From ea87ecab21a54741e64680977521837ccaf0206b Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= <jcerny@redhat.com>

Date: Tue, 5 Oct 2021 14:33:37 +0200

Subject: [PATCH] Allow empty /proc in offline mode

When scanning offline file systems the /proc might be empty. Currently,

OpenSCAP thinks that it means a permissions problems, which is often

true if it happens on a real system, but in offline mode it can be a

normal situation. We will not consider empty /proc an error in offline

mode.

The commit also includes a simple test case.

Inspired by eda9881e08f0398d1481f133fbb56c0080cfe9f3

Resolves: RHBZ #2008922

---

 src/OVAL/probes/unix/process58_probe.c | 18 ++++++++++----

 tests/probes/process58/CMakeLists.txt  |  1 +

 tests/probes/process58/empty_proc.sh   | 33 ++++++++++++++++++++++++++

 3 files changed, 47 insertions(+), 5 deletions(-)

 create mode 100755 tests/probes/process58/empty_proc.sh

diff --git a/src/OVAL/probes/unix/process58_probe.c b/src/OVAL/probes/unix/process58_probe.c

index d1108fc59..29c582152 100644

--- a/src/OVAL/probes/unix/process58_probe.c

+++ b/src/OVAL/probes/unix/process58_probe.c

@@ -472,7 +472,7 @@ static inline char *make_defunc_str(char* const cmd_buffer){

 static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)

 {

 	char buf[PATH_MAX];

-	int err = PROBE_EACCESS, max_cap_id;

+	int max_cap_id;

 	DIR *d;

 	struct dirent *ent;

 	oval_schema_version_t oval_version;

@@ -501,6 +501,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)

 	cmd_buffer[0] = '[';

 	// Scan the directories

+	bool any_pid_dir_found = false;

 	while (( ent = readdir(d) )) {

 		int fd, len;

 		char *tmp, state, tty_dev[128];

@@ -562,9 +563,7 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)

 			}

 		}

-

-		err = PROBE_ESUCCESS; // If we get this far, no permission problems

-		dI("Have command: %s", cmd);

+		any_pid_dir_found = true;

 		cmd_sexp = SEXP_string_newf("%s", cmd);

 		pid_sexp = SEXP_number_newu_32(pid);

 		if ((cmd_sexp == NULL || probe_entobj_cmp(cmd_ent, cmd_sexp) == OVAL_RESULT_TRUE) &&

@@ -662,7 +661,16 @@ static int read_process(SEXP_t *cmd_ent, SEXP_t *pid_ent, probe_ctx *ctx)

 	}

         closedir(d);

 	oscap_buffer_free(cmdline_buffer);

-	return err;

+

+	if (!any_pid_dir_found) {

+		dW("No data about processes could be read from '%s'.", buf);

+	}

+	// In offline mode, empty /proc might be a normal situation and doesn't

+	// have to mean permissions problems

+	if (prefix)

+		return PROBE_ESUCCESS;

+	else

+		return any_pid_dir_found ? PROBE_ESUCCESS : PROBE_EACCESS;

 }

 int process58_probe_offline_mode_supported(void)

diff --git a/tests/probes/process58/CMakeLists.txt b/tests/probes/process58/CMakeLists.txt

index 17261dbb7..947665de6 100644

--- a/tests/probes/process58/CMakeLists.txt

+++ b/tests/probes/process58/CMakeLists.txt

@@ -2,6 +2,7 @@ if(ENABLE_PROBES_UNIX)

 	add_oscap_test("capability.sh")

 	add_oscap_test("command_line.sh")

 	add_oscap_test("dev_to_tty.sh")

+	add_oscap_test("empty_proc.sh")

 	add_oscap_test("loginuid.sh")

 	add_oscap_test("selinux_domain_label.sh")

 	add_oscap_test("sessionid.sh")

diff --git a/tests/probes/process58/empty_proc.sh b/tests/probes/process58/empty_proc.sh

new file mode 100755

index 000000000..2f0334b15

--- /dev/null

+++ b/tests/probes/process58/empty_proc.sh

@@ -0,0 +1,33 @@

+#!/usr/bin/env bash

+

+# This is regression test of RHBZ #2008922

+

+set -e -o pipefail

+

+. $builddir/tests/test_common.sh

+probecheck "process58" || exit 255

+

+name=$(basename $0 .sh)

+result=$(mktemp ${name}.out.XXXXXX)

+stderr=$(mktemp ${name}.err.XXXXXX)

+

+root=$(mktemp -d)

+

+# create an empty /proc in the offline file system dir

+mkdir -p "$root/proc"

+

+export OSCAP_PROBE_ROOT="$root"

+$OSCAP oval eval --results $result $srcdir/capability.oval.xml 2> $stderr

+

+[ $? -eq 0 ]

+grep -q "^W: oscap:\s\+No data about processes could be read from '$root/proc'." "$stderr"

+grep -q "OpenSCAP Error: Probe at sd=1 (process58) reported an error: Operation not permitted" "$stderr" && false

+grep -q "W: oscap:\s\+Can't receive message: 125, Operation canceled." "$stderr" && false

+

+[ -s "$result" ]

+assert_exists 1 '/oval_results/results/system/definitions/definition[@result="false"]'

+assert_exists 1 '/oval_results/results/system/oval_system_characteristics/collected_objects/object[@flag="does not exist"]'

+

+rm "$stderr"

+rm "$result"

+rm -r "$root"