rpms/oscap-anaconda-addon
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import oscap-anaconda-addon-2.0.0-12.el9

Browse Source
This commit is contained in:
CentOS Sources 2022-09-27 08:04:21 -04:00 committed by Stepan Oksanichenko
parent 1fa882dd81
commit 388d3006cd
4 changed files with 7010 additions and 276 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7000
SOURCES/lang.patch
View File

File diff suppressed because it is too large Load Diff

191
SOURCES/oscap-anaconda-addon-2.0.1-absent_appstream-PR_185.patch Normal file
View File

@ -0,0 +1,191 @@
From c92205d5a5c788eeac84a6e67956a3e0540ab565 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Mon, 3 Jan 2022 17:31:49 +0100
Subject: [PATCH 1/2] Add oscap sanity check before attempting remediation
If something is obviously wrong with the scanner, then don't attempt to remediate
and try to show relevant information in a dialog window.
---
org_fedora_oscap/common.py | 39 +++++++++++++++++++-----
org_fedora_oscap/service/installation.py | 11 +++++++
tests/test_common.py | 8 +++++
tests/test_installation.py | 3 +-
4 files changed, 52 insertions(+), 9 deletions(-)
diff --git a/org_fedora_oscap/common.py b/org_fedora_oscap/common.py
index c432168..eeb27fc 100644
--- a/org_fedora_oscap/common.py
+++ b/org_fedora_oscap/common.py
@@ -171,7 +171,8 @@ def execute(self, ** kwargs):
proc = subprocess.Popen(self.args, stdout=subprocess.PIPE,
stderr=subprocess.PIPE, ** kwargs)
except OSError as oserr:
- msg = "Failed to run the oscap tool: %s" % oserr
+ msg = ("Failed to execute command '{command_string}': {oserr}"
+ .format(command_string=command_string, oserr=oserr))
raise OSCAPaddonError(msg)
(stdout, stderr) = proc.communicate()
@@ -247,6 +248,34 @@ def _run_oscap_gen_fix(profile, fpath, template, ds_id="", xccdf_id="",
return proc.stdout
+def do_chroot(chroot):
+ """Helper function doing the chroot if requested."""
+ if chroot and chroot != "/":
+ os.chroot(chroot)
+ os.chdir("/")
+
+
+def assert_scanner_works(chroot, executable="oscap"):
+ args = [executable, "--version"]
+ command = " ".join(args)
+
+ try:
+ proc = subprocess.Popen(
+ args, preexec_fn=lambda: do_chroot(chroot),
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+ (stdout, stderr) = proc.communicate()
+ stderr = stderr.decode(errors="replace")
+ except OSError as exc:
+ msg = _(f"Basic invocation '{command}' fails: {str(exc)}")
+ raise OSCAPaddonError(msg)
+ if proc.returncode != 0:
+ msg = _(
+ f"Basic scanner invocation '{command}' exited "
+ "with non-zero error code {proc.returncode}: {stderr}")
+ raise OSCAPaddonError(msg)
+ return True
+
+
def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
chroot=""):
"""
@@ -276,12 +305,6 @@ def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
if not profile:
return ""
- def do_chroot():
- """Helper function doing the chroot if requested."""
- if chroot and chroot != "/":
- os.chroot(chroot)
- os.chdir("/")
-
# make sure the directory for the results exists
results_dir = os.path.dirname(RESULTS_PATH)
if chroot:
@@ -306,7 +329,7 @@ def do_chroot():
args.append(fpath)
proc = SubprocessLauncher(args)
- proc.execute(preexec_fn=do_chroot)
+ proc.execute(preexec_fn=lambda: do_chroot(chroot))
proc.log_messages()
if proc.returncode not in (0, 2):
diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
index 2da8559..d909c44 100644
--- a/org_fedora_oscap/service/installation.py
+++ b/org_fedora_oscap/service/installation.py
@@ -239,6 +239,17 @@ def name(self):
def run(self):
"""Run the task."""
+ try:
+ common.assert_scanner_works(
+ chroot=self._sysroot, executable="oscap")
+ except Exception as exc:
+ msg_lines = [_(
+ "The 'oscap' scanner doesn't work in the installed system: {error}"
+ .format(error=str(exc)))]
+ msg_lines.append(_("As a result, the installed system can't be hardened."))
+ terminate("\n".join(msg_lines))
+ return
+
common.run_oscap_remediate(
self._policy_data.profile_id,
self._target_content_path,
diff --git a/tests/test_common.py b/tests/test_common.py
index 9f7a16a..4f25379 100644
--- a/tests/test_common.py
+++ b/tests/test_common.py
@@ -77,6 +77,14 @@ def _run_oscap(mock_subprocess, additional_args):
return expected_args, kwargs
+def test_oscap_works():
+ assert common.assert_scanner_works(chroot="/")
+ with pytest.raises(common.OSCAPaddonError, match="No such file"):
+ common.assert_scanner_works(chroot="/", executable="i_dont_exist")
+ with pytest.raises(common.OSCAPaddonError, match="non-zero"):
+ common.assert_scanner_works(chroot="/", executable="false")
+
+
def test_run_oscap_remediate_profile_only(mock_subprocess, monkeypatch):
return run_oscap_remediate_profile(
mock_subprocess, monkeypatch,
diff --git a/tests/test_installation.py b/tests/test_installation.py
index 5749a94..f819c3b 100644
--- a/tests/test_installation.py
+++ b/tests/test_installation.py
@@ -115,4 +115,5 @@ def test_remediate_system_task(sysroot_path, content_path, tailoring_path):
)
assert task.name == "Remediate the system"
- task.run()
+ with pytest.raises(installation.NonCriticalInstallationError, match="No such file"):
+ task.run()
From ea2dbf5017445875b1c0e4ee27899c8dde292c98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
Date: Mon, 3 Jan 2022 17:42:31 +0100
Subject: [PATCH 2/2] Don't raise exceptions in execute()
Those result in tracebacks during the installation,
while a dialog window presents a more useful form of user interaction.
---
org_fedora_oscap/service/installation.py | 27 ++++++++++++++----------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
index d909c44..290da40 100644
--- a/org_fedora_oscap/service/installation.py
+++ b/org_fedora_oscap/service/installation.py
@@ -210,9 +210,9 @@ def run(self):
)
if ret != 0:
- raise common.ExtractionError(
- "Failed to install content RPM to the target system"
- )
+ msg = _(f"Failed to install content RPM to the target system.")
+ terminate(msg)
+ return
else:
pattern = utils.join_paths(common.INSTALLATION_CONTENT_DIR, "*")
utils.universal_copy(pattern, target_content_dir)
@@ -250,11 +250,16 @@ def run(self):
terminate("\n".join(msg_lines))
return
- common.run_oscap_remediate(
- self._policy_data.profile_id,
- self._target_content_path,
- self._policy_data.datastream_id,
- self._policy_data.xccdf_id,
- self._target_tailoring_path,
- chroot=self._sysroot
- )
+ try:
+ common.run_oscap_remediate(
+ self._policy_data.profile_id,
+ self._target_content_path,
+ self._policy_data.datastream_id,
+ self._policy_data.xccdf_id,
+ self._target_tailoring_path,
+ chroot=self._sysroot
+ )
+ except Exception as exc:
+ msg = _(f"Something went wrong during the final hardening: {str(exc)}.")
+ terminate(msg)
+ return

72
SOURCES/oscap-anaconda-addon-2.0.1-fix_strings-PR_207.patch Normal file
View File

@ -0,0 +1,72 @@
From 1b96504a8bbc198cce11647a0c3a65e1a3ffaba1 Mon Sep 17 00:00:00 2001
From: Matej Tyc <matyc@redhat.com>
Date: Fri, 13 May 2022 14:44:45 +0200
Subject: [PATCH] Fix strings for translations
The input of the _() function has to be a static string,
and it was in those cases a formatted one,
which didn't match the translation data.
---
org_fedora_oscap/rule_handling.py | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/org_fedora_oscap/rule_handling.py b/org_fedora_oscap/rule_handling.py
index 244aac8..635446e 100644
--- a/org_fedora_oscap/rule_handling.py
+++ b/org_fedora_oscap/rule_handling.py
@@ -707,10 +707,11 @@ def eval_rules(self, ksdata, storage, report_only=False):
messages = []
packages_data = get_packages_data()
+ msg_installed_template = _(
+ "package '%s' has been added to the list of to be installed packages")
# add messages for the already added packages
for pkg in self._added_pkgs:
- msg = _("package '%s' has been added to the list of to be installed "
- "packages" % pkg)
+ msg = msg_installed_template % pkg
messages.append(RuleMessage(self.__class__,
common.MESSAGE_TYPE_INFO, msg))
@@ -724,11 +725,12 @@ def eval_rules(self, ksdata, storage, report_only=False):
self._added_pkgs.add(pkg)
packages_data.packages.append(pkg)
- msg = _("package '%s' has been added to the list of to be installed "
- "packages" % pkg)
+ msg = msg_installed_template % pkg
messages.append(RuleMessage(self.__class__,
common.MESSAGE_TYPE_INFO, msg))
+ msg_excluded_template = _(
+ "package '%s' has been added to the list of excluded packages")
# now do the same for the packages that should be excluded
# add messages for the already excluded packages
for pkg in self._removed_pkgs:
@@ -736,13 +738,12 @@ def eval_rules(self, ksdata, storage, report_only=False):
msg = _(
"package '{package}' has been added to the list "
"of excluded packages, but it can't be removed "
- "from the current software selection without breaking the installation."
- .format(package=pkg))
+ "from the current software selection without breaking the installation.")
+ msg = msg.format(package=pkg)
messages.append(RuleMessage(self.__class__,
common.MESSAGE_TYPE_FATAL, msg))
else:
- msg = _("package '%s' has been added to the list of excluded "
- "packages" % pkg)
+ msg = msg_excluded_template % pkg
messages.append(RuleMessage(self.__class__,
common.MESSAGE_TYPE_INFO, msg))
@@ -756,8 +757,7 @@ def eval_rules(self, ksdata, storage, report_only=False):
self._removed_pkgs.add(pkg)
packages_data.excluded_packages.append(pkg)
- msg = _("package '%s' has been added to the list of excluded "
- "packages" % pkg)
+ msg = msg_excluded_template % pkg
messages.append(RuleMessage(self.__class__,
common.MESSAGE_TYPE_INFO, msg))

23
SPECS/oscap-anaconda-addon.spec
View File

@ -10,7 +10,7 @@
Name: oscap-anaconda-addon
Version: 2.0.0
Release: 8%{?dist}
Release: 12%{?dist}
Summary: Anaconda addon integrating OpenSCAP to the installation process
License: GPLv2+
@ -28,6 +28,8 @@ Patch5: oscap-anaconda-addon-2.0.1-fix_fingerprint-PR_177.patch
Patch6: oscap-anaconda-addon-2.0.1-rhel9_tailoring_fix-PR_180.patch
Patch7: oscap-anaconda-addon-1.2.2-dbus_show_integration-PR_182.patch
Patch8: oscap-anaconda-addon-2.1.0-unified_help-PR_192.patch
Patch9: oscap-anaconda-addon-2.0.1-absent_appstream-PR_185.patch
Patch10: oscap-anaconda-addon-2.0.1-fix_strings-PR_207.patch
BuildArch: noarch
BuildRequires: make
@ -67,6 +69,25 @@ make install DESTDIR=%{buildroot}
%doc COPYING ChangeLog README.md
%changelog
* Fri Jun 10 2022 Matej Tyc <matyc@redhat.com> - 2.0.0-12
- Remove the firstboot remediation feature completely.
We can't have it, while maintaining the standard UX.
Resolves: rhbz#2065751
* Wed Jun 01 2022 Matej Tyc <matyc@redhat.com> - 2.0.0-11
- Remove the redundant dependency on oscap-utils
Resolves: rhbz#2086822
* Wed May 18 2022 Matej Tyc <matyc@redhat.com> - 2.0.0-10
- Fix strings, so they are translatable, and update translations
Resolves: rhbz#2081268
* Mon Mar 21 2022 Matej Tyc <matyc@redhat.com> - 2.0.0-9
- Introduce the firstboot remediation
Resolves: rhbz#1999587
- Add better error handling of installation using unsupported installation sources
Resolves: rhbz#2042334
* Mon Jan 24 2022 Matej Tyc <matyc@redhat.com> - 2.0.0-8
- Introduce unified help support
Resolves: rhbz#2043512