Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oscap-bootc support --fetch-remote-resources #2186

Open
p5 opened this issue Dec 11, 2024 · 0 comments · May be fixed by #2187
Open

oscap-bootc support --fetch-remote-resources #2186

p5 opened this issue Dec 11, 2024 · 0 comments · May be fixed by #2187

Comments

@p5
Copy link

p5 commented Dec 11, 2024

Description of Problem:

Currently there's no way to pass --fetch-remote-resources when calling oscap-bootc. This means a limited number of checks and remediations are ran.

OpenSCAP Version:

Prelease from COPR

Operating System & Version:

AlmaLinux9

Steps to Reproduce:

ARG OS_VERSION=9
FROM quay.io/almalinuxorg/almalinux-bootc:${OS_VERSION}
ARG OS_VERSION

RUN dnf install -y dnf-plugins-core
RUN dnf -y copr enable packit/OpenSCAP-openscap-maint-1.3 centos-stream-${OS_VERSION}-x86_64 && \
	dnf install -y openscap-utils scap-security-guide openscap-engine-sce

RUN oscap-bootc --profile xccdf_org.ssgproject.content_profile_cis --fetch-remote-resources /usr/share/xml/scap/ssg/content/ssg-almalinux${OS_VERSION}-ds.xml

Actual Results:

Expected Results:

Additional Information / Debugging Steps:

I've been trying to implement this functionality myself, and am seeing some very strange behaviour where the code is appearing to be invoked in the wrong order... I know it sounds strange... But I've been banging my head against the wall for hours on this one.

Edit: Ignore this comment. It was me not understanding the code and I guess how Python writes logs.

Current (broken) patch:

diff --git a/utils/oscap-bootc b/utils/oscap-bootc
index 8ac7c17b8..c53a87cdf 100755
--- a/utils/oscap-bootc
+++ b/utils/oscap-bootc
@@ -46,6 +46,9 @@ def parse_args():
         "data_stream", metavar="DATA_STREAM",
         help="Path to a SCAP source data stream, eg. "
         "/usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml")
+    parser.add_argument(
+        "--fetch-remote-resources", action="store_true",
+        help="Fetch remote resources")
     # Unfortunately, we can't add "--rule", "--skip-rule", or "--reference"
     # because the "oscap xccdf generate fix" submodule doesn't support these
     # options.
@@ -87,6 +90,9 @@ def add_common_args(args, cmd):
         ("--tailoring-file", args.tailoring_file),
         ("--tailoring-id", args.tailoring_id)
     ]
+    if args.fetch_remote_resources:
+        print("Fetching remote resources")
+        oal.append(("--fetch-remote-resources", None))
     add_args(oal, cmd)
 
 
@@ -105,6 +111,7 @@ def pre_scan_fix(args):
             "--output", remediation_script.name]
         add_common_args(args, gen_fix_cmd)
         gen_fix_cmd.append(args.data_stream)
+        print("Using command:", gen_fix_cmd)
         subprocess.run(gen_fix_cmd, check=True)
         subprocess.run(["bash", remediation_script.name], check=True)
 
@@ -123,6 +130,7 @@ def scan_and_remediate(args):
 
 
 def main():
+    print("Running oscap-bootc")
     args = parse_args()
     ensure_sce_installed()
     install_sce_dependencies()

Log:

❯ podman build -f Containerfile .
STEP 1/6: FROM quay.io/almalinuxorg/almalinux-bootc:9
STEP 2/6: ARG OS_VERSION
--> Using cache c6161c4ce3807825c5a97ca47d20a11ec907dfc79ef933fa2a0416a8fc5c68bd
--> c6161c4ce380
STEP 3/6: RUN dnf install -y dnf-plugins-core
--> Using cache 59d7ebc4a5d2310035581db27e279bb99a29ad241e5c20f2ce1d059086083c74
--> 59d7ebc4a5d2
STEP 4/6: RUN dnf -y copr enable packit/OpenSCAP-openscap-maint-1.3 centos-stream-${OS_VERSION}-x86_64 &&       dnf install -y openscap-utils scap-security-guide openscap-engine-sce
--> Using cache 1f9ea0d0d69484c5afb00d1855d791163cb747c1acaf246bfe62bebf3e42890c
--> 1f9ea0d0d694
STEP 5/6: COPY files/ /
--> bb4b05a4f649
STEP 6/6: RUN chmod +x /usr/bin/oscap-bootc &&  oscap-bootc --profile xccdf_org.ssgproject.content_profile_cis --fetch-remote-resources /usr/share/xml/scap/ssg/content/ssg-almalinux${OS_VERSION}-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_oval-org.almalinux.alsa-9.xml.bz2' points out to the remote 'https://security.almalinux.org/oval/org.almalinux.alsa-9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://security.almalinux.org/oval/org.almalinux.alsa-9.xml.bz2' file which is referenced from datastream
WARNING: Datastream component 'scap_org.open-scap_cref_oval-org.almalinux.alsa-9.xml.bz2' points out to the remote 'https://security.almalinux.org/oval/org.almalinux.alsa-9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://security.almalinux.org/oval/org.almalinux.alsa-9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./oval-org.almalinux.alsa-9.xml.bz2 file which is referenced from XCCDF content
xccdf_org.ssgproject.content_rule_package_aide_installed:notapplicable
xccdf_org.ssgproject.content_rule_aide_build_database:notapplicable
xccdf_org.ssgproject.content_rule_aide_check_audit_tools:notapplicable
xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking:notapplicable
xccdf_org.ssgproject.content_rule_configure_crypto_policy:fail
(...)
xccdf_org.ssgproject.content_rule_file_owner_sshd_config:notapplicable
xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key:notapplicable
Running oscap-bootc
Fetching remote resources
Generating fix script
Using command: ['oscap', 'xccdf', 'generate', 'fix', '--fix-type', 'bootc', '--output', '/tmp/tmpye4chyy7', '--profile', 'xccdf_org.ssgproject.content_profile_cis', '/usr/share/xml/scap/ssg/content/ssg-almalinux9-ds.xml']
Fetching remote resources
COMMIT
--> 3b7e3d6bfa2d
3b7e3d6bfa2dad3ede39e91509a00409521853631399e6ea5981e7f476f6e22e

I would expect the logs I have added (especially the "Running oscap-bootc") to appear before all other logs, but it's not.

@p5 p5 linked a pull request Dec 11, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant