From 66468fdb682307066461332ed0a754f3275f141c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 22 Oct 2024 10:06:13 +0200 Subject: [PATCH] Pass OSCAP_BOOTC_BUILD to remediations Starting with this commit, the OSCAP_BOOTC_BUILD environment variable will be passed down to the bash remediation. If this environment variable is set in the caller environment, the Bash remediations will be able to access it and read its value. This will be useful because the bash remediations will be able to contain a condition depending on this variable. Using this feature we can influence the behavior of our Bash remediations in the process of building bootable container images. The `oscap-bootc` utility will export the `OSCAP_BOOTC_BUILD` environment variable and the Bash remeditions will check this variable and for example they will not start systemd services. This commit also adds a small test. --- src/XCCDF_POLICY/xccdf_policy_remediate.c | 12 +++- tests/API/XCCDF/unittests/CMakeLists.txt | 1 + .../test_oscap_bootc_pass_down.ds.xml | 66 +++++++++++++++++++ .../unittests/test_oscap_bootc_pass_down.sh | 31 +++++++++ 4 files changed, 107 insertions(+), 3 deletions(-) create mode 100644 tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml create mode 100755 tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh diff --git a/src/XCCDF_POLICY/xccdf_policy_remediate.c b/src/XCCDF_POLICY/xccdf_policy_remediate.c index 8c2aaf98c9..bf5a51f509 100644 --- a/src/XCCDF_POLICY/xccdf_policy_remediate.c +++ b/src/XCCDF_POLICY/xccdf_policy_remediate.c @@ -445,9 +445,9 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_ int fork_result = fork(); if (fork_result >= 0) { - /* fork succeded */ + /* fork succeeded */ if (fork_result == 0) { - /* Execute fix and forward output to the parrent. */ + /* Execute fix and forward output to the parent. */ close(pipefd[0]); dup2(pipefd[1], fileno(stdout)); dup2(pipefd[1], fileno(stderr)); @@ -459,8 +459,14 @@ static inline int _xccdf_fix_execute(struct xccdf_rule_result *rr, struct xccdf_ NULL }; - char *const envp[2] = { + char *oscap_bootc_build = getenv("OSCAP_BOOTC_BUILD"); + char *oscap_bootc_build_kvarg = NULL; + if (oscap_bootc_build != NULL) { + oscap_bootc_build_kvarg = oscap_sprintf("OSCAP_BOOTC_BUILD=%s", oscap_bootc_build); + } + char *const envp[3] = { "PATH=/bin:/sbin:/usr/bin:/usr/sbin", + oscap_bootc_build_kvarg, NULL }; diff --git a/tests/API/XCCDF/unittests/CMakeLists.txt b/tests/API/XCCDF/unittests/CMakeLists.txt index 7a9b3b452c..865f5c18ae 100644 --- a/tests/API/XCCDF/unittests/CMakeLists.txt +++ b/tests/API/XCCDF/unittests/CMakeLists.txt @@ -110,3 +110,4 @@ add_oscap_test("test_skip_rule.sh") add_oscap_test("test_no_newline_between_select_elements.sh") add_oscap_test("test_single_line_tailoring.sh") add_oscap_test("test_reference.sh") +add_oscap_test("test_oscap_bootc_pass_down.sh") diff --git a/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml new file mode 100644 index 0000000000..660575d55e --- /dev/null +++ b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.ds.xml @@ -0,0 +1,66 @@ + + + + + + + + + + + + + + + + + + 5.11.1 + 2009-01-12T10:41:00-05:00 + + + + + FAIL + fail + + + + + + + + + + + + + + oval:x:var:1 + + + + + 100 + + + + + + + accepted + 1.0 + + This rule always fails + + if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]] ; then + printf "WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW" + fi + + + + + + + + diff --git a/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh new file mode 100755 index 0000000000..09783de1d3 --- /dev/null +++ b/tests/API/XCCDF/unittests/test_oscap_bootc_pass_down.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bash + +. $builddir/tests/test_common.sh + +set -e -o pipefail + +function test_pass_env_var_down() { + stdout=$(mktemp) + stderr=$(mktemp) + result=$(mktemp) + + OSCAP_BOOTC_BUILD=YES $OSCAP xccdf eval --remediate --results "$result" "$srcdir/test_oscap_bootc_pass_down.ds.xml" > "$stdout" 2> "$stderr" || ret=$? + assert_exists 1 '//rule-result/message[text()="WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW"]' + + rm -rf "$stdout" "$stderr" "$result" +} + +function test_no_env_var() { + stdout=$(mktemp) + stderr=$(mktemp) + result=$(mktemp) + + $OSCAP xccdf eval --remediate --results "$result" "$srcdir/test_oscap_bootc_pass_down.ds.xml" > "$stdout" 2> "$stderr" || ret=$? + assert_exists 0 '//rule-result/message[text()="WE ARE BUILDING BOOTABLE CONTAINER IMAGE NOW"]' + + rm -rf "$stdout" "$stderr" "$result" +} + + +test_pass_env_var_down +test_no_env_var