Skip to content

Commit 97d8831

Browse files
matusmarhefkamatusmarhefka
authored
Merge pull request OpenSCAP#2165 from jan-cerny/prefer_sce2
Allow preferring SCE
2 parents 8c7ef5d + d977ad5 commit 97d8831

File tree

7 files changed

+156
-0
lines changed

7 files changed

+156
-0
lines changed

‎docs/manual/manual.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1658,6 +1658,7 @@ If OpenSCAP is executed with verbosity level INFO or DEVEL their runtime values
16581658
* `OSCAP_PROBE_MEMORY_USAGE_RATIO` - maximum memory usage ratio (used/total) for OpenSCAP probes, default: 0.1
16591659
* `OSCAP_PROBE_MAX_COLLECTED_ITEMS` - maximal count of collected items by OpenSCAP probe for a single OVAL object evaluation
16601660
* `OSCAP_PROBE_IGNORE_PATHS` - Skip given paths during evaluation. If multiple paths should be skipped they need to be separated by a colon. The paths should be absolute canonical paths.
1661+
* `OSCAP_PREFERRED_ENGINE` - Set a preffered check engine for XCCDF rules. If a rule has multiple checks, the checks for the preffered check engine will be used. Allowed values: `SCE`, `OVAL`. If this variable is set to `SCE` and a rule has both SCE and OVAL checks the SCE check will be used. If this variable is set to `OVAL` and a rule has both SCE and OVAL checks the OVAL check will be used. If this environment variable isn't set, the standard XCCDF mechanism will be used for check selection.
16611662

16621663
Also, OpenSCAP uses `libcurl` library which also can be configured using environment variables. See https://curl.se/libcurl/c/libcurl-env.html[the list of libcurl environment variables].
16631664

‎src/SCE/sce_engine.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,7 @@ xccdf_test_result_type_t sce_engine_eval_rule(struct xccdf_policy *policy, const
370370
struct xccdf_check_import_iterator *check_import_it,
371371
void *usr)
372372
{
373+
dI("Executing SCE check '%s'", href);
373374
struct sce_parameters* parameters = (struct sce_parameters*)usr;
374375
const char* xccdf_directory = parameters->xccdf_directory;
375376
bool use_sce_wrapper = false; // use osca-run-sce-script ?

‎src/XCCDF_POLICY/xccdf_policy.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -588,6 +588,16 @@ _xccdf_policy_rule_get_applicable_check(struct xccdf_policy *policy, struct xccd
588588
struct xccdf_check *check = xccdf_check_iterator_next(candidate_it);
589589
if (_xccdf_policy_is_engine_registered(policy, (char *) xccdf_check_get_system(check))) {
590590
result = check;
591+
char *preferred_engine = getenv("OSCAP_PREFERRED_ENGINE");
592+
if (preferred_engine) {
593+
if (strcmp("SCE", preferred_engine) && strcmp("OVAL", preferred_engine)) {
594+
dW("Unknown value of OSCAP_PREFFERED_ENGINE: '%s'. It will be ignored.", preferred_engine);
595+
}
596+
if ((!strcmp("SCE", preferred_engine) && !strcmp("http://open-scap.org/page/SCE", check->system)) ||
597+
(!strcmp("OVAL", preferred_engine) && !strcmp("http://oval.mitre.org/XMLSchema/oval-definitions-5", check->system))) {
598+
break;
599+
}
600+
}
591601
} else if (strcmp("http://oval.mitre.org/XMLSchema/oval-definitions-5", check->system) == 0) {
592602
print_oval_warning = true;
593603
} else if (strcmp("http://scap.nist.gov/schema/ocil/2", check->system) == 0) {

‎src/common/debug.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,7 @@ void oscap_print_env_vars()
311311
"OSCAP_PROBE_MEMORY_USAGE_RATIO",
312312
"OSCAP_PROBE_MAX_COLLECTED_ITEMS",
313313
"OSCAP_PROBE_IGNORE_PATHS",
314+
"OSCAP_PREFERRED_ENGINE",
314315
NULL
315316
};
316317
dI("Using environment variables:");

‎tests/sce/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
if(ENABLE_SCE)
2+
add_oscap_test("test_prefer_sce.sh")
23
if(${PYTHON_VERSION_MAJOR} EQUAL "3")
34
add_oscap_test("test_sce.sh")
45
endif()

‎tests/sce/test_prefer_sce.ds.xml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sce="http://open-scap.org/page/SCE_xccdf_stream" id="scap_org.openscap.www_collection_from_xccdf_test_single_rule.xccdf.xml" schematron-version="1.3" xsi:schemaLocation="http://scap.nist.gov/schema/scap/source/1.2 https://scap.nist.gov/schema/scap/1.3/scap-source-data-stream_1.3.xsd">
3+
<ds:data-stream id="scap_org.openscap.www_datastream_simple" scap-version="1.3" use-case="OTHER">
4+
<ds:checklists>
5+
<ds:component-ref id="scap_org.openscap.www_cref_test_single_rule.xccdf.xml" xlink:href="#scap_org.openscap.www_comp_test_single_rule.xccdf.xml">
6+
<cat:catalog>
7+
<cat:uri name="test_single_rule.oval.xml" uri="#scap_org.openscap.www_cref_test_single_rule.oval.xml"/>
8+
<cat:uri name="fedora/checks/sce/rule_1.sh" uri="#scap_org.openscap.www_cref_fedora-checks-sce-rule_1.sh"/>
9+
</cat:catalog>
10+
</ds:component-ref>
11+
<ds:component-ref id="scap_org.openscap.www_cref_fedora-checks-sce-rule_1.sh" xlink:href="#scap_org.openscap.www_ecomp_fedora-checks-sce-rule_1.sh"/>
12+
</ds:checklists>
13+
<ds:checks>
14+
<ds:component-ref id="scap_org.openscap.www_cref_test_single_rule.oval.xml" xlink:href="#scap_org.openscap.www_comp_test_single_rule.oval.xml"/>
15+
</ds:checks>
16+
</ds:data-stream>
17+
<ds:component id="scap_org.openscap.www_comp_test_single_rule.oval.xml" timestamp="2021-02-01T08:07:06+01:00">
18+
<oval_definitions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd">
19+
<generator>
20+
<oval:schema_version>5.11.2</oval:schema_version>
21+
<oval:timestamp>2021-02-01T08:07:06+01:00</oval:timestamp>
22+
</generator>
23+
<definitions>
24+
<definition class="compliance" id="oval:org.openscap.www:def:1" version="1">
25+
<metadata>
26+
<title>OVAL check for rule 1</title>
27+
<description>pass</description>
28+
</metadata>
29+
<criteria>
30+
<criterion comment="PASS test" test_ref="oval:org.openscap.www:tst:1"/>
31+
</criteria>
32+
</definition>
33+
</definitions>
34+
<tests>
35+
<variable_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:org.openscap.www:tst:1" check="all" comment="always pass" version="1">
36+
<object object_ref="oval:org.openscap.www:obj:1"/>
37+
</variable_test>
38+
</tests>
39+
<objects>
40+
<variable_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:org.openscap.www:obj:1" version="1" comment="x">
41+
<var_ref>oval:org.openscap.www:var:1</var_ref>
42+
</variable_object>
43+
</objects>
44+
<variables>
45+
<constant_variable id="oval:org.openscap.www:var:1" version="1" comment="x" datatype="int">
46+
<value>100</value>
47+
</constant_variable>
48+
</variables>
49+
</oval_definitions>
50+
</ds:component>
51+
<ds:component id="scap_org.openscap.www_comp_test_single_rule.xccdf.xml" timestamp="2021-02-01T08:07:06+01:00">
52+
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.openscap.www_benchmark_test">
53+
<status>accepted</status>
54+
<version>1.0</version>
55+
<Profile id="xccdf_org.openscap.www_profile_common">
56+
<title>Common hardening profile</title>
57+
<description>This is a very cool profile</description>
58+
<select idref="xccdf_org.openscap.www_rule_1" selected="true"/>
59+
</Profile>
60+
<Rule selected="false" id="xccdf_org.openscap.www_rule_1">
61+
<title>Rule 1: Enable Audit Service</title>
62+
<check system="http://open-scap.org/page/SCE">
63+
<check-import import-name="stdout"/>
64+
<check-content-ref href="fedora/checks/sce/rule_1.sh"/>
65+
</check>
66+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
67+
<check-content-ref href="test_single_rule.oval.xml" name="oval:org.openscap.www:def:1"/>
68+
</check>
69+
</Rule>
70+
</Benchmark>
71+
</ds:component>
72+
<ds:extended-component id="scap_org.openscap.www_ecomp_fedora-checks-sce-rule_1.sh" timestamp="2024-10-09T18:03:34">
73+
<sce:script>#!/bin/bash
74+
echo "Hello how are you"
75+
exit "$XCCDF_RESULT_FAIL"
76+
</sce:script>
77+
</ds:extended-component>
78+
</ds:data-stream-collection>

‎tests/sce/test_prefer_sce.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/usr/bin/env bash
2+
3+
. $builddir/tests/test_common.sh
4+
5+
set -e -o pipefail
6+
7+
8+
function test_prefer_sce_on () {
9+
stdout=$(mktemp)
10+
stderr=$(mktemp)
11+
arf=$(mktemp)
12+
13+
OSCAP_PREFERRED_ENGINE="SCE" $OSCAP xccdf eval --verbose INFO --progress --profile common --results-arf "$arf" > "$stdout" 2> "$stderr" "$srcdir/test_prefer_sce.ds.xml" || ret="$?"
14+
grep -q "xccdf_org.openscap.www_rule_1:fail" "$stdout"
15+
! grep -q "I: oscap: Evaluating definition 'oval:org.openscap.www:def:1': OVAL check for rule 1." "$stderr"
16+
grep -q "I: oscap: Executing SCE check 'fedora/checks/sce/rule_1.sh'" "$stderr"
17+
18+
rm -rf "$stdout" "$stderr" "$arf"
19+
}
20+
21+
test_prefer_sce_off () {
22+
stdout=$(mktemp)
23+
stderr=$(mktemp)
24+
arf=$(mktemp)
25+
26+
$OSCAP xccdf eval --verbose INFO --progress --profile common --results-arf "$arf" > "$stdout" 2> "$stderr" "$srcdir/test_prefer_sce.ds.xml" || ret="$?"
27+
grep -q "xccdf_org.openscap.www_rule_1:pass" "$stdout"
28+
grep -q "I: oscap: Evaluating definition 'oval:org.openscap.www:def:1': OVAL check for rule 1." "$stderr"
29+
! grep -q "I: oscap: Executing SCE check 'fedora/checks/sce/rule_1.sh'" "$stderr"
30+
31+
rm -rf "$stdout" "$stderr" "$arf"
32+
}
33+
34+
test_prefer_oval_explicit () {
35+
stdout=$(mktemp)
36+
stderr=$(mktemp)
37+
arf=$(mktemp)
38+
39+
OSCAP_PREFERRED_ENGINE="OVAL" $OSCAP xccdf eval --verbose INFO --progress --profile common --results-arf "$arf" > "$stdout" 2> "$stderr" "$srcdir/test_prefer_sce.ds.xml" || ret="$?"
40+
grep -q "xccdf_org.openscap.www_rule_1:pass" "$stdout"
41+
grep -q "I: oscap: Evaluating definition 'oval:org.openscap.www:def:1': OVAL check for rule 1." "$stderr"
42+
! grep -q "I: oscap: Executing SCE check 'fedora/checks/sce/rule_1.sh'" "$stderr"
43+
44+
rm -rf "$stdout" "$stderr" "$arf"
45+
}
46+
47+
test_invalid_envi_variable () {
48+
stdout=$(mktemp)
49+
stderr=$(mktemp)
50+
arf=$(mktemp)
51+
52+
OSCAP_PREFERRED_ENGINE="FOOBARVIM" $OSCAP xccdf eval --verbose INFO --progress --profile common --results-arf "$arf" > "$stdout" 2> "$stderr" "$srcdir/test_prefer_sce.ds.xml" || ret="$?"
53+
grep -q "Unknown value of OSCAP_PREFFERED_ENGINE: 'FOOBARVIM'. It will be ignored." "$stderr"
54+
grep -q "xccdf_org.openscap.www_rule_1:pass" "$stdout"
55+
grep -q "I: oscap: Evaluating definition 'oval:org.openscap.www:def:1': OVAL check for rule 1." "$stderr"
56+
! grep -q "I: oscap: Executing SCE check 'fedora/checks/sce/rule_1.sh'" "$stderr"
57+
58+
rm -rf "$stdout" "$stderr" "$arf"
59+
}
60+
61+
test_prefer_sce_on
62+
test_prefer_sce_off
63+
test_prefer_oval_explicit
64+
test_invalid_envi_variable

0 commit comments

Comments
 (0)