-
Notifications
You must be signed in to change notification settings - Fork 378
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Don't hard require /var/lib/rpm
#2151
Comments
To be clear we can add that symlink into bootc images, and maybe we'll need to if we keep finding more issues like this...but again on the flip side you are hardcoding to read from a now deprecated path, which would make sense to stop doing. |
jan-cerny
added a commit
to jan-cerny/openscap
that referenced
this issue
Aug 22, 2024
The assumption that /var/lib/rpm is always a symlink to /usr/lib/sysimage/rpm was wrong. In bootc images, it isn't the case. As a result, all rules were evaluated as notapplicable when scanning a bootc image or container. We will fix it the following way: We will first try if the "new" location /usr/lib/sysimage/rpm exists, and use it only if it exists. If it doesn't exist, we will fall back to the "old" location /var/lib/rpm. Fixes: https://issues.redhat.com/browse/RHEL-55251 Fixes: OpenSCAP#2151
jan-cerny
added a commit
to jan-cerny/openscap
that referenced
this issue
Aug 22, 2024
The assumption that /var/lib/rpm is always a symlink to /usr/lib/sysimage/rpm was wrong. In bootc images, it isn't the case. As a result, all rules were evaluated as notapplicable when scanning a bootc image or container. We will fix it the following way: We will first try if the "new" location /usr/lib/sysimage/rpm exists, and use it only if it exists. If it doesn't exist, we will fall back to the "old" location /var/lib/rpm. Fixes: https://issues.redhat.com/browse/RHEL-55251 Fixes: OpenSCAP#2151
jan-cerny
added a commit
to jan-cerny/openscap
that referenced
this issue
Sep 9, 2024
The assumption that /var/lib/rpm is always a symlink to /usr/lib/sysimage/rpm was wrong. In bootc images, it isn't the case. As a result, all rules were evaluated as notapplicable when scanning a bootc image or container. We will fix it the following way: We will first try if the "new" location /usr/lib/sysimage/rpm exists, and use it only if it exists. If it doesn't exist, we will fall back to the "old" location /var/lib/rpm. Fixes: https://issues.redhat.com/browse/RHEL-55251 Fixes: OpenSCAP#2151
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This code is suboptimal:
openscap/src/OVAL/probes/unix/linux/rpminfo_probe.c
Line 298 in ecf658f
As bootc images won't have that symlink by default because we want
/var
to start out empty as much as possible.In general this kind of "cross OS scanning" is going to get into tricky corner cases. It would seem to be more sustainable to simply fork
/usr/bin/rpm
in the target environment (as a container).Alternatively, please at least check if
/usr/lib/sysimage/rpm
exists and set it as the dbpath first. Or, just try a query with the default config and accept that if it returns content.The text was updated successfully, but these errors were encountered: