57 lines
2.4 KiB
Diff
57 lines
2.4 KiB
Diff
From efd08dd9d8453583f1e801ddb5ac0af65cc86f69 Mon Sep 17 00:00:00 2001
|
|
From: Panu Matilainen <pmatilai@redhat.com>
|
|
Date: Tue, 11 Jun 2019 16:12:57 +0300
|
|
Subject: [PATCH 3/3] Drop bogus VERIFY_SIGNATURE and VERIFY_DIGEST checks
|
|
|
|
VERIFY_SIGNATURE and VERIFY_DIGEST are not independent verification
|
|
checks, these checks are performed internally by rpm and failure in
|
|
either will cause the entire header failing to load. These flags allow
|
|
disabling that verification, but this doesn't make sense for openscap
|
|
and doesn't work this way in rpm >= 4.15 anyway.
|
|
---
|
|
.../probes/unix/linux/rpmverifypackage_probe.c | 14 --------------
|
|
1 file changed, 14 deletions(-)
|
|
|
|
diff --git a/src/OVAL/probes/unix/linux/rpmverifypackage_probe.c b/src/OVAL/probes/unix/linux/rpmverifypackage_probe.c
|
|
index ed6c714d8..06059ae47 100644
|
|
--- a/src/OVAL/probes/unix/linux/rpmverifypackage_probe.c
|
|
+++ b/src/OVAL/probes/unix/linux/rpmverifypackage_probe.c
|
|
@@ -69,9 +69,7 @@ typedef struct {
|
|
|
|
const rpmverifypackage_bhmap_t rpmverifypackage_bhmap[] = {
|
|
{ "nodeps", (uint64_t)VERIFY_DEPS , "--nodeps"},
|
|
- { "nodigest", (uint64_t)VERIFY_DIGEST , "--nodigest"},
|
|
{ "noscripts", (uint64_t)VERIFY_SCRIPT , "--noscript"},
|
|
- { "nosignature", (uint64_t)VERIFY_SIGNATURE , "--nosignature"}
|
|
};
|
|
|
|
struct rpmverify_res {
|
|
@@ -409,24 +407,12 @@ static int rpmverifypackage_additem(probe_ctx *ctx, struct rpmverify_res *res)
|
|
probe_item_ent_add(item, "dependency_check_passed", NULL, value);
|
|
SEXP_free(value);
|
|
}
|
|
- if (res->vflags & VERIFY_DIGEST) {
|
|
- dI("VERIFY_DIGEST %d", res->vresults & VERIFY_DIGEST);
|
|
- value = probe_entval_from_cstr(OVAL_DATATYPE_BOOLEAN, (res->vresults & VERIFY_DIGEST ? "1" : "0"), 1);
|
|
- probe_item_ent_add(item, "digest_check_passed", NULL, value);
|
|
- SEXP_free(value);
|
|
- }
|
|
if (res->vflags & VERIFY_SCRIPT) {
|
|
dI("VERIFY_SCRIPT %d", res->vresults & VERIFY_SCRIPT);
|
|
value = probe_entval_from_cstr(OVAL_DATATYPE_BOOLEAN, (res->vresults & VERIFY_SCRIPT ? "1" : "0"), 1);
|
|
probe_item_ent_add(item, "verification_script_successful", NULL, value);
|
|
SEXP_free(value);
|
|
}
|
|
- if (res->vflags & VERIFY_SIGNATURE) {
|
|
- dI("VERIFY_SIGNATURE %d", res->vresults & VERIFY_SIGNATURE);
|
|
- value = probe_entval_from_cstr(OVAL_DATATYPE_BOOLEAN, (res->vresults & VERIFY_SIGNATURE ? "1" : "0"), 1);
|
|
- probe_item_ent_add(item, "signature_check_passed", NULL, value);
|
|
- SEXP_free(value);
|
|
- }
|
|
|
|
return probe_item_collect(ctx, item) == 2 ? 1 : 0;
|
|
}
|
|
--
|
|
2.22.0
|
|
|