52cb2c7ea6
- Introduce the firstboot remediation to remediate services-related rules correctly - Add better error handling of installation using unsupported installation sources Resolves: rhbz#2042334 Resolves: rhbz#1999587
192 lines
7.3 KiB
Diff
192 lines
7.3 KiB
Diff
From c92205d5a5c788eeac84a6e67956a3e0540ab565 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
|
|
Date: Mon, 3 Jan 2022 17:31:49 +0100
|
|
Subject: [PATCH 1/2] Add oscap sanity check before attempting remediation
|
|
|
|
If something is obviously wrong with the scanner, then don't attempt to remediate
|
|
and try to show relevant information in a dialog window.
|
|
---
|
|
org_fedora_oscap/common.py | 39 +++++++++++++++++++-----
|
|
org_fedora_oscap/service/installation.py | 11 +++++++
|
|
tests/test_common.py | 8 +++++
|
|
tests/test_installation.py | 3 +-
|
|
4 files changed, 52 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/org_fedora_oscap/common.py b/org_fedora_oscap/common.py
|
|
index c432168..eeb27fc 100644
|
|
--- a/org_fedora_oscap/common.py
|
|
+++ b/org_fedora_oscap/common.py
|
|
@@ -171,7 +171,8 @@ def execute(self, ** kwargs):
|
|
proc = subprocess.Popen(self.args, stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE, ** kwargs)
|
|
except OSError as oserr:
|
|
- msg = "Failed to run the oscap tool: %s" % oserr
|
|
+ msg = ("Failed to execute command '{command_string}': {oserr}"
|
|
+ .format(command_string=command_string, oserr=oserr))
|
|
raise OSCAPaddonError(msg)
|
|
|
|
(stdout, stderr) = proc.communicate()
|
|
@@ -247,6 +248,34 @@ def _run_oscap_gen_fix(profile, fpath, template, ds_id="", xccdf_id="",
|
|
return proc.stdout
|
|
|
|
|
|
+def do_chroot(chroot):
|
|
+ """Helper function doing the chroot if requested."""
|
|
+ if chroot and chroot != "/":
|
|
+ os.chroot(chroot)
|
|
+ os.chdir("/")
|
|
+
|
|
+
|
|
+def assert_scanner_works(chroot, executable="oscap"):
|
|
+ args = [executable, "--version"]
|
|
+ command = " ".join(args)
|
|
+
|
|
+ try:
|
|
+ proc = subprocess.Popen(
|
|
+ args, preexec_fn=lambda: do_chroot(chroot),
|
|
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
+ (stdout, stderr) = proc.communicate()
|
|
+ stderr = stderr.decode(errors="replace")
|
|
+ except OSError as exc:
|
|
+ msg = _(f"Basic invocation '{command}' fails: {str(exc)}")
|
|
+ raise OSCAPaddonError(msg)
|
|
+ if proc.returncode != 0:
|
|
+ msg = _(
|
|
+ f"Basic scanner invocation '{command}' exited "
|
|
+ "with non-zero error code {proc.returncode}: {stderr}")
|
|
+ raise OSCAPaddonError(msg)
|
|
+ return True
|
|
+
|
|
+
|
|
def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
|
|
chroot=""):
|
|
"""
|
|
@@ -276,12 +305,6 @@ def run_oscap_remediate(profile, fpath, ds_id="", xccdf_id="", tailoring="",
|
|
if not profile:
|
|
return ""
|
|
|
|
- def do_chroot():
|
|
- """Helper function doing the chroot if requested."""
|
|
- if chroot and chroot != "/":
|
|
- os.chroot(chroot)
|
|
- os.chdir("/")
|
|
-
|
|
# make sure the directory for the results exists
|
|
results_dir = os.path.dirname(RESULTS_PATH)
|
|
if chroot:
|
|
@@ -306,7 +329,7 @@ def do_chroot():
|
|
args.append(fpath)
|
|
|
|
proc = SubprocessLauncher(args)
|
|
- proc.execute(preexec_fn=do_chroot)
|
|
+ proc.execute(preexec_fn=lambda: do_chroot(chroot))
|
|
proc.log_messages()
|
|
|
|
if proc.returncode not in (0, 2):
|
|
diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
|
|
index 2da8559..d909c44 100644
|
|
--- a/org_fedora_oscap/service/installation.py
|
|
+++ b/org_fedora_oscap/service/installation.py
|
|
@@ -239,6 +239,17 @@ def name(self):
|
|
|
|
def run(self):
|
|
"""Run the task."""
|
|
+ try:
|
|
+ common.assert_scanner_works(
|
|
+ chroot=self._sysroot, executable="oscap")
|
|
+ except Exception as exc:
|
|
+ msg_lines = [_(
|
|
+ "The 'oscap' scanner doesn't work in the installed system: {error}"
|
|
+ .format(error=str(exc)))]
|
|
+ msg_lines.append(_("As a result, the installed system can't be hardened."))
|
|
+ terminate("\n".join(msg_lines))
|
|
+ return
|
|
+
|
|
common.run_oscap_remediate(
|
|
self._policy_data.profile_id,
|
|
self._target_content_path,
|
|
diff --git a/tests/test_common.py b/tests/test_common.py
|
|
index 9f7a16a..4f25379 100644
|
|
--- a/tests/test_common.py
|
|
+++ b/tests/test_common.py
|
|
@@ -77,6 +77,14 @@ def _run_oscap(mock_subprocess, additional_args):
|
|
return expected_args, kwargs
|
|
|
|
|
|
+def test_oscap_works():
|
|
+ assert common.assert_scanner_works(chroot="/")
|
|
+ with pytest.raises(common.OSCAPaddonError, match="No such file"):
|
|
+ common.assert_scanner_works(chroot="/", executable="i_dont_exist")
|
|
+ with pytest.raises(common.OSCAPaddonError, match="non-zero"):
|
|
+ common.assert_scanner_works(chroot="/", executable="false")
|
|
+
|
|
+
|
|
def test_run_oscap_remediate_profile_only(mock_subprocess, monkeypatch):
|
|
return run_oscap_remediate_profile(
|
|
mock_subprocess, monkeypatch,
|
|
diff --git a/tests/test_installation.py b/tests/test_installation.py
|
|
index 5749a94..f819c3b 100644
|
|
--- a/tests/test_installation.py
|
|
+++ b/tests/test_installation.py
|
|
@@ -115,4 +115,5 @@ def test_remediate_system_task(sysroot_path, content_path, tailoring_path):
|
|
)
|
|
|
|
assert task.name == "Remediate the system"
|
|
- task.run()
|
|
+ with pytest.raises(installation.NonCriticalInstallationError, match="No such file"):
|
|
+ task.run()
|
|
|
|
From ea2dbf5017445875b1c0e4ee27899c8dde292c98 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com>
|
|
Date: Mon, 3 Jan 2022 17:42:31 +0100
|
|
Subject: [PATCH 2/2] Don't raise exceptions in execute()
|
|
|
|
Those result in tracebacks during the installation,
|
|
while a dialog window presents a more useful form of user interaction.
|
|
---
|
|
org_fedora_oscap/service/installation.py | 27 ++++++++++++++----------
|
|
1 file changed, 16 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/org_fedora_oscap/service/installation.py b/org_fedora_oscap/service/installation.py
|
|
index d909c44..290da40 100644
|
|
--- a/org_fedora_oscap/service/installation.py
|
|
+++ b/org_fedora_oscap/service/installation.py
|
|
@@ -210,9 +210,9 @@ def run(self):
|
|
)
|
|
|
|
if ret != 0:
|
|
- raise common.ExtractionError(
|
|
- "Failed to install content RPM to the target system"
|
|
- )
|
|
+ msg = _(f"Failed to install content RPM to the target system.")
|
|
+ terminate(msg)
|
|
+ return
|
|
else:
|
|
pattern = utils.join_paths(common.INSTALLATION_CONTENT_DIR, "*")
|
|
utils.universal_copy(pattern, target_content_dir)
|
|
@@ -250,11 +250,16 @@ def run(self):
|
|
terminate("\n".join(msg_lines))
|
|
return
|
|
|
|
- common.run_oscap_remediate(
|
|
- self._policy_data.profile_id,
|
|
- self._target_content_path,
|
|
- self._policy_data.datastream_id,
|
|
- self._policy_data.xccdf_id,
|
|
- self._target_tailoring_path,
|
|
- chroot=self._sysroot
|
|
- )
|
|
+ try:
|
|
+ common.run_oscap_remediate(
|
|
+ self._policy_data.profile_id,
|
|
+ self._target_content_path,
|
|
+ self._policy_data.datastream_id,
|
|
+ self._policy_data.xccdf_id,
|
|
+ self._target_tailoring_path,
|
|
+ chroot=self._sysroot
|
|
+ )
|
|
+ except Exception as exc:
|
|
+ msg = _(f"Something went wrong during the final hardening: {str(exc)}.")
|
|
+ terminate(msg)
|
|
+ return
|