/proc"
+
+export OSCAP_PROBE_ROOT="$root"
+$OSCAP oval eval --results $result $srcdir/capability.oval.xml 2> $stderr
+
+[ $? -eq 0 ]
+grep -q "^W: oscap:\s\+No data about processes could be read from '$root/proc'." "$stderr"
+grep -q "OpenSCAP Error: Probe at sd=1 (process58) reported an error: Operation not permitted" "$stderr" && false
+grep -q "W: oscap:\s\+Can't receive message: 125, Operation canceled." "$stderr" && false
+
+[ -s "$result" ]
+assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'
+assert_exists 1 '/oval_results/results/system/oval_system_characteristics/collected_objects/object[@flag="does not exist"]'
+
+rm "$stderr"
+rm "$result"
+rm -r "$root"

40
SOURCES/openscap-1.3.6-fix-failing-test-pr-1775.patch
View File

@ -1,40 +0,0 @@
From 11e5d42d279f39c13a9bdea7df6da7728b85a0b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 29 Jun 2021 09:12:34 +0200
Subject: [PATCH] Fix failing test
The test fails becuse the OVAL content in
`test_remediation_simple.oval.xml` used in rule
`xccdf_moc.elpmaxe.www_rule_1` in
`test_profile_selection_by_suffix.xccdf.xml` expects that a file named
`test_file` exists in the current working directory.
This test doesn't fail when executed as a part of complete test suite
run. I guess that it's because some other test creates the `test_file`
file and doesn't delete it. Unfortunately, I can't find which test
creates it. There are many test cases that use a file `test_file`
and it is also created often by remediation executed in some tests.
---
.../API/XCCDF/unittests/test_profile_selection_by_suffix.sh | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tests/API/XCCDF/unittests/test_profile_selection_by_suffix.sh b/tests/API/XCCDF/unittests/test_profile_selection_by_suffix.sh
index 910264626a..9b0852df37 100755
--- a/tests/API/XCCDF/unittests/test_profile_selection_by_suffix.sh
+++ b/tests/API/XCCDF/unittests/test_profile_selection_by_suffix.sh
@@ -13,6 +13,9 @@ echo "Stderr file = $stderr"
echo "Result file = $result"
ret=0
+touch test_file
+[ -f test_file ]
+
# Multiple matches should result in failure
$OSCAP xccdf eval --profile common $benchmark 2> $stderr || ret=$?
[ $ret -eq 1 ]
@@ -55,3 +58,5 @@ grep -Fq "No profile matching suffix \"another\" was found" $stderr
[ -f $stderr ]; rm $stderr
rm $result
+
+rm -f test_file

92
SOURCES/openscap-1.3.6-http_error_fix-PR_1805.patch
View File

@ -1,92 +0,0 @@
From d2790140325a3d77264937c38d5076899c824dd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 10 Sep 2021 10:11:00 +0200
Subject: [PATCH] Fail download on HTTP errors
When the HTTP server returns status code greater than or equal 400,
the download will fail.
Resolves: rhbz#2002733
---
src/common/oscap_acquire.c | 20 ++++++++++++++++++--
tests/DS/test_ds_misc.sh | 15 +++++++++++++++
2 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/src/common/oscap_acquire.c b/src/common/oscap_acquire.c
index cd9bfc36f6..8f4991751f 100644
--- a/src/common/oscap_acquire.c
+++ b/src/common/oscap_acquire.c
@@ -328,6 +328,14 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size)
CURLcode res;
+ /* CURLOPT_FAILONERROR - request failure on HTTP response >= 400 */
+ res = curl_easy_setopt(curl, CURLOPT_FAILONERROR, true);
+ if (res != 0) {
+ curl_easy_cleanup(curl);
+ oscap_seterr(OSCAP_EFAMILY_NET, "Failed to set CURLOPT_FAILONERROR: %s", curl_easy_strerror(res));
+ return NULL;
+ }
+
res = curl_easy_setopt(curl, CURLOPT_URL, url);
if (res != 0) {
curl_easy_cleanup(curl);
@@ -387,14 +395,22 @@ char* oscap_acquire_url_download(const char *url, size_t* memory_size)
}
res = curl_easy_perform(curl);
- curl_easy_cleanup(curl);
if (res != 0) {
- oscap_seterr(OSCAP_EFAMILY_NET, "Download failed: %s", curl_easy_strerror(res));
+ if (res == CURLE_HTTP_RETURNED_ERROR) {
+ long http_code = 0;
+ curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
+ oscap_seterr(OSCAP_EFAMILY_NET, "Download failed: %s: %ld", curl_easy_strerror(res), http_code);
+ } else {
+ oscap_seterr(OSCAP_EFAMILY_NET, "Download failed: %s", curl_easy_strerror(res));
+ }
+ curl_easy_cleanup(curl);
oscap_buffer_free(buffer);
return NULL;
}
+ curl_easy_cleanup(curl);
+
*memory_size = oscap_buffer_get_length(buffer);
char* data = oscap_buffer_bequeath(buffer); // get data and free buffer struct
return data;
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index 4d2dfc449a..159007518e 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -250,6 +250,19 @@ function test_ds_continue_without_remote_resources() {
rm -f "$result" "$oval_result"
}
+function test_ds_error_remote_resources() {
+ local DS="${srcdir}/$1"
+ local PROFILE="$2"
+ local result=$(mktemp)
+ local stderr=$(mktemp)
+
+ $OSCAP xccdf eval --fetch-remote-resources --profile "$PROFILE" --results "$result" "$DS" 2>"$stderr" || ret=$?
+ grep -q "Downloading: https://www.example.com/security/data/oval/oval.xml.bz2 ... error" "$stderr"
+ grep -q "OpenSCAP Error: Download failed: HTTP response code said error: 404" "$stderr"
+
+ rm -f "$result" "$stderr"
+}
+
function test_source_date_epoch() {
local xccdf="$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
local result="$(mktemp)"
@@ -286,7 +299,9 @@ test_run "eval_cpe" test_eval_cpe eval_cpe/sds.xml
test_run "test_eval_complex" test_eval_complex
test_run "sds_add_multiple_oval_twice_in_row" sds_add_multiple_twice
test_run "test_ds_1_2_continue_without_remote_resources" test_ds_continue_without_remote_resources ds_continue_without_remote_resources/remote_content_1.2.ds.xml xccdf_com.example.www_profile_test_remote_res
+test_run "test_ds_1_2_error_remote_resources" test_ds_error_remote_resources ds_continue_without_remote_resources/remote_content_1.2.ds.xml xccdf_com.example.www_profile_test_remote_res
test_run "test_ds_1_3_continue_without_remote_resources" test_ds_continue_without_remote_resources ds_continue_without_remote_resources/remote_content_1.3.ds.xml xccdf_com.example.www_profile_test_remote_res
+test_run "test_ds_1_3_error_remote_resources" test_ds_error_remote_resources ds_continue_without_remote_resources/remote_content_1.3.ds.xml xccdf_com.example.www_profile_test_remote_res
test_run "test_source_date_epoch" test_source_date_epoch
test_exit

136
SOURCES/openscap-1.3.6-initialize-crapi-once-pr-1779.patch
View File

@ -1,136 +0,0 @@
From 5c422226df442855a7dc9834eb4ff74865394a92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 8 Jul 2021 14:28:16 +0200
Subject: [PATCH 1/3] Initialize crypto API only once
The function `crapi_init` calls `gcry_check_version` which must be
called before any other function from the Libgcrypt library. That might
be violated when multiple threads executing multiple probes are running.
The mitigation proposed in this PR is to call `crapi_init` only once
when the session is initialized which means before any threads are
spawned.
See also: https://www.gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading
Resolves: RHBZ#1959570
---
src/OVAL/oval_probe_session.c | 5 +++++
src/OVAL/probes/independent/filehash58_probe.c | 6 ------
src/OVAL/probes/independent/filehash_probe.c | 6 ------
src/OVAL/probes/independent/filemd5_probe.c | 6 ------
4 files changed, 5 insertions(+), 18 deletions(-)
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
index 435ca148fd..6f6d7ad426 100644
--- a/src/OVAL/oval_probe_session.c
+++ b/src/OVAL/oval_probe_session.c
@@ -93,6 +93,11 @@ static void oval_probe_session_libinit(void)
SEXP_free((SEXP_t *)exp);
ncache_libinit();
+ /*
+ * Initialize crypto API
+ */
+ if (crapi_init (NULL) != 0)
+ return (NULL);
}
/**
diff --git a/src/OVAL/probes/independent/filehash58_probe.c b/src/OVAL/probes/independent/filehash58_probe.c
index ff1e065746..32a38562bd 100644
--- a/src/OVAL/probes/independent/filehash58_probe.c
+++ b/src/OVAL/probes/independent/filehash58_probe.c
@@ -210,12 +210,6 @@ int filehash58_probe_offline_mode_supported()
void *filehash58_probe_init(void)
{
- /*
- * Initialize crypto API
- */
- if (crapi_init (NULL) != 0)
- return (NULL);
-
/*
* Initialize mutex.
*/
diff --git a/src/OVAL/probes/independent/filehash_probe.c b/src/OVAL/probes/independent/filehash_probe.c
index 522d976512..6d8780dc95 100644
--- a/src/OVAL/probes/independent/filehash_probe.c
+++ b/src/OVAL/probes/independent/filehash_probe.c
@@ -190,12 +190,6 @@ int filehash_probe_offline_mode_supported()
void *filehash_probe_init(void)
{
- /*
- * Initialize crypto API
- */
- if (crapi_init (NULL) != 0)
- return (NULL);
-
/*
* Initialize mutex.
*/
diff --git a/src/OVAL/probes/independent/filemd5_probe.c b/src/OVAL/probes/independent/filemd5_probe.c
index d0de402d8b..99913581f0 100644
--- a/src/OVAL/probes/independent/filemd5_probe.c
+++ b/src/OVAL/probes/independent/filemd5_probe.c
@@ -163,12 +163,6 @@ int probe_offline_mode_supported()
void *probe_init (void)
{
- /*
- * Initialize crypto API
- */
- if (crapi_init (NULL) != 0)
- return (NULL);
-
/*
* Initialize mutex.
*/
From c4c26d99a59205d744befe52be4e81bcf5f55d9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 13 Jul 2021 13:03:21 +0200
Subject: [PATCH 2/3] Add a missing include
---
src/OVAL/oval_probe_session.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
index 6f6d7ad426..295782b536 100644
--- a/src/OVAL/oval_probe_session.c
+++ b/src/OVAL/oval_probe_session.c
@@ -48,6 +48,7 @@
#include "oval_probe_ext.h"
#include "probe-table.h"
#include "oval_types.h"
+#include "crapi/crapi.h"
#if defined(OSCAP_THREAD_SAFE)
#include <pthread.h>
From 6241a8835574429a787e0dd48d2c0ac2a71499b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 15 Jul 2021 14:21:00 +0200
Subject: [PATCH 3/3] Don't initialize crypto on Windows
---
src/OVAL/oval_probe_session.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/OVAL/oval_probe_session.c b/src/OVAL/oval_probe_session.c
index 295782b536..b443cbcc80 100644
--- a/src/OVAL/oval_probe_session.c
+++ b/src/OVAL/oval_probe_session.c
@@ -97,8 +97,10 @@ static void oval_probe_session_libinit(void)
/*
* Initialize crypto API
*/
+#ifndef OS_WINDOWS
if (crapi_init (NULL) != 0)
return (NULL);
+#endif
}
/**

2158
SOURCES/openscap-1.3.6-local-files-pr-1769.patch
View File

File diff suppressed because it is too large Load Diff

242
SOURCES/openscap-1.3.6-memory-limit-pr-1827.patch
View File

@ -1,242 +0,0 @@
From a7a0c4a3f528594bb3181174b6986e9c50a684b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 30 Aug 2021 15:44:37 +0200
Subject: [PATCH 1/3] Lower memory limits and improve their checking
This patch attempts to mitigate problems caused by a large amount of
collected objects such as rhbz#1932833.
Specifically, these changes are made:
- Lower the threshold so that the amount of used memory is checked when
only 1000 items are collected for the given OVAL object. That's
because 32768 items (the original value) is already a large amount which
occupies a lot of memory during further processing.
- Lower the memory usage ratio limit for the probe to 10 %. We have
found experimentally that giving the probe 15 % or more will cause the
oscap process to be killed when processing the collected data and
generating results.
- In the calling function probe_item_collect, distinguish between return
codes which means different behavior when there is insufficient memory
than when the memory consumption can't be checked.
- Improve the warning message to show greater details about memory
consumption to the user.
- Remove the check for the absolute amount of remaining free memory. As
we can see on the example of rhbz#1932833, on systems with large
amount of memory the remaining memory of 512 MB isn't enough memory for
openscap to process the collected data. At the same time, if we lowered
the usage ratio, we don't need this anymore.
- Remove useless message "spt:" from the verbose log because it's
produced many times and pollutes the log extremely.
---
src/OVAL/probes/probe/icache.c | 23 +++++++++++------------
src/common/memusage.c | 2 --
2 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/src/OVAL/probes/probe/icache.c b/src/OVAL/probes/probe/icache.c
index 7e16daa334..af7b528372 100644
--- a/src/OVAL/probes/probe/icache.c
+++ b/src/OVAL/probes/probe/icache.c
@@ -487,9 +487,8 @@ int probe_icache_nop(probe_icache_t *cache)
return (0);
}
-#define PROBE_RESULT_MEMCHECK_CTRESHOLD 32768 /* item count */
-#define PROBE_RESULT_MEMCHECK_MINFREEMEM 512 /* MiB */
-#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.8 /* max. memory usage ratio - used/total */
+#define PROBE_RESULT_MEMCHECK_CTRESHOLD 1000 /* item count */
+#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.1 /* max. memory usage ratio - used/total */
/**
* Returns 0 if the memory constraints are not reached. Otherwise, 1 is returned.
@@ -511,18 +510,12 @@ static int probe_cobj_memcheck(size_t item_cnt)
c_ratio = (double)mu_proc.mu_rss/(double)(mu_sys.mu_total);
if (c_ratio > PROBE_RESULT_MEMCHECK_MAXRATIO) {
- dW("Memory usage ratio limit reached! limit=%f, current=%f",
- PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio);
+ dW("Memory usage ratio limit reached! limit=%f, current=%f, used=%ld MB, free=%ld MB, total=%ld MB, count of items=%ld",
+ PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
errno = ENOMEM;
return (1);
}
- if ((mu_sys.mu_realfree / 1024) < PROBE_RESULT_MEMCHECK_MINFREEMEM) {
- dW("Minimum free memory limit reached! limit=%zu, current=%zu",
- PROBE_RESULT_MEMCHECK_MINFREEMEM, mu_sys.mu_realfree / 1024);
- errno = ENOMEM;
- return (1);
- }
}
return (0);
@@ -547,6 +540,7 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
{
SEXP_t *cobj_content;
size_t cobj_itemcnt;
+ int memcheck_ret;
if (ctx == NULL || ctx->probe_out == NULL || item == NULL) {
return -1;
@@ -556,7 +550,12 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
cobj_itemcnt = SEXP_list_length(cobj_content);
SEXP_free(cobj_content);
- if (probe_cobj_memcheck(cobj_itemcnt) != 0) {
+ memcheck_ret = probe_cobj_memcheck(cobj_itemcnt);
+ if (memcheck_ret == -1) {
+ dE("Failed to check available memory");
+ return -1;
+ }
+ if (memcheck_ret == 1) {
/*
* Don't set the message again if the collected object is
diff --git a/src/common/memusage.c b/src/common/memusage.c
index fc6909e6fb..c6755f21f1 100644
--- a/src/common/memusage.c
+++ b/src/common/memusage.c
@@ -137,8 +137,6 @@ static int read_status(const char *source, void *base, struct stat_parser *spt,
sp = oscap_bfind(spt, spt_size, sizeof(struct stat_parser),
linebuf, (int(*)(void *, void *))&cmpkey);
- dD("spt: %s", linebuf);
-
if (sp == NULL) {
/* drop end of unread line */
while (strchr(strval, '\n') == NULL) {
From ded3d58cd62259b217a9ab35030827ac3cb8dd45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 7 Sep 2021 13:52:50 +0200
Subject: [PATCH 2/3] Allow to set memory ratio by environment variable
If the probe memory usage ratio limit will be too small or too big
in some situation, the user will be able to modify the limit easily
by setting the environment variable OSCAP_PROBE_MEMORY_USAGE_RATIO
to a different value. This can also help users when debugging memory
problems.
---
docs/manual/manual.adoc | 1 +
src/OVAL/probes/probe/icache.c | 9 ++++-----
src/OVAL/probes/probe/probe.h | 1 +
src/OVAL/probes/probe/worker.c | 12 ++++++++++++
4 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/docs/manual/manual.adoc b/docs/manual/manual.adoc
index 90e2cc2c63..825844bc71 100644
--- a/docs/manual/manual.adoc
+++ b/docs/manual/manual.adoc
@@ -1613,6 +1613,7 @@ not considered local by the scanner:
* `OSCAP_PROBE_ROOT` - Path to a directory which contains mounted filesystem to be evaluated. Used for offline scanning.
* `SEXP_VALIDATE_DISABLE` - If set, `oscap` will not validate SEXP expressions during its execution.
* `SOURCE_DATE_EPOCH` - Timestamp in seconds since epoch. This timestamp will be used instead of the current time to populate `timestamp` attributes in SCAP source data streams created by `oscap ds sds-compose` sub-module. This is used for reproducible builds of data streams.
+* `OSCAP_PROBE_MEMORY_USAGE_RATIO` - maximum memory usage ratio (used/total) for OpenSCAP probes, default: 0.1
Also, OpenSCAP uses `libcurl` library which also can be configured using environment variables. See https://curl.se/libcurl/c/libcurl-env.html[the list of libcurl environment variables].
diff --git a/src/OVAL/probes/probe/icache.c b/src/OVAL/probes/probe/icache.c
index af7b528372..a397d35ec2 100644
--- a/src/OVAL/probes/probe/icache.c
+++ b/src/OVAL/probes/probe/icache.c
@@ -488,13 +488,12 @@ int probe_icache_nop(probe_icache_t *cache)
}
#define PROBE_RESULT_MEMCHECK_CTRESHOLD 1000 /* item count */
-#define PROBE_RESULT_MEMCHECK_MAXRATIO 0.1 /* max. memory usage ratio - used/total */
/**
* Returns 0 if the memory constraints are not reached. Otherwise, 1 is returned.
* In case of an error, -1 is returned.
*/
-static int probe_cobj_memcheck(size_t item_cnt)
+static int probe_cobj_memcheck(size_t item_cnt, double max_ratio)
{
if (item_cnt > PROBE_RESULT_MEMCHECK_CTRESHOLD) {
struct proc_memusage mu_proc;
@@ -509,9 +508,9 @@ static int probe_cobj_memcheck(size_t item_cnt)
c_ratio = (double)mu_proc.mu_rss/(double)(mu_sys.mu_total);
- if (c_ratio > PROBE_RESULT_MEMCHECK_MAXRATIO) {
+ if (c_ratio > max_ratio) {
dW("Memory usage ratio limit reached! limit=%f, current=%f, used=%ld MB, free=%ld MB, total=%ld MB, count of items=%ld",
- PROBE_RESULT_MEMCHECK_MAXRATIO, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
+ max_ratio, c_ratio, mu_proc.mu_rss / 1024, mu_sys.mu_realfree / 1024, mu_sys.mu_total / 1024, item_cnt);
errno = ENOMEM;
return (1);
}
@@ -550,7 +549,7 @@ int probe_item_collect(struct probe_ctx *ctx, SEXP_t *item)
cobj_itemcnt = SEXP_list_length(cobj_content);
SEXP_free(cobj_content);
- memcheck_ret = probe_cobj_memcheck(cobj_itemcnt);
+ memcheck_ret = probe_cobj_memcheck(cobj_itemcnt, ctx->max_mem_ratio);
if (memcheck_ret == -1) {
dE("Failed to check available memory");
return -1;
diff --git a/src/OVAL/probes/probe/probe.h b/src/OVAL/probes/probe/probe.h
index 1c7a3b1b00..d3a488c4d5 100644
--- a/src/OVAL/probes/probe/probe.h
+++ b/src/OVAL/probes/probe/probe.h
@@ -83,6 +83,7 @@ struct probe_ctx {
SEXP_t *filters; /**< object filters (OVAL 5.8 and higher) */
probe_icache_t *icache; /**< item cache */
int offline_mode;
+ double max_mem_ratio;
};
typedef enum {
diff --git a/src/OVAL/probes/probe/worker.c b/src/OVAL/probes/probe/worker.c
index 94fe5c2037..3ef489b40d 100644
--- a/src/OVAL/probes/probe/worker.c
+++ b/src/OVAL/probes/probe/worker.c
@@ -52,6 +52,10 @@ extern int chroot(const char *);
#include "probe-table.h"
#include "probe.h"
+/* default max. memory usage ratio - used/total */
+/* can be overridden by environment variable OSCAP_PROBE_MEMORY_USAGE_RATIO */
+#define OSCAP_PROBE_MEMORY_USAGE_RATIO_DEFAULT 0.1
+
extern bool OSCAP_GSYM(varref_handling);
extern void *OSCAP_GSYM(probe_arg);
@@ -1064,6 +1068,14 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
pctx.offline_mode = probe->selected_offline_mode;
+ pctx.max_mem_ratio = OSCAP_PROBE_MEMORY_USAGE_RATIO_DEFAULT;
+ char *max_ratio_str = getenv("OSCAP_PROBE_MEMORY_USAGE_RATIO");
+ if (max_ratio_str != NULL) {
+ double max_ratio = strtod(max_ratio_str, NULL);
+ if (max_ratio != 0)
+ pctx.max_mem_ratio = max_ratio;
+ }
+
/* simple object */
pctx.icache = probe->icache;
pctx.filters = probe_prepare_filters(probe, probe_in);
From 0f5cf5b09f469920616a2037d0f9c81cf0868a58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Wed, 15 Sep 2021 14:41:30 +0200
Subject: [PATCH 3/3] Update src/OVAL/probes/probe/worker.c
Co-authored-by: Evgeny Kolesnikov <evgenyz@gmail.com>
---
src/OVAL/probes/probe/worker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/OVAL/probes/probe/worker.c b/src/OVAL/probes/probe/worker.c
index 3ef489b40d..1183ed06bf 100644
--- a/src/OVAL/probes/probe/worker.c
+++ b/src/OVAL/probes/probe/worker.c
@@ -1072,7 +1072,7 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
char *max_ratio_str = getenv("OSCAP_PROBE_MEMORY_USAGE_RATIO");
if (max_ratio_str != NULL) {
double max_ratio = strtod(max_ratio_str, NULL);
- if (max_ratio != 0)
+ if (max_ratio > 0)
pctx.max_mem_ratio = max_ratio;
}

25
SOURCES/openscap-1.3.6-oscap-ssh-local-files-pr-1786.patch
View File

@ -1,25 +0,0 @@
From 9f9a322b73e71bb4945a736605eb0515acf9a207 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Wed, 28 Jul 2021 08:36:50 +0200
Subject: [PATCH] Document problems with --local-files in oscap-ssh
Related to: https://github.com/OpenSCAP/openscap/pull/1769
Thanks @ggbecker for pointing this out.
---
utils/oscap-ssh.8 | 3 +++
1 file changed, 3 insertions(+)
diff --git a/utils/oscap-ssh.8 b/utils/oscap-ssh.8
index 416b1f3e5..05c80cd3c 100644
--- a/utils/oscap-ssh.8
+++ b/utils/oscap-ssh.8
@@ -67,6 +67,9 @@ Specific option for oscap-ssh (must be first argument):
oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable, and pastes its contents into the command-line of ssh to the location where options are expected.
Supply the variable in form of a string that corresponds to a section of the ssh command-line and that consists of options you want to pass.
+.SS Using --local-files option
+The oscap-ssh command supports the --local-files option, but it isn't possible to pass './' and '../' as an argument. Use a full directory path instead.
+
.SH EXAMPLE USAGE
.SS Simple XCCDF evaluation
The following command evaluates a remote Fedora machine as root. HTML report is written out as report.html on the local machine. Can be executed from any machine that has ssh, scp and bash. The local machine does not need to have openscap installed.

36
SOURCES/openscap-1.3.6-replace-getlogin-pr-1753.patch
View File

@ -1,36 +0,0 @@
From b31cff1bc3a298cfa36a10476f2d633c290b6741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 11 May 2021 13:20:18 +0200
Subject: [PATCH] Replace getlogin by cuserid
The getlogin() is used here to fill in the xccdf:identity element which
shall contain information about the system identity or user employed
during application of the benchmark. But, the getlogin() can return NULL
when there is no controlling terminal. This happened when testing oscap
on a test system with no pty. As an alternative, the system provides
also cuserid() function which gets the effective user ID of the process.
However, these 2 values differ when the program is executed under sudo.
From the user experience point of view, it would be better to have
displayed there the user logged in on the controlling terminal. As a
compromise, we will first attempt to obtain the name using getlogin()
and if that fails we will run cuserid().
---
src/XCCDF/result.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/XCCDF/result.c b/src/XCCDF/result.c
index cd03e6bd8f..cbe016c44a 100644
--- a/src/XCCDF/result.c
+++ b/src/XCCDF/result.c
@@ -217,7 +217,10 @@ static inline void _xccdf_result_fill_identity(struct xccdf_result *result)
xccdf_identity_set_authenticated(id, 0);
xccdf_identity_set_privileged(id, 0);
#ifdef OSCAP_UNIX
- xccdf_identity_set_name(id, getlogin());
+ char *name = getlogin();
+ if (name == NULL)
+ name = cuserid(NULL);
+ xccdf_identity_set_name(id, name);
#elif defined(OS_WINDOWS)
GetUserName((TCHAR *) w32_username, &w32_usernamesize); /* XXX: Check the return value? */
xccdf_identity_set_name(id, w32_username);

42
SOURCES/openscap-1.3.6-rpath-pr-1765.patch
View File

@ -1,42 +0,0 @@
From 5f8879927fa34827f1b367eac311845e6ebec9a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 10 Jun 2021 13:41:25 +0200
Subject: [PATCH] Do not set Rpath
See: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_beware_of_rpath
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1967200
---
CMakeLists.txt | 18 ------------------
1 file changed, 18 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index c70ba29bf..cc7b5e005 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -482,25 +482,7 @@ else()
endif()
set(OSCAP_TEMP_DIR "/tmp" CACHE STRING "use different temporary directory to execute sce scripts (default=/tmp)")
-# ---------- RPATHS for linking
-# see https://cmake.org/Wiki/CMake_RPATH_handling
-
-# use, i.e. don't skip the full RPATH for the build tree
-set(CMAKE_SKIP_BUILD_RPATH FALSE)
-
-# when building, don't use the install RPATH already
-# (but later on when installing)
-set(CMAKE_BUILD_WITH_INSTALL_RPATH FALSE)
-
-set(CMAKE_INSTALL_RPATH ${CMAKE_INSTALL_FULL_LIBDIR})
-
-# add the automatically determined parts of the RPATH
-# which point to directories outside the build tree to the install RPATH
-set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
-
-# Turn on RPATH for OSX for policy warning
-set(CMAKE_MACOSX_RPATH ON)
# ---------- CONFIGURATION
configure_file("config.h.in" "config.h")

81
SOURCES/openscap-1.3.6-rpminspect-xml-pr-1773.patch
View File

@ -1,81 +0,0 @@
From e515fc9694efb8703f6c55782094e0273c0dec9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 25 Jun 2021 13:59:59 +0200
Subject: [PATCH] Workaround rpminspect problem
rpminspect produces this problem:
xml-files:
----------
1) File /usr/share/openscap/xsl/oval-results-report.xsl is a malformed XML file on x86_64
Result: VERIFY
Waiver Authorization: Anyone
Details:
No declaration for element stylesheet
Suggested Remedy: Correct the reported errors in the XML document
I assume that it's caused by mixing the DTD and schema - it probably
expects that the DTD will contain a declaration of the root element
as well. The workaround simply expands both entities by substituting
them by their contents.
---
xsl/oval-results-report.xsl | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
diff --git a/xsl/oval-results-report.xsl b/xsl/oval-results-report.xsl
index fe50717795..744540c8f8 100644
--- a/xsl/oval-results-report.xsl
+++ b/xsl/oval-results-report.xsl
@@ -1,10 +1,4 @@
<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE xsl:stylesheet [
-<!-- check symbol -->
-<!ENTITY resultgood "&#x2713;">
-<!-- x symbol -->
-<!ENTITY resultbad "&#x2715;">
-]>
<!--
****************************************************************************************
@@ -129,7 +123,7 @@
<tr class="LightRow">
<td class="resultbadA ColorBox"/>
<td class="resultbadB ColorBox"/>
- <td class="Text" title="Non-Compliant/Vulnerable/Unpatched">&resultbad;</td>
+ <td class="Text" title="Non-Compliant/Vulnerable/Unpatched">&#x2715;</td>
</tr>
</table>
</td>
@@ -138,7 +132,7 @@
<tr class="LightRow">
<td class="resultgoodA ColorBox"/>
<td class="resultgoodB ColorBox"/>
- <td class="Text" title="Compliant/Non-Vulnerable/Patched">&resultgood;</td>
+ <td class="Text" title="Compliant/Non-Vulnerable/Patched">&#x2713;</td>
</tr>
</table>
</td>
@@ -227,8 +221,8 @@
<table border="1">
<tr class="Title">
<td class="TitleLabel" align="center">Systems Analyzed</td>
- <td class="TitleLabel" align="center" title="Non-Compliant/Vulnerable/Unpatched">&resultbad;</td>
- <td class="TitleLabel" align="center" title="Compliant/Non-Vulnerable/Patched">&resultgood;</td>
+ <td class="TitleLabel" align="center" title="Non-Compliant/Vulnerable/Unpatched">&#x2715;</td>
+ <td class="TitleLabel" align="center" title="Compliant/Non-Vulnerable/Patched">&#x2713;</td>
<td class="TitleLabel" align="center">Errors</td>
<td class="TitleLabel" align="center">Unknown</td>
<td class="TitleLabel" align="center" title="Inventory/Miscellaneous class, or Not Applicable/Not Evaluated result">Other</td>
@@ -497,8 +491,8 @@
<xsl:template name="GeneratorResTotals">
<xsl:param name="resultsElm"/>
<tr class="DarkRow Center">
- <td class="SmallLabel" style="width: 20%;" title="Non-Compliant/Vulnerable/Unpatched">#&resultbad;</td>
- <td class="SmallLabel" style="width: 20%;" title="Compliant/Non-Vulnerable/Patched">#&resultgood;</td>
+ <td class="SmallLabel" style="width: 20%;" title="Non-Compliant/Vulnerable/Unpatched">#&#x2715;</td>
+ <td class="SmallLabel" style="width: 20%;" title="Compliant/Non-Vulnerable/Patched">#&#x2713;</td>
<td class="SmallLabel" style="width: 20%;" title="Error">#Error</td>
<td class="SmallLabel" style="width: 20%;" title="Unknown">#Unknown</td>
<td class="SmallLabel" style="width: 20%;" title="Inventory/Miscellaneous class, or Not Applicable/Not Evaluated result">#Other</td>

97
SOURCES/openscap-1.3.6-test-rhbz1959570-pr-1788.patch
View File

@ -1,97 +0,0 @@
From 05faede8f6602b7b71d71fd965276225a986fb1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Wed, 28 Jul 2021 13:06:25 +0200
Subject: [PATCH] Add a regression test for rhbz#1959570
The bug was a segmentation fault in filehash58 probe which happened
in openscap-1.3.3-6.el8_3.
The bug was fixed by https://github.com/OpenSCAP/openscap/pull/1779
and this patch adds a very small test.
---
tests/probes/filehash58/CMakeLists.txt | 1 +
.../probes/filehash58/rhbz1959570_segfault.sh | 19 +++++++++
.../rhbz1959570_segfault_reproducer.xml | 39 +++++++++++++++++++
3 files changed, 59 insertions(+)
create mode 100755 tests/probes/filehash58/rhbz1959570_segfault.sh
create mode 100644 tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
diff --git a/tests/probes/filehash58/CMakeLists.txt b/tests/probes/filehash58/CMakeLists.txt
index b26d8171fb..cdec0792eb 100644
--- a/tests/probes/filehash58/CMakeLists.txt
+++ b/tests/probes/filehash58/CMakeLists.txt
@@ -1,3 +1,4 @@
if(ENABLE_PROBES_INDEPENDENT)
add_oscap_test("test_probes_filehash58.sh")
+ add_oscap_test("rhbz1959570_segfault.sh")
endif()
diff --git a/tests/probes/filehash58/rhbz1959570_segfault.sh b/tests/probes/filehash58/rhbz1959570_segfault.sh
new file mode 100755
index 0000000000..0c32cc79f1
--- /dev/null
+++ b/tests/probes/filehash58/rhbz1959570_segfault.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+# Copyright 2021 Red Hat Inc., Durham, North Carolina.
+# All Rights Reserved.
+#
+# OpenSCAP Probes Test Suite.
+#
+# Authors:
+# Jan Černý, <jcerny@redhat.com>
+
+set -e -o pipefail
+. $builddir/tests/test_common.sh
+
+# Test Cases
+
+stderr="$(mktemp)"
+$OSCAP oval eval --id oval:x:def:1 "$srcdir/rhbz1959570_segfault_reproducer.xml" 2> "$stderr"
+[ ! -s "$stderr" ]
+rm "$stderr"
diff --git a/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
new file mode 100644
index 0000000000..4b3fc4863a
--- /dev/null
+++ b/tests/probes/filehash58/rhbz1959570_segfault_reproducer.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<oval-def:oval_definitions xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
+ <oval-def:generator>
+ <oval:product_name>jcerny</oval:product_name>
+ <oval:product_version>1</oval:product_version>
+ <oval:schema_version>5.11</oval:schema_version>
+ <oval:timestamp>2021-07-28T07:40:55</oval:timestamp>
+ </oval-def:generator>
+ <oval-def:definitions>
+ <oval-def:definition class="compliance" id="oval:x:def:1" version="1">
+ <oval-def:metadata>
+ <oval-def:title>title</oval-def:title>
+ <oval-def:description>description</oval-def:description>
+ </oval-def:metadata>
+ <oval-def:criteria>
+ <oval-def:criterion comment="comment" test_ref="oval:x:tst:1"/>
+ </oval-def:criteria>
+ </oval-def:definition>
+ </oval-def:definitions>
+ <oval-def:tests>
+ <ind:filehash58_test check="all" check_existence="all_exist" comment="comment" id="oval:x:tst:1" version="1">
+ <ind:object object_ref="oval:x:obj:1"/>
+ <ind:state state_ref="oval:x:ste:1"/>
+ </ind:filehash58_test>
+ </oval-def:tests>
+ <oval-def:objects>
+ <ind:filehash58_object id="oval:x:obj:1" version="1">
+ <ind:filepath>/etc/os-release</ind:filepath>
+ <ind:hash_type>SHA-256</ind:hash_type>
+ </ind:filehash58_object>
+ </oval-def:objects>
+ <oval-def:states>
+ <ind:filehash58_state id="oval:x:ste:1" version="1">
+ <ind:filepath>/etc/os-release</ind:filepath>
+ <ind:hash_type>SHA-256</ind:hash_type>
+ <ind:hash>6488c757642cd493da09dd78ee27f039711a1ad79039900970553772fd2106af</ind:hash>
+ </ind:filehash58_state>
+ </oval-def:states>
+</oval-def:oval_definitions>

38
SOURCES/openscap-1.3.6-ubi9-pr-1772.patch
View File

@ -1,38 +0,0 @@
From 80543bc666d648d0251e4c7b675489b8011a548a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 25 Jun 2021 10:19:43 +0200
Subject: [PATCH] Fix UBI 9 scan
In offline mode when scanning a cointainer based on UBI 9 the
system_info probe failed because the function `_offline_get_hname` which
reads from `/etc/hostname` returns an empty string which causes
`__sysinfo_saneval(hname)` check to return zero which in turn causes the
probe returns an error. We can prevent this situation by replacing the
empty string by `"Unknown"`, which we already do when the `hname` is
`NULL`.
Addressing:
W: oscap: Can't receive message: 125, Operation canceled.
E: oscap: Recv: retry limit (0) reached.
OpenSCAP Error: Probe at sd=32 (system_info) reported an error: Invalid type, value or format [/home/jcerny/work/git/openscap/src/OVAL/oval_probe_ext.c:383]
Unable to receive a message from probe [/home/jcerny/work/git/openscap/src/OVAL/oval_probe_ext.c:572]
Resolves: rhbz#1953610
---
src/OVAL/probes/independent/system_info_probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/OVAL/probes/independent/system_info_probe.c b/src/OVAL/probes/independent/system_info_probe.c
index 9bdd73556d..8251e655ed 100644
--- a/src/OVAL/probes/independent/system_info_probe.c
+++ b/src/OVAL/probes/independent/system_info_probe.c
@@ -732,7 +732,7 @@ int system_info_probe_main(probe_ctx *ctx, void *arg)
if (!architecture)
architecture = strdup(unknown);
- if (!hname)
+ if (!hname || *hname == '\0')
hname = strdup(unknown);
if (__sysinfo_saneval(os_name) < 1 ||

43
SOURCES/openscap-1.3.6-waive-hugetables-pr-1745.patch
View File

@ -1,43 +0,0 @@
From 192f908562779fe4c9b7e5cc7605840976a06c85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 26 Apr 2021 13:13:26 +0200
Subject: [PATCH] Waive the known issue with hugepages on ppc64/ppc64le
The known issue has been reported in
https://bugzilla.redhat.com/show_bug.cgi?id=1642995
This modification is currently applied as a patch applied during setup
phase of Sanity/smoke-test in Fedora CI gating.
https://src.fedoraproject.org/tests/openscap/blob/main/f/Sanity/smoke-test
The patched file got changed recetly so the patch doesn't apply anymore
which causes the Rawhide gating to fail.
We have decided to propose the change to upstream to avoid the need
for modifying the patch in the tests and to prevent similar problems
in the future.
---
tests/probes/sysctl/test_sysctl_probe_all.sh | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tests/probes/sysctl/test_sysctl_probe_all.sh b/tests/probes/sysctl/test_sysctl_probe_all.sh
index 2280ff7ae..c79d7ed18 100755
--- a/tests/probes/sysctl/test_sysctl_probe_all.sh
+++ b/tests/probes/sysctl/test_sysctl_probe_all.sh
@@ -73,6 +73,10 @@ if [ "$procps_ver" != "$lowest_ver" ]; then
sed -i '/.*vm.stat_refresh/d' "$sysctlNames"
fi
+if ! grep -q "hugepages" "$ourNames"; then
+ sed -i "/^.*hugepages.*$/d" "$sysctlNames"
+fi
+
echo "Diff (sysctlNames / ourNames): ------"
diff "$sysctlNames" "$ourNames"
echo "-------------------------------------"
@@ -84,6 +88,7 @@ sed -i -E "/^E: oscap: +Can't read sysctl value from /d" "$stderr"
# that can't fit into 8K buffer and result in errno 14
# (for example /proc/sys/kernel/spl/hostid could be the case)
sed -i -E "/^E: oscap: +An error.*14, Bad address/d" "$stderr"
+sed -i "/^.*hugepages.*$/d" "$stderr"
echo "Errors (without messages related to permissions):"
cat "$stderr"

41
SOURCES/openscap-1.3.6-warning-local-files-pr-1826.patch
View File

@ -1,41 +0,0 @@
From ce74fde37771fa2cf6d947e5aaeebd9a197db50b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 9 Nov 2021 09:15:20 +0100
Subject: [PATCH] Print warning for local files
This will explicitely display users that they're using local
files instead of the remote resource.
See https://bugzilla.redhat.com/show_bug.cgi?id=1970529#c6
---
src/DS/sds.c | 4 +++-
tests/DS/test_ds_use_local_remote_resources.sh | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/DS/sds.c b/src/DS/sds.c
index a26fdbb09..243b62968 100644
--- a/src/DS/sds.c
+++ b/src/DS/sds.c
@@ -407,7 +407,9 @@ static int _handle_disabled_downloads(struct ds_sds_session *session, const char
char *local_filepath = oscap_path_join(local_files, relative_filepath);
struct stat sb;
if (stat(local_filepath, &sb) == 0) {
- dI("Using local file '%s' instead of '%s'", local_filepath, xlink_href);
+ ds_sds_session_remote_resources_progress(session)(true,
+ "WARNING: Using local file '%s' instead of '%s'",
+ local_filepath, xlink_href);
struct oscap_source *source_file = oscap_source_new_from_file(local_filepath);
xmlDoc *doc = oscap_source_get_xmlDoc(source_file);
if (doc == NULL) {
diff --git a/tests/DS/test_ds_use_local_remote_resources.sh b/tests/DS/test_ds_use_local_remote_resources.sh
index 789dc8326..2feb47da1 100755
--- a/tests/DS/test_ds_use_local_remote_resources.sh
+++ b/tests/DS/test_ds_use_local_remote_resources.sh
@@ -24,6 +24,7 @@ $OSCAP xccdf eval --local-files "$tmpdir3" --profile "$PROFILE" --results "$resu
grep -q "WARNING: Datastream component 'scap_org.open-scap_cref_remote.oval.xml' points out to the remote 'https://www.example.com/security/data/oval/remote.oval.xml'. Use '--fetch-remote-resources' option to download it." "$stderr" && false
grep -q "WARNING: Skipping 'https://www.example.com/security/data/oval/remote.oval.xml' file which is referenced from datastream" "$stderr" && false
+grep -q "WARNING: Using local file '$tmpdir3/remote.oval.xml' instead of 'https://www.example.com/security/data/oval/remote.oval.xml'" "$stderr"
assert_exists 1 '//rule-result[@idref="xccdf_com.example.www_rule_test-pass"]/result[text()="pass"]'
# the remote_res rule is a multicheck with 2 oval definitions so it's twice here

150
SOURCES/openscap-1.3.6-yamlfile-null-pr-1756.patch
View File

@ -1,150 +0,0 @@
From 89f99834ba183284a7d75835932a0c0ea4eb9007 Mon Sep 17 00:00:00 2001
From: Evgeny Kolesnikov <ekolesni@redhat.com>
Date: Mon, 17 May 2021 08:40:17 +0200
Subject: [PATCH] oval/yamlfilecontent: Add 'null' values handling
For now null values would be represented as string '(null)' as
record's field could not be attributed as nil="true" yet.
---
.../independent/yamlfilecontent_probe.c | 9 ++++
.../test_probes_yamlfilecontent_types.sh | 5 ++
.../test_probes_yamlfilecontent_types.xml | 52 +++++++++++++++++++
tests/probes/yamlfilecontent/types.yaml | 4 ++
4 files changed, 70 insertions(+)
diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
index 62a8f4ff29..2d0cac6991 100644
--- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
@@ -41,6 +41,7 @@
#define OSCAP_YAML_BOOL_TAG "tag:yaml.org,2002:bool"
#define OSCAP_YAML_FLOAT_TAG "tag:yaml.org,2002:float"
#define OSCAP_YAML_INT_TAG "tag:yaml.org,2002:int"
+#define OSCAP_YAML_NULL_TAG "tag:yaml.org,2002:null"
#define OVECCOUNT 30 /* should be a multiple of 3 */
@@ -135,6 +136,14 @@ static SEXP_t *yaml_scalar_event_to_sexp(yaml_event_t *event)
return NULL;
}
}
+ if (question || !strcmp(tag, OSCAP_YAML_NULL_TAG)) {
+ if (match_regex("^(null|Null|NULL|~|)$", value)) {
+ // TODO: Return real NULL when record's field will support nil="true"
+ return SEXP_string_new("(null)", strlen("(null)"));
+ } else if (!question) {
+ return NULL;
+ }
+ }
return SEXP_string_new(value, strlen(value));
}
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
index 4f110f6eb7..e445771d03 100755
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.sh
@@ -60,6 +60,11 @@ function test_probes_yamlfilecontent_types {
assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="boolean" and text()="true"]'
# string_number
assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and @datatype!="int" and text()="81"]'
+ # string_null
+ assert_exists 1 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="null"]'
+
+ # null_1_2_3
+ assert_exists 3 $sd'/ind-sys:yamlfilecontent_item/ind-sys:value/field[@name="#" and text()="(null)"]'
# bool_error_cast, int_error_cast, float_error_cast
co='/oval_results/results/system/oval_system_characteristics/collected_objects'
diff --git a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
index adf96571b8..503ec2d4a4 100644
--- a/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
+++ b/tests/probes/yamlfilecontent/test_probes_yamlfilecontent_types.xml
@@ -262,6 +262,19 @@
</criteria>
</definition>
+ <definition class="compliance" version="1" id="oval:0:def:26">
+ <metadata>
+ <title></title>
+ <description></description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="comment" test_ref="oval:0:tst:26"/>
+ <criterion comment="comment" test_ref="oval:0:tst:27"/>
+ <criterion comment="comment" test_ref="oval:0:tst:28"/>
+ <criterion comment="comment" test_ref="oval:0:tst:29"/>
+ </criteria>
+ </definition>
+
</definitions>
<tests>
@@ -364,6 +377,21 @@
<ind-def:object object_ref="oval:0:obj:25"/>
</ind-def:yamlfilecontent_test>
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:26" check="all" comment="true">
+ <ind-def:object object_ref="oval:0:obj:26"/>
+ </ind-def:yamlfilecontent_test>
+
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:27" check="all" comment="true">
+ <ind-def:object object_ref="oval:0:obj:27"/>
+ </ind-def:yamlfilecontent_test>
+
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:28" check="all" comment="true">
+ <ind-def:object object_ref="oval:0:obj:28"/>
+ </ind-def:yamlfilecontent_test>
+
+ <ind-def:yamlfilecontent_test version="1" id="oval:0:tst:29" check="all" comment="true">
+ <ind-def:object object_ref="oval:0:obj:29"/>
+ </ind-def:yamlfilecontent_test>
</tests>
<objects>
@@ -517,6 +545,30 @@
<ind-def:filename>types.yaml</ind-def:filename>
<ind-def:yamlpath>.float_error_cast</ind-def:yamlpath>
</ind-def:yamlfilecontent_object>
+
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:26">
+ <ind-def:path>/tmp</ind-def:path>
+ <ind-def:filename>types.yaml</ind-def:filename>
+ <ind-def:yamlpath>.null_1</ind-def:yamlpath>
+ </ind-def:yamlfilecontent_object>
+
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:27">
+ <ind-def:path>/tmp</ind-def:path>
+ <ind-def:filename>types.yaml</ind-def:filename>
+ <ind-def:yamlpath>.null_2</ind-def:yamlpath>
+ </ind-def:yamlfilecontent_object>
+
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:28">
+ <ind-def:path>/tmp</ind-def:path>
+ <ind-def:filename>types.yaml</ind-def:filename>
+ <ind-def:yamlpath>.null_3</ind-def:yamlpath>
+ </ind-def:yamlfilecontent_object>
+
+ <ind-def:yamlfilecontent_object version="1" id="oval:0:obj:29">
+ <ind-def:path>/tmp</ind-def:path>
+ <ind-def:filename>types.yaml</ind-def:filename>
+ <ind-def:yamlpath>.string_null</ind-def:yamlpath>
+ </ind-def:yamlfilecontent_object>
</objects>
</oval_definitions>
diff --git a/tests/probes/yamlfilecontent/types.yaml b/tests/probes/yamlfilecontent/types.yaml
index f05fa3a967..fb26eab5f0 100644
--- a/tests/probes/yamlfilecontent/types.yaml
+++ b/tests/probes/yamlfilecontent/types.yaml
@@ -19,7 +19,11 @@ bool_false_cast: !!bool "false"
int_cast: !!int "369"
float_cast: !!float "978.65"
string_true: "true"
+string_null: "null"
string_number: "81"
bool_error_cast: !!bool "falsee"
int_error_cast: !!int "50%"
float_error_cast: !!float "58.41$"
+null_1: null
+null_2:
+null_3: !!null "null"

104
SOURCES/openscap-1.3.7-PR-1841-coverity.patch Normal file
View File

@ -0,0 +1,104 @@
From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:00:33 +0100
Subject: [PATCH 1/3] Fix shellcheck warning
Addressing:
Error: SHELLCHECK_WARNING (CWE-138): [#def1]
/usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument.
108| args+=( "--remediate" )
109| args+=( "${OSCAP_REMEDIATE_DS}" )
110|-> log "Args: ${args[@]}"
111|
112| # Now we are good to go
---
utils/oscap-remediate | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/utils/oscap-remediate b/utils/oscap-remediate
index fc0b7715f..52e29aa66 100755
--- a/utils/oscap-remediate
+++ b/utils/oscap-remediate
@@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}"
args+=( "--progress-full" )
args+=( "--remediate" )
args+=( "${OSCAP_REMEDIATE_DS}" )
-log "Args: ${args[@]}"
+log "Args: ${args[*]}"
# Now we are good to go
header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..."
From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:09:02 +0100
Subject: [PATCH 2/3] Remove superfluous strdup
We can do this because xccdf_session_set_rule calls strdup on the rule
parameter internally.
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule".
openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to.
4148| char *n_rule = strdup(rule);
4149| xccdf_session_set_rule(sess, n_rule);
4150|-> }
4151|
4152| void xccdf_session_free_py(struct xccdf_session *sess){
---
swig/openscap.i | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/swig/openscap.i b/swig/openscap.i
index 2fe1cce99..158a22675 100644
--- a/swig/openscap.i
+++ b/swig/openscap.i
@@ -559,8 +559,7 @@ struct xccdf_session {
};
void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) {
- char *n_rule = strdup(rule);
- xccdf_session_set_rule(sess, n_rule);
+ xccdf_session_set_rule(sess, rule);
}
void xccdf_session_free_py(struct xccdf_session *sess){
From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 27 Jan 2022 15:16:02 +0100
Subject: [PATCH 3/3] Add a missing free
Addressing:
Error: RESOURCE_LEAK (CWE-772): [#def4] [important]
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key".
openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to.
2148| oscap_seterr(OSCAP_EFAMILY_XCCDF,
2149| "Rule '%s' not found in selected profile.", rule_id);
2150|-> return NULL;
2151| }
2152| }
---
src/XCCDF_POLICY/xccdf_policy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c
index b63853a38..4d4b7ad0a 100644
--- a/src/XCCDF_POLICY/xccdf_policy.c
+++ b/src/XCCDF_POLICY/xccdf_policy.c
@@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy)
if (oscap_htable_get(policy->rules_found, rule_id) == NULL) {
oscap_seterr(OSCAP_EFAMILY_XCCDF,
"Rule '%s' not found in selected profile.", rule_id);
+ oscap_htable_iterator_free(rit);
return NULL;
}
}

32
SOURCES/openscap-1.3.7-PR-1843-fix-test-ds-misc.patch Normal file
View File

@ -0,0 +1,32 @@
From e49669a0dde7e3a9123925347fbf3234602371ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Mon, 31 Jan 2022 13:45:15 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
The SOURCE_DATE_EPOCH environment variable is effective only when it's
set to a value that's older than mtime of the processed file. See the
implementation in ds_sds_compose_add_component_internal in src/DS/sds.c.
However, the file in our test suite has originally been created before
(in 2019) and this mtime can be used when a tarball is produced. To
avoid the test failing, we can modify the mtime using the touch command
just before we run the tests.
---
tests/DS/test_ds_misc.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index 159007518..cffbef303 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -269,6 +269,8 @@ function test_source_date_epoch() {
local timestamp="2020-03-05T12:09:37"
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
+ # ensure the file mtime is always newer than the $timestamp
+ touch -c "$xccdf"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"
--
2.34.1

27
SOURCES/openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch Normal file
View File

@ -0,0 +1,27 @@
From 650656bdac5e8e4df30c11bb4dbc830aab8baa78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Tue, 1 Feb 2022 15:06:33 +0100
Subject: [PATCH] Prevent fails of test_ds_misc.sh
Other files from which the datastream is composed might also
affect the timestamp attributes in result document depending
on their mtime.
---
tests/DS/test_ds_misc.sh | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tests/DS/test_ds_misc.sh b/tests/DS/test_ds_misc.sh
index cffbef303..1777c44f4 100755
--- a/tests/DS/test_ds_misc.sh
+++ b/tests/DS/test_ds_misc.sh
@@ -270,7 +270,9 @@ function test_source_date_epoch() {
export SOURCE_DATE_EPOCH="1583410177"
export TZ=UTC
# ensure the file mtime is always newer than the $timestamp
- touch -c "$xccdf"
+ touch -c "$srcdir/sds_multiple_oval/first-oval.xml"
+ touch -c "$srcdir/sds_multiple_oval/multiple-oval-xccdf.xml"
+ touch -c "$srcdir/sds_multiple_oval/second-oval.xml"
$OSCAP ds sds-compose "$xccdf" "$result"
assert_exists 3 '//ds:component[@timestamp="'$timestamp'"]'
rm -f "$result"

393
SOURCES/openscap-1.3.7-PR-1846-file-permissions.patch Normal file
View File

@ -0,0 +1,393 @@
From d000375944e8ec965486cf019c3f75f4c06a4e10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 14:14:21 +0100
Subject: [PATCH 1/5] Prevent file permissions errors
The sysctl setting `fs.protected_regular` doesn't allow `O_CREAT` open
on regular files that we don't own in world writable sticky directories
(think `/tmp`). This causes permission denied error when writing HTML
report to a temporary files created by the `mktemp` command executed as
a normal user and then executing `sudo oscap`.
See https://bugzilla.redhat.com/show_bug.cgi?id=2048571
If OpenSCAP fails to open the file because of permissions, it will retry
to open the file without O_CREAT flag.
This fixes only creation of the HTML report using the `--report` option,
We will have to create a similar patch also for other output options
such as `--results` or `--results-arf`.
---
src/source/xslt.c | 40 ++++++++++++++++++++++++++++------------
1 file changed, 28 insertions(+), 12 deletions(-)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 24c4c46e9..7a3a3f328 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -22,6 +22,7 @@
#include <config.h>
#endif
+#include <fcntl.h>
#include <libxml/parser.h>
#include <libxslt/xslt.h>
#include <libxslt/xsltInternals.h>
@@ -82,23 +83,38 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
{
- FILE *f = NULL;
- if (outfile)
- f = fopen(outfile, "w");
- else
- f = stdout;
-
- if (f == NULL) {
- oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not open output file '%s'", outfile ? outfile : "stdout");
- return -1;
+ int fd = STDOUT_FILENO;
+ if (outfile) {
+#ifdef OS_WINDOWS
+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_OSCAP,
+ "Could not open output file '%s': %s",
+ outfile, strerror(errno));
+ return -1;
+ }
+ }
}
- int ret = xsltSaveResultToFile(f, resulting_doc, stylesheet);
+ int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
if (ret < 0) {
oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
}
- if (outfile && f)
- fclose(f);
+ if (fd != STDOUT_FILENO)
+ close(fd);
return ret;
}
From ad3c89a72c0aeb6c6ceab0873c51b07deba45701 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 15:08:52 +0100
Subject: [PATCH 2/5] Prevent permission access issues
Very similar to the previous commit, but this time for saving XML
documents.
---
src/common/elements.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/src/common/elements.c b/src/common/elements.c
index e512f5e3d..d0d9170f1 100644
--- a/src/common/elements.c
+++ b/src/common/elements.c
@@ -233,9 +233,22 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
#endif
- if (fd < 0) {
- oscap_seterr(OSCAP_EFAMILY_GLIBC, "%s '%s'", strerror(errno), filename);
- return -1;
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(filename, O_WRONLY|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_GLIBC,
+ "%s '%s'", strerror(errno), filename);
+ return -1;
+ }
}
buff = xmlOutputBufferCreateFd(fd, NULL);
From b2dc90fb80419e30d05676660a2069050693078d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 15:37:31 +0100
Subject: [PATCH 3/5] Add a missing include
---
src/source/xslt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 7a3a3f328..a763d6b59 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -30,6 +30,8 @@
#include <libxslt/xsltutils.h>
#include <libexslt/exslt.h>
#include <string.h>
+#include <sys/stat.h>
+
#ifdef OS_WINDOWS
#include <io.h>
#else
From 13ff98bd744ea542bc782e388fdedb5b7f66e54b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Thu, 3 Feb 2022 16:22:56 +0100
Subject: [PATCH 4/5] Fix missing STDOUT_FILENO on Windows
---
src/source/xslt.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/source/xslt.c b/src/source/xslt.c
index a763d6b59..799d5170d 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -85,7 +85,11 @@ static int xccdf_ns_xslt_workaround(xmlDocPtr doc, xmlNodePtr node)
static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStylesheet *stylesheet, const char *outfile)
{
+#ifdef OS_WINDOWS
+ int fd = _fileno(stdout);
+#else
int fd = STDOUT_FILENO;
+#endif
if (outfile) {
#ifdef OS_WINDOWS
fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
@@ -115,7 +119,11 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
if (ret < 0) {
oscap_seterr(OSCAP_EFAMILY_OSCAP, "Could not save result document");
}
+#ifdef OS_WINDOWS
+ if (fd != _fileno(stdout))
+#else
if (fd != STDOUT_FILENO)
+#endif
close(fd);
return ret;
}
From f00831513ec2cdde13c12820ff6cc0eef8105c65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
Date: Fri, 4 Feb 2022 12:19:50 +0100
Subject: [PATCH 5/5] Refactor: extract function oscap_open_writable
---
src/common/elements.c | 26 ++--------------
src/common/util.c | 31 +++++++++++++++++++
src/common/util.h | 14 ++++++++-
src/source/xslt.c | 27 ++--------------
tests/API/XCCDF/unittests/CMakeLists.txt | 2 ++
tests/API/XCCDF/unittests/test_oscap_common.c | 1 +
6 files changed, 53 insertions(+), 48 deletions(-)
diff --git a/src/common/elements.c b/src/common/elements.c
index d0d9170f1..de4be88f1 100644
--- a/src/common/elements.c
+++ b/src/common/elements.c
@@ -227,29 +227,9 @@ int oscap_xml_save_filename(const char *filename, xmlDocPtr doc)
xmlCode = xmlSaveFormatFileEnc(filename, doc, "UTF-8", 1);
}
else {
-#ifdef OS_WINDOWS
- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY, S_IREAD|S_IWRITE);
-#else
- int fd = open(filename, O_CREAT|O_TRUNC|O_WRONLY,
- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- if (fd == -1) {
- if (errno == EACCES) {
- /* File already exists and we aren't allowed to create a new one
- with the same name */
-#ifdef OS_WINDOWS
- fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(filename, O_WRONLY|O_TRUNC,
- S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- }
- if (fd == -1) {
- oscap_seterr(OSCAP_EFAMILY_GLIBC,
- "%s '%s'", strerror(errno), filename);
- return -1;
- }
- }
+ int fd = oscap_open_writable(filename);
+ if (fd == -1)
+ return -1;
buff = xmlOutputBufferCreateFd(fd, NULL);
if (buff == NULL) {
diff --git a/src/common/util.c b/src/common/util.c
index 8f9f751e2..8ca2ad130 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -25,12 +25,14 @@
#include <config.h>
#endif
+#include <fcntl.h>
#include <string.h>
#include <ctype.h>
#include <limits.h>
#include <stdarg.h>
#include <math.h>
#include <pcre.h>
+#include <sys/stat.h>
#include "util.h"
#include "_error.h"
@@ -482,3 +484,32 @@ char *oscap_windows_error_message(unsigned long error_code)
return error_message;
}
#endif
+
+int oscap_open_writable(const char *filename)
+{
+#ifdef OS_WINDOWS
+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ int fd = open(filename, O_WRONLY|O_CREAT|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ if (fd == -1) {
+ if (errno == EACCES) {
+ /* File already exists and we aren't allowed to create a new one
+ with the same name */
+#ifdef OS_WINDOWS
+ fd = open(filename, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
+#else
+ fd = open(filename, O_WRONLY|O_TRUNC,
+ S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
+#endif
+ }
+ if (fd == -1) {
+ oscap_seterr(OSCAP_EFAMILY_OSCAP,
+ "Could not open output file '%s': %s",
+ filename, strerror(errno));
+ return -1;
+ }
+ }
+ return fd;
+}
diff --git a/src/common/util.h b/src/common/util.h
index c48d92a52..5712f2f0b 100644
--- a/src/common/util.h
+++ b/src/common/util.h
@@ -524,4 +524,16 @@ wchar_t *oscap_windows_str_to_wstr(const char *str);
char *oscap_windows_error_message(unsigned long error_code);
#endif
-#endif /* OSCAP_UTIL_H_ */
+/**
+ * Open a file for writing.
+ * The main difference from fopen() is that if the file exists but its opening
+ * for writing fails as permission denied, it will attempt to open it again
+ * without the O_CREAT flag. This is useful when writing to world-writeable
+ * directories with sticky bit such as /tmp on systems with fs.protected_regular
+ * turned on.
+ * @param filename name of the file to be opened
+ * @return file descriptor or -1 on error
+ */
+int oscap_open_writable(const char *filename);
+
+#endif /* OSCAP_UTIL_H_ */
diff --git a/src/source/xslt.c b/src/source/xslt.c
index 799d5170d..906bfabdb 100644
--- a/src/source/xslt.c
+++ b/src/source/xslt.c
@@ -22,7 +22,6 @@
#include <config.h>
#endif
-#include <fcntl.h>
#include <libxml/parser.h>
#include <libxslt/xslt.h>
#include <libxslt/xsltInternals.h>
@@ -30,7 +29,6 @@
#include <libxslt/xsltutils.h>
#include <libexslt/exslt.h>
#include <string.h>
-#include <sys/stat.h>
#ifdef OS_WINDOWS
#include <io.h>
@@ -91,29 +89,10 @@ static inline int save_stylesheet_result_to_file(xmlDoc *resulting_doc, xsltStyl
int fd = STDOUT_FILENO;
#endif
if (outfile) {
-#ifdef OS_WINDOWS
- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(outfile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- if (fd == -1) {
- if (errno == EACCES) {
- /* File already exists and we aren't allowed to create a new one
- with the same name */
-#ifdef OS_WINDOWS
- fd = open(outfile, O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE);
-#else
- fd = open(outfile, O_WRONLY|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH);
-#endif
- }
- if (fd == -1) {
- oscap_seterr(OSCAP_EFAMILY_OSCAP,
- "Could not open output file '%s': %s",
- outfile, strerror(errno));
- return -1;
- }
- }
+ fd = oscap_open_writable(outfile);
}
+ if (fd == -1)
+ return -1;
int ret = xsltSaveResultToFd(fd, resulting_doc, stylesheet);
if (ret < 0) {
diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt
index 97e1ab09f..a1c7da67f 100644
--- a/tests/API/XCCDF/unittests/CMakeLists.txt
+++ b/tests/API/XCCDF/unittests/CMakeLists.txt
@@ -2,6 +2,8 @@ add_oscap_test_executable(test_oscap_common
"test_oscap_common.c"
${CMAKE_SOURCE_DIR}/src/common/util.c
${CMAKE_SOURCE_DIR}/src/common/list.c
+ ${CMAKE_SOURCE_DIR}/src/common/error.c
+ ${CMAKE_SOURCE_DIR}/src/common/err_queue.c
)
add_oscap_test_executable(test_xccdf_overrides
diff --git a/tests/API/XCCDF/unittests/test_oscap_common.c b/tests/API/XCCDF/unittests/test_oscap_common.c
index 26ff51d48..939ba8750 100644
--- a/tests/API/XCCDF/unittests/test_oscap_common.c
+++ b/tests/API/XCCDF/unittests/test_oscap_common.c
@@ -28,6 +28,7 @@
#include <string.h>
#include "common/list.h"
#include "common/util.h"
+#include "common/_error.h"
#include "oscap_assert.h"
#define SEEN_LEN 9

54
SPECS/openscap.spec
View File

@ -1,32 +1,15 @@
Name: openscap
Version: 1.3.5
Release: 13%{?dist}.alma
Version: 1.3.6
Release: 3%{?dist}.alma
Epoch: 1
Summary: Set of open source libraries enabling integration of the SCAP line of standards
License: LGPLv2+
URL: http://www.open-scap.org/
Source0: https://github.com/OpenSCAP/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
Patch1: openscap-1.3.6-waive-hugetables-pr-1745.patch
Patch2: openscap-1.3.6-replace-getlogin-pr-1753.patch
Patch3: openscap-1.3.6-rpath-pr-1765.patch
Patch4: openscap-1.3.6-ubi9-pr-1772.patch
Patch5: openscap-1.3.6-rpminspect-xml-pr-1773.patch
Patch6: openscap-1.3.6-fix-failing-test-pr-1775.patch
Patch7: openscap-1.3.6-yamlfile-null-pr-1756.patch
Patch8: openscap-1.3.6-coverity-issues-pr-1748.patch
Patch9: openscap-1.3.6-coverity-issues-pr-1778.patch
Patch10: openscap-1.3.6-disable-sha1-md5-pr-1781.patch
Patch11: openscap-1.3.6-http_error_fix-PR_1805.patch
Patch12: openscap-1.3.6-empty-proc-in-offline-pr-1812.patch
Patch13: openscap-1.3.6-initialize-crapi-once-pr-1779.patch
Patch14: openscap-1.3.6-test-rhbz1959570-pr-1788.patch
Patch15: openscap-1.3.6-blueprint-fix-pr-1749.patch
Patch16: openscap-1.3.6-blueprint-toml-pr-1810.patch
Patch17: openscap-1.3.6-local-files-pr-1769.patch
Patch18: openscap-1.3.6-oscap-ssh-local-files-pr-1786.patch
Patch19: openscap-1.3.6-alternative-hostname-pr-1806.patch
Patch20: openscap-1.3.6-memory-limit-pr-1827.patch
Patch21: openscap-1.3.6-warning-local-files-pr-1826.patch
Patch1: openscap-1.3.7-PR-1841-coverity.patch
Patch2: openscap-1.3.7-PR-1843-fix-test-ds-misc.patch
Patch3: openscap-1.3.7-PR-1844-fix-test-ds-misc-2.patch
Patch4: openscap-1.3.7-PR-1846-file-permissions.patch
# Add AlmaLinux definitions
Patch100: openscap-1.3.5-almalinux.patch
@ -169,6 +152,12 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
%ldconfig_scriptlets
# enable oscap-remediate.service here for now
# https://github.com/hughsie/PackageKit/issues/401
# https://bugzilla.redhat.com/show_bug.cgi?id=1833176
mkdir -p %{buildroot}%{_unitdir}/system-update.target.wants/
ln -sf ../oscap-remediate.service %{buildroot}%{_unitdir}/system-update.target.wants/oscap-remediate.service
%files
%doc AUTHORS NEWS README.md
%license COPYING
@ -201,7 +190,12 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
%{_bindir}/oscap
%{_mandir}/man8/oscap-chroot.8.gz
%{_bindir}/oscap-chroot
%{_mandir}/man8/oscap-remediate-offline.8.gz
%{_bindir}/oscap-remediate-offline
%{_sysconfdir}/bash_completion.d
%{_libexecdir}/oscap-remediate
%{_unitdir}/oscap-remediate.service
%{_unitdir}/system-update.target.wants/
%files utils
%doc docs/oscap-scan.cron
@ -221,9 +215,21 @@ pathfix.py -i %{__python3} -p -n $RPM_BUILD_ROOT%{_bindir}/scap-as-rpm
%{_bindir}/oscap-run-sce-script
%changelog
* Wed Jan 19 2022 Eduard Abdullin <eabdullin@almalinux.org> - 1:1.3.5-13.alma
* Fri Apr 08 2022 Eduard Abdullin <eabdullin@almalinux.org> - 1:1.3.6-3.alma
- Add AlmaLinux definitions
* Mon Feb 07 2022 Jan Černý <jcerny@redhat.com> - 1:1.3.6-3
- Prevent file permission errors (rhbz#2048571)
* Mon Jan 31 2022 Jan Černý <jcerny@redhat.com> - 1.3.6-2
- Fix coverity issues
- Prevent fails of test_ds_misc.sh
* Thu Jan 20 2022 Jan Černý <jcerny@redhat.com> - 1:1.3.6-1
- Upgrade to the latest upstream release (rhbz#2041782)
- Select and exclude groups of rules on the command line (rhbz#2020580, rhbz#2020581)
- The boot-time remediation service for systemd's Offline Update mode
* Fri Nov 19 2021 Jan Černý <jcerny@redhat.com> - 1:1.3.5-13
- Print warning for local files