oscap-anaconda-addon/oscap-anaconda-addon-2.0.1-absent_appstream-PR_185.patch

From c92205d5a5c788eeac84a6e67956a3e0540ab565 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Mon, 3 Jan 2022 17:31:49 +0100
Subject: [PATCH 1/2] Add oscap sanity check before attempting remediation

If something is obviously wrong with the scanner, then don't attempt to remediate
and try to show relevant information in a dialog window.
---
 org_fedora_oscap/common.py               | 39 +++++++++++++++++++-----
 org_fedora_oscap/service/installation.py | 11 +++++++
 tests/test_common.py                     |  8 +++++
 tests/test_installation.py               |  3 +-
 4 files changed, 52 insertions(+), 9 deletions(-)

diff --git a/org_fedora_oscap/common.py b/org_fedora_oscap/common.py
index c432168..eeb27fc 100644
--- a/org_fedora_oscap/common.py
+++ b/org_fedora_oscap/common.py
@@ -171,7 +171,8 @@ def execute(self, ** kwargs):
             proc = subprocess.Popen(self.args, stdout=subprocess.PIPE,
                                     stderr=subprocess.PIPE, ** kwargs)
         except OSError as oserr:
-            msg = "Failed to run the oscap tool: %s" % oserr
+            msg = ("Failed to execute command '{command_string}': {oserr}"
+                   .format(command_string=command_string, oserr=oserr))
             raise OSCAPaddonError(msg)
 
         (stdout, stderr) = proc.communicate()
@@ -247,6 +248,34 @@ def _run_oscap_gen_fix(profile, fpath, template, ds_id="", xccdf_id="",
     return proc.stdout
 
 
+def do_chroot(chroot):
+    """Helper function doing the chroot if requested."""
+    if chroot and chroot != "/":
+        os.chroot(chroot)
+        os.chdir("/")
+
+
+def assert_scanner_works(chroot, executable="oscap"):
+    args = [executable, "--version"]
+    command = " ".join(args)
+
+    try:
+        proc = subprocess.Popen(
+            args, preexec_fn=lambda: do_chroot(chroot),
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        (stdout, stderr) = proc.communicate()
+        stderr = stderr.decode(errors="replace")
+    except OSError as exc:
+        msg = _(f"Basic invocation '{command}' fails: {str(exc)}")
+        raise OSCAPaddonError(msg)
+    if proc.returncode != 0:
+        msg = _(
+            f"Basic scanner invocation '{command}' exited "
+            "with non-zero error code {proc.returncode}: {stderr}")
+        raise OSCAPaddonError(msg)
+    return True
+
+
 def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
                         chroot=""):
     """
@@ -276,12 +305,6 @@ def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
     if not profile:
         return ""
 
-    def do_chroot():
-        """Helper function doing the chroot if requested."""
-        if chroot and chroot != "/":
-            os.chroot(chroot)
-            os.chdir("/")
-
     # make sure the directory for the results exists
     results_dir = os.path.dirname(RESULTS_PATH)
     if chroot:
@@ -306,7 +329,7 @@ def do_chroot():
     args.append(fpath)
 
     proc = SubprocessLauncher(args)
-    proc.execute(preexec_fn=do_chroot)
+    proc.execute(preexec_fn=lambda: do_chroot(chroot))
     proc.log_messages()
 
     if proc.returncode not in (0, 2):
diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
index 2da8559..d909c44 100644
--- a/org_fedora_oscap/service/installation.py
+++ b/org_fedora_oscap/service/installation.py
@@ -239,6 +239,17 @@ def name(self):
 
     def run(self):
         """Run the task."""
+        try:
+            common.assert_scanner_works(
+                chroot=self._sysroot, executable="oscap")
+        except Exception as exc:
+            msg_lines = [_(
+                "The 'oscap' scanner doesn't work in the installed system: {error}"
+                .format(error=str(exc)))]
+            msg_lines.append(_("As a result, the installed system can't be hardened."))
+            terminate("\n".join(msg_lines))
+            return
+
         common.run_oscap_remediate(
             self._policy_data.profile_id,
             self._target_content_path,
diff --git a/tests/test_common.py b/tests/test_common.py
index 9f7a16a..4f25379 100644
--- a/tests/test_common.py
+++ b/tests/test_common.py
@@ -77,6 +77,14 @@ def _run_oscap(mock_subprocess, additional_args):
     return expected_args, kwargs
 
 
+def test_oscap_works():
+    assert common.assert_scanner_works(chroot="/")
+    with pytest.raises(common.OSCAPaddonError, match="No such file"):
+        common.assert_scanner_works(chroot="/", executable="i_dont_exist")
+    with pytest.raises(common.OSCAPaddonError, match="non-zero"):
+        common.assert_scanner_works(chroot="/", executable="false")
+
+
 def test_run_oscap_remediate_profile_only(mock_subprocess, monkeypatch):
     return run_oscap_remediate_profile(
         mock_subprocess, monkeypatch,
diff --git a/tests/test_installation.py b/tests/test_installation.py
index 5749a94..f819c3b 100644
--- a/tests/test_installation.py
+++ b/tests/test_installation.py
@@ -115,4 +115,5 @@ def test_remediate_system_task(sysroot_path, content_path, tailoring_path):
     )
 
     assert task.name == "Remediate the system"
-    task.run()
+    with pytest.raises(installation.NonCriticalInstallationError, match="No such file"):
+        task.run()

From ea2dbf5017445875b1c0e4ee27899c8dde292c98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Mon, 3 Jan 2022 17:42:31 +0100
Subject: [PATCH 2/2] Don't raise exceptions in execute()

Those result in tracebacks during the installation,
while a dialog window presents a more useful form of user interaction.
---
 org_fedora_oscap/service/installation.py | 27 ++++++++++++++----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
index d909c44..290da40 100644
--- a/org_fedora_oscap/service/installation.py
+++ b/org_fedora_oscap/service/installation.py
@@ -210,9 +210,9 @@ def run(self):
             )
 
             if ret != 0:
-                raise common.ExtractionError(
-                    "Failed to install content RPM to the target system"
-                )
+                msg = _(f"Failed to install content RPM to the target system.")
+                terminate(msg)
+                return
         else:
             pattern = utils.join_paths(common.INSTALLATION_CONTENT_DIR, "*")
             utils.universal_copy(pattern, target_content_dir)
@@ -250,11 +250,16 @@ def run(self):
             terminate("\n".join(msg_lines))
             return
 
-        common.run_oscap_remediate(
-            self._policy_data.profile_id,
-            self._target_content_path,
-            self._policy_data.datastream_id,
-            self._policy_data.xccdf_id,
-            self._target_tailoring_path,
-            chroot=self._sysroot
-        )
+        try:
+            common.run_oscap_remediate(
+                self._policy_data.profile_id,
+                self._target_content_path,
+                self._policy_data.datastream_id,
+                self._policy_data.xccdf_id,
+                self._target_tailoring_path,
+                chroot=self._sysroot
+            )
+        except Exception as exc:
+            msg = _(f"Something went wrong during the final hardening: {str(exc)}.")
+            terminate(msg)
+            return