adamwill / rpms / openscap

Forked from rpms/openscap 3 years ago
Clone

Blame SOURCES/openscap-1.3.4-fix-no-more-recursion.patch

d48c07
From c8fc880a672afbfdbd384dc6afa4b7fbdd666b73 Mon Sep 17 00:00:00 2001
d48c07
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
d48c07
Date: Wed, 27 May 2020 10:38:56 +0200
d48c07
Subject: [PATCH 1/3] Add a regression test for RHBZ#1686370
d48c07
d48c07
There is a non-optimal behavior of file probe. It happens when file path
d48c07
is specified using a variable with 2 values with `operation="equals"`
d48c07
and `var_check="all"`. The probe recurses into a file system tree even
d48c07
if it's obvious that it won't find any match. If one of values is a big
d48c07
tree (for example `/`) it eventually runs out of memory and crashes. The
d48c07
OVAL doesn't make sense because it's impossible that a single file would
d48c07
have 2 different paths. But despite that it's a valid OVAL document.
d48c07
The test is expected to fail because the bug hasn't been fixed.
d48c07
---
d48c07
 tests/probes/file/CMakeLists.txt              |  1 +
d48c07
 .../test_probes_file_multiple_file_paths.sh   | 39 +++++++++++++++++
d48c07
 .../test_probes_file_multiple_file_paths.xml  | 42 +++++++++++++++++++
d48c07
 3 files changed, 82 insertions(+)
d48c07
 create mode 100755 tests/probes/file/test_probes_file_multiple_file_paths.sh
d48c07
 create mode 100644 tests/probes/file/test_probes_file_multiple_file_paths.xml
d48c07
d48c07
diff --git a/tests/probes/file/CMakeLists.txt b/tests/probes/file/CMakeLists.txt
d48c07
index 12718603f..35b4c1169 100644
d48c07
--- a/tests/probes/file/CMakeLists.txt
d48c07
+++ b/tests/probes/file/CMakeLists.txt
d48c07
@@ -1,3 +1,4 @@
d48c07
 if(ENABLE_PROBES_UNIX)
d48c07
 	add_oscap_test("test_probes_file.sh")
d48c07
+	add_oscap_test("test_probes_file_multiple_file_paths.sh")
d48c07
 endif()
d48c07
diff --git a/tests/probes/file/test_probes_file_multiple_file_paths.sh b/tests/probes/file/test_probes_file_multiple_file_paths.sh
d48c07
new file mode 100755
d48c07
index 000000000..1cececbb0
d48c07
--- /dev/null
d48c07
+++ b/tests/probes/file/test_probes_file_multiple_file_paths.sh
d48c07
@@ -0,0 +1,39 @@
d48c07
+#!/bin/bash
d48c07
+
d48c07
+set -e -o pipefail
d48c07
+
d48c07
+. $builddir/tests/test_common.sh
d48c07
+
d48c07
+probecheck "file" || exit 255
d48c07
+which strace || exit 255
d48c07
+
d48c07
+function check_strace_output {
d48c07
+	strace_log="$1"
d48c07
+	grep -q "/tmp/numbers/1" $strace_log && return 1
d48c07
+	grep -q "/tmp/numbers/1/2" $strace_log && return 1
d48c07
+	grep -q "/tmp/numbers/1/2/3" $strace_log && return 1
d48c07
+	grep -q "/tmp/numbers/1/2/3/4" $strace_log && return 1
d48c07
+	grep -q "/tmp/numbers/1/2/3/4/5" $strace_log && return 1
d48c07
+	grep -q "/tmp/numbers/1/2/3/4/5/6" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a/b" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a/b/c" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a/b/c/d" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a/b/c/d/e" $strace_log && return 1
d48c07
+	grep -q "/tmp/letters/a/b/c/d/e/f" $strace_log && return 1
d48c07
+	return 0
d48c07
+}
d48c07
+
d48c07
+rm -rf /tmp/numbers
d48c07
+mkdir -p /tmp/numbers/1/2/3/4/5/6
d48c07
+rm -rf /tmp/letters
d48c07
+mkdir -p /tmp/letters/a/b/c/d/e/f
d48c07
+strace_log=$(mktemp)
d48c07
+strace -f -e openat -o $strace_log $OSCAP oval eval --results results.xml "$srcdir/test_probes_file_multiple_file_paths.xml"
d48c07
+ret=0
d48c07
+check_strace_output $strace_log || ret=$?
d48c07
+rm -f $strace_log
d48c07
+rm -f results.xml
d48c07
+rm -rf /tmp/numbers
d48c07
+rm -rf /tmp/letters
d48c07
+exit $ret
d48c07
diff --git a/tests/probes/file/test_probes_file_multiple_file_paths.xml b/tests/probes/file/test_probes_file_multiple_file_paths.xml
d48c07
new file mode 100644
d48c07
index 000000000..893a3fe97
d48c07
--- /dev/null
d48c07
+++ b/tests/probes/file/test_probes_file_multiple_file_paths.xml
d48c07
@@ -0,0 +1,42 @@
d48c07
+
d48c07
+<oval_definitions xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
d48c07
+  <generator>
d48c07
+    <oval:schema_version>5.10</oval:schema_version>
d48c07
+    <oval:timestamp>0001-01-01T00:00:00+00:00</oval:timestamp>
d48c07
+  </generator>
d48c07
+
d48c07
+  <definitions>
d48c07
+    <definition class="compliance" version="1" id="oval:x:def:1">
d48c07
+      <metadata>
d48c07
+        <title>Specify a file path using variable with two values</title>
d48c07
+        <description>x</description>
d48c07
+        <affected family="unix">
d48c07
+          <platform>multi_platform_all</platform>
d48c07
+        </affected>
d48c07
+      </metadata>
d48c07
+          <criteria operator="AND">
d48c07
+            <criterion comment="Check multiple paths" test_ref="oval:x:tst:1"/>
d48c07
+          </criteria>
d48c07
+    </definition>
d48c07
+  </definitions>
d48c07
+
d48c07
+  <tests>
d48c07
+        <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:x:tst:1" version="1" comment="Verify all paths exist" check_existence="all_exist" check="all">
d48c07
+          <object object_ref="oval:x:obj:1"/>
d48c07
+        </file_test>
d48c07
+  </tests>
d48c07
+
d48c07
+  <objects>
d48c07
+        <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:x:obj:1" version="1" comment="uses var_check=all together with operation=equals">
d48c07
+          <path datatype="string" var_ref="oval:x:var:1" var_check="all" operation="equals"/>
d48c07
+          <filename xsi:nil="true" datatype="string"/>
d48c07
+        </file_object>
d48c07
+  </objects>
d48c07
+
d48c07
+  <variables>
d48c07
+        <constant_variable datatype="string" comment="2 file paths" version="1" id="oval:x:var:1">
d48c07
+            <value>/tmp/numbers</value>
d48c07
+            <value>/tmp/letters</value>
d48c07
+        </constant_variable>
d48c07
+  </variables>
d48c07
+</oval_definitions>
d48c07
d48c07
From 569e0013ca83adef233ddecc78a052db9b3ccc5c Mon Sep 17 00:00:00 2001
d48c07
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
d48c07
Date: Tue, 2 Jun 2020 15:11:37 +0200
d48c07
Subject: [PATCH 2/3] Add strace to the list of test dependencies
d48c07
d48c07
---
d48c07
 docs/developer/developer.adoc | 2 +-
d48c07
 1 file changed, 1 insertion(+), 1 deletion(-)
d48c07
d48c07
diff --git a/docs/developer/developer.adoc b/docs/developer/developer.adoc
d48c07
index 823a1504e..0f01ace74 100644
d48c07
--- a/docs/developer/developer.adoc
d48c07
+++ b/docs/developer/developer.adoc
d48c07
@@ -152,7 +152,7 @@ After building the library you might want to run library self-checks. To do
d48c07
 that you need to have these additional packages installed:
d48c07
 
d48c07
 ----
d48c07
-wget lua which procps-ng initscripts chkconfig sendmail bzip2 rpm-build
d48c07
+wget lua which procps-ng initscripts chkconfig sendmail bzip2 rpm-build strace
d48c07
 ----
d48c07
 
d48c07
 On Ubuntu 18.04, also install:
d48c07
d48c07
From a47604bf30c6574e570abde4fd01488ba120f82d Mon Sep 17 00:00:00 2001
d48c07
From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>
d48c07
Date: Wed, 17 Jun 2020 11:00:02 +0200
d48c07
Subject: [PATCH 3/3] Terminate matching to prevent recursion
d48c07
d48c07
Fixes: RHBZ#1686370
d48c07
---
d48c07
 src/OVAL/probes/oval_fts.c | 9 +++++++++
d48c07
 1 file changed, 9 insertions(+)
d48c07
d48c07
diff --git a/src/OVAL/probes/oval_fts.c b/src/OVAL/probes/oval_fts.c
d48c07
index 696997942..2b7314c38 100644
d48c07
--- a/src/OVAL/probes/oval_fts.c
d48c07
+++ b/src/OVAL/probes/oval_fts.c
d48c07
@@ -1029,6 +1029,15 @@ static FTSENT *oval_fts_read_match_path(OVAL_FTS *ofts)
d48c07
 
d48c07
 		if (ores == OVAL_RESULT_TRUE)
d48c07
 			break;
d48c07
+		if (ofts->ofts_path_op == OVAL_OPERATION_EQUALS) {
d48c07
+			/* At this point the comparison result isn't OVAL_RESULT_TRUE. Since
d48c07
+			we passed the exact path (from filepath or path elements) to
d48c07
+			fts_open() we surely know that we can't find other items that would
d48c07
+			be equal. Therefore we can terminate the matching. This can happen
d48c07
+			if the filepath or path element references a variable that has
d48c07
+			multiple different values. */
d48c07
+			return NULL;
d48c07
+		}
d48c07
 	} /* for (;;) */
d48c07
 
d48c07
 	/*