diff options
Diffstat (limited to 'meta-security-compliance/recipes-openscap')
3 files changed, 78 insertions, 1 deletions
diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch new file mode 100644 index 0000000..c0b93e4 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch | |||
@@ -0,0 +1,39 @@ | |||
1 | From 174293162e5840684d967e36840fc1f9f57c90be Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com> | ||
3 | Date: Thu, 5 Dec 2019 15:02:05 +0100 | ||
4 | Subject: [PATCH] Fix XML "parsing" of the remediation functions file. | ||
5 | |||
6 | A proper fix is not worth the effort, as we aim to kill shared Bash remediation | ||
7 | with Jinja2 macros. | ||
8 | |||
9 | Upstream-Status: Backport | ||
10 | [https://github.com/ComplianceAsCode/content/commit/174293162e5840684d967e36840fc1f9f57c90be] | ||
11 | |||
12 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
13 | --- | ||
14 | ssg/build_remediations.py | 8 ++++---- | ||
15 | 1 file changed, 4 insertions(+), 4 deletions(-) | ||
16 | |||
17 | diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py | ||
18 | index 7da807bd6..13e90f732 100644 | ||
19 | --- a/ssg/build_remediations.py | ||
20 | +++ b/ssg/build_remediations.py | ||
21 | @@ -56,11 +56,11 @@ def get_available_functions(build_dir): | ||
22 | remediation_functions = [] | ||
23 | with codecs.open(xmlfilepath, "r", encoding="utf-8") as xmlfile: | ||
24 | filestring = xmlfile.read() | ||
25 | - # This regex looks implementation dependent but we can rely on | ||
26 | - # ElementTree sorting XML attrs alphabetically. Hidden is guaranteed | ||
27 | - # to be the first attr and ID is guaranteed to be second. | ||
28 | + # This regex looks implementation dependent but we can rely on the element attributes | ||
29 | + # being present on one line. | ||
30 | + # We can't rely on ElementTree sorting XML attrs in any way since Python 3.7. | ||
31 | remediation_functions = re.findall( | ||
32 | - r'<Value hidden=\"true\" id=\"function_(\S+)\"', | ||
33 | + r'<Value.*id=\"function_(\S+)\"', | ||
34 | filestring, re.DOTALL | ||
35 | ) | ||
36 | |||
37 | -- | ||
38 | 2.17.1 | ||
39 | |||
diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch new file mode 100644 index 0000000..f0c9909 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch | |||
@@ -0,0 +1,35 @@ | |||
1 | From 28a35d63a0cc6b7beb51c77d93bb30778e6960cd Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= <matyc@redhat.com> | ||
3 | Date: Mon, 9 Dec 2019 13:41:47 +0100 | ||
4 | Subject: [PATCH] Fixed the broken fix, when greedy regex ate the whole file. | ||
5 | |||
6 | We want to match attributes in an XML element, not in the whole file. | ||
7 | |||
8 | Upstream-Status: Backport | ||
9 | [https://github.com/ComplianceAsCode/content/commit/28a35d63a0cc6b7beb51c77d93bb30778e6960cd] | ||
10 | |||
11 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
12 | --- | ||
13 | ssg/build_remediations.py | 4 ++-- | ||
14 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
15 | |||
16 | diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py | ||
17 | index 13e90f732..edf31c0cf 100644 | ||
18 | --- a/ssg/build_remediations.py | ||
19 | +++ b/ssg/build_remediations.py | ||
20 | @@ -57,10 +57,10 @@ def get_available_functions(build_dir): | ||
21 | with codecs.open(xmlfilepath, "r", encoding="utf-8") as xmlfile: | ||
22 | filestring = xmlfile.read() | ||
23 | # This regex looks implementation dependent but we can rely on the element attributes | ||
24 | - # being present on one line. | ||
25 | + # being present. Beware, DOTALL means we go through the whole file at once. | ||
26 | # We can't rely on ElementTree sorting XML attrs in any way since Python 3.7. | ||
27 | remediation_functions = re.findall( | ||
28 | - r'<Value.*id=\"function_(\S+)\"', | ||
29 | + r'<Value[^>]+id=\"function_(\S+)\"', | ||
30 | filestring, re.DOTALL | ||
31 | ) | ||
32 | |||
33 | -- | ||
34 | 2.17.1 | ||
35 | |||
diff --git a/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb index d9238c0..f35d769 100644 --- a/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb +++ b/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb | |||
@@ -1,7 +1,10 @@ | |||
1 | SUMARRY = "SCAP content for various platforms, OE changes" | 1 | SUMARRY = "SCAP content for various platforms, OE changes" |
2 | 2 | ||
3 | SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed" | 3 | SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed" |
4 | SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44;" | 4 | SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44; \ |
5 | file://0001-Fix-XML-parsing-of-the-remediation-functions-file.patch \ | ||
6 | file://0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch \ | ||
7 | " | ||
5 | PV = "0.1.44+git${SRCPV}" | 8 | PV = "0.1.44+git${SRCPV}" |
6 | 9 | ||
7 | require scap-security-guide.inc | 10 | require scap-security-guide.inc |