Hide Forgot
Created attachment 1191705 [details] tailoring file used (shouldn't matter) Description of problem: When oscap xccdf eval is called with tailoring file is targeted, oscap segfaults. Version-Release number of selected component (if applicable): openscap-1.2.10-1.el7.x86_64 How reproducible: reliably Steps to Reproduce: 1. oscap xccdf eval ssg-rhel7-ds-tailoring.xml Actual results: Segmentation fault (core dumped) Expected results: Some kind of error is printed instead. (Graceful exit) Additional info: (gdb) run xccdf eval --profile xccdf_org.ssgproject.content_profile_faillock_test ssg-rhel7-ds-tailoring.xml Starting program: /usr/bin/oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_faillock_test ssg-rhel7-ds-tailoring.xml [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x00007ffff54a3427 in _int_free () from /lib64/libc.so.6 (gdb) bt #0 0x00007ffff54a3427 in _int_free () from /lib64/libc.so.6 #1 0x00007ffff7b8d33e in xccdf_session_new () from /lib64/libopenscap.so.8 #2 0x000055555556222c in app_evaluate_xccdf () #3 0x000055555555e229 in oscap_module_process () #4 0x000055555555d021 in main () (gdb) quit
I cannot reproduce this with upstream 1.2.10 or maint-1.2. This may be related to machine setup. Marek, could you please run: # debuginfo-install openscap-scanner And then rerun your test-case and provide the backtrace?
I CAN reproduce it with my fedora24 version $ oscap xccdf eval ssg-rhel7-ds-tailoring.xml Segmentation fault (core dumped) Upstream (latest git maint-1.2): $ myoscap xccdf eval ssg-rhel7-ds-tailoring.xml Bus error (core dumped) Sometimes I get "bus error"/otherwise "segmentation fault" GDB: #0 0x00007ffff52f9362 in free () from /lib64/libc.so.6 #1 0x00007ffff7b861c8 in _xccdf_session_autonegotiate_tailoring_file (session=0x61a7b0, session=0x61a7b0, original_path=0x7fffffffe046 "ssg-rhel7-ds-tailoring.xml") at xccdf_session.c:181 #2 xccdf_session_new (filename=0x7fffffffe046 "ssg-rhel7-ds-tailoring.xml") at xccdf_session.c:146 #3 0x000000000040b965 in app_evaluate_xccdf (action=0x7fffffffd9e0) at oscap-xccdf.c:536 #4 0x0000000000407f7e in oscap_module_call (action=0x7fffffffd9e0) at oscap-tool.c:261 #5 oscap_module_process (module=0x6154c0 <XCCDF_EVAL>, module@entry=0x614a40 <OSCAP_ROOT_MODULE>, argc=argc@entry=4, argv=argv@entry=0x7fffffffdc78) at oscap-tool.c:346 #6 0x0000000000406fff in main (argc=4, argv=0x7fffffffdc78) at oscap.c:80 It seems like problem with: char *base_dir = dirname(original_path_cpy); oscap_free(base_dir); man dirname: ... These functions may return pointers to statically allocated memory which may be overwritten by subsequent calls. Alternatively, they may return a pointer to some part of path, so that the string referred to by path should not be modified or freed until the pointer returned by the function is no longer required. ...
This PR should fix the segfault https://github.com/OpenSCAP/openscap/pull/517
Fixed upstream in https://github.com/OpenSCAP/openscap/commit/38c054d4aacf07ed20c00b13510240fd07e8afba
Verified fix being in version openscap-1.2.14-2.el7.x86_64 OLD: :: [ BEGIN ] :: Running 'oscap xccdf eval tailoring.xml' /usr/share/beakerlib/testing.sh: line 781: 10100 Segmentation fault oscap xccdf eval tailoring.xml :: [ FAIL ] :: Command 'oscap xccdf eval tailoring.xml' (Expected 0,1,2, got 139) NEW: :: [ BEGIN ] :: Running 'oscap xccdf eval tailoring.xml' WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them. WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content :: [ PASS ] :: Command 'oscap xccdf eval tailoring.xml' (Expected 0,1,2, got 0)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2291