From 502d41bf534576e655791b884e8b4daf8c63fb9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 22 Oct 2024 10:06:13 +0200 Subject: [PATCH] Pass OSCAP_BOOTC_BUILD to remediations Starting with this commit, the OSCAP_BOOTC_BUILD environment variable will be passed down to the bash remediation. If this environment variable is set in the caller environment, the Bash remediations will be able to access it and read its value. This will be useful because the bash remediations will be able to contain a condition depending on this variable. Using this feature we can influence the behavior of our Bash remediations in the process of building bootable container images. The `oscap-bootc` utility will export the `OSCAP_BOOTC_BUILD` environment variable and the Bash remeditions will check this variable and for example they will not start systemd services. This commit also adds a small test. --- src/XCCDF_POLICY/xccdf_policy_remediate.c | 12 +++- tests/API/XCCDF/unittests/CMakeLists.txt | 1 + .../test_oscap_bootc_pass_down.ds.xml | 66 +++++++++++++++++++ .../unittests/test_oscap_bootc_pass_down.sh | 31 +++++++++ 4 files changed, 107 insertions(+), 3 deletions(-) create mode 100644 tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml create mode 100755 tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c index 70eb188838..72b8bed34b 100644 --- a/src/XCCDF_POLICY/xccdf_policy_remediate.c +++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c @@ -450,9 +450,9 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_ int fork_result = fork(); if (fork_result >= 0) { - /* fork succeded */ + /* fork succeeded */ if (fork_result == 0) { - /* Execute fix and forward output to the parrent. */ + /* Execute fix and forward output to the parent. */ close(pipefd[0]); dup2(pipefd[1], fileno(stdout)); dup2(pipefd[1], fileno(stderr)); @@ -464,8 +464,14 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_ NULL }; - char *const envp[2] = { + char *oscap_bootc_build = getenv("OSCAP_BOOTC_BUILD"); + char *oscap_bootc_build_kvarg = NULL; + if (oscap_bootc_build != NULL) { + oscap_bootc_build_kvarg = oscap_sprintf("OSCAP_BOOTC_BUILD=%s", oscap_bootc_build); + } + char *const envp[3] = { "PATH=/bin:/sbin:/usr/bin:/usr/sbin", + oscap_bootc_build_kvarg, NULL }; diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt index 164b795e0e..d8c5432e5f 100644 --- a/tests/API/XCCDF/unittests/CMakeLists.txt +++ b/tests/API/XCCDF/unittests/CMakeLists.txt @@ -111,3 +111,4 @@ add_oscap_test("test_no_newline_between_select_elements.sh") add_oscap_test("test_single_line_tailoring.sh") add_oscap_test("test_reference.sh") add_oscap_test("test_remediation_bootc.sh") +add_oscap_test("test_oscap_bootc_pass_down.sh") diff --git a/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml new file mode 100644 index 0000000000..660575d55e --- /dev/null +++ b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml @@ -0,0 +1,66 @@ + + + + + + + + + + + + + + + + + + 5.11.1 + 2009-01-12T10:41:00-05:00 + + + + + FAIL + fail + + + + + + + + + + + + + + oval:x:var:1 + + + + + 100 + + + + + + + accepted + 1.0 + + This rule always fails + + if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then + printf "WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW" + fi + + + + + + + + diff --git a/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh new file mode 100755 index 0000000000..09783de1d3 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bash + +. $builddir/tests/test_common.sh + +set -e -o pipefail + +function test_pass_env_var_down() { + stdout=$(mktemp) + stderr=$(mktemp) + result=$(mktemp) + + OSCAP_BOOTC_BUILD=YES $OSCAP xccdf eval --remediate --results "$result" "$srcdir/test_oscap_bootc_pass_down.ds.xml" > "$stdout" 2> "$stderr" || ret=$? + assert_exists 1 '//rule-result/message[text()="WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW"]' + + rm -rf "$stdout" "$stderr" "$result" +} + +function test_no_env_var() { + stdout=$(mktemp) + stderr=$(mktemp) + result=$(mktemp) + + $OSCAP xccdf eval --remediate --results "$result" "$srcdir/test_oscap_bootc_pass_down.ds.xml" > "$stdout" 2> "$stderr" || ret=$? + assert_exists 0 '//rule-result/message[text()="WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW"]' + + rm -rf "$stdout" "$stderr" "$result" +} + + +test_pass_env_var_down +test_no_env_var