Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
After following these steps we get "Value warning" :
1. Start SCAP Workbench
2. Select Content "RHEL8"
3. Button "Load Content"
3. Select Profile "default"
4. Button "Customize"
5. Leave New Profile ID on default
6. Button "Deselect All"
7. Select Rule "Ensure that Root's Path Does Not Include World or Group-Writable Directories"
8. Button "OK"
9. Button "Scan"
It will pass but warn about "Entity has no value!".
From oscap source:
1. Value Warning (1 occurence)
-------------------------------
"W: oscap: Entity has no value!" (on STDERR)
Title Ensure that Root's Path Does Not Include World or Group-Writable Directories
Rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write
Ident CCE-80672-9
W: oscap: Entity has no value!
Result pass
-> This is what openscap source tells about the message
./src/OVAL/probes/public/probe-api.h
#define PROBE_ENT_STRVAL(ent, dst, dstlen, invalid_exp, zerolen_exp) \
do { \
SEXP_t *___r; \
\
if ((___r = probe_ent_getval(ent)) == NULL) { \
dW("Entity has no value!"); \ <<<<<<<<<<<
invalid_exp \
} else { \
if (!SEXP_stringp(___r)) { \
dE("Invalid type"); \
SEXP_free(___r); \
invalid_exp \
} \
else if (SEXP_string_length(___r) == 0) { \
SEXP_free(___r); \
zerolen_exp \
} else { \
SEXP_string_cstr_r(___r, dst, dstlen); \
SEXP_free(___r); \
} \
} \
} while (0)
Here, ent(entity) can be a string, key, path+filename or filepath typecasted to typedef struct SEXP SEXP_t;
probe_ent_getval() function checks
if it contains "var_ref" then return value
else validate list if fails return NULL. <<<<<<<< This is the case. NULL is returned
# oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write --profile "(all)" /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
Title Ensure that Root's Path Does Not Include World or Group-Writable Directories
Rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write
Ident CCE-80672-9
W: oscap: Entity has no value! <<<<<<<<
Result pass
Will this fix?
scap-security-guide-0.1.43/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/oval/shared.xml
<ind:environmentvariable58_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1">
- <ind:pid xsi:nil="true" datatype="int" />
+ <ind:pid datatype="int" />0</ind:pid>
Version-Release number of selected component (if applicable):
scap-security-guide-0.1.42-11.el8.noarch
How reproducible:
All times
Steps to Reproduce:
1.
2.
3.
Actual results:
confusing string "Entity has no value!" appears in output.
Expected results:
Some meaning message should be seen instead of "Entity has no value!".
Additional info:
Also, In general can we be more elaborate regarding warnings so one may have a clue where to look for possible reasons and mitigations (like which entity, value of what kind, etc.)
Hello Amit,
thanks for the detailed analysis. I have looked into this issue and even though the following fixes the issue (on content side):
----------------------------
scap-security-guide-0.1.43/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/oval/shared.xml
<ind:environmentvariable58_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1">
- <ind:pid xsi:nil="true" datatype="int" />
+ <ind:pid datatype="int" />0</ind:pid>
----------------------------
this is not issue in the content, but in the scanner. The OVAL Definitions Schema documentation [1] for the `environmentvariable58_object` specifies the following for the pid child element:
"... If the xsi:nil attribute is set to true, the process ID shall be the tool's running process."
which is root in this case.
I am moving this to the openscap component. The scanner should not output a warning in this case (the string can rather be printed into debug output). The output needs to be definitely improved as the "Entity has no value!" is just useless and gives zero information on what is the problem.
[1] https://oval.mitre.org/language/version5.11/ovaldefinition/documentation/independent-definitions-schema.html
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (openscap bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:4623
Description of problem: After following these steps we get "Value warning" : 1. Start SCAP Workbench 2. Select Content "RHEL8" 3. Button "Load Content" 3. Select Profile "default" 4. Button "Customize" 5. Leave New Profile ID on default 6. Button "Deselect All" 7. Select Rule "Ensure that Root's Path Does Not Include World or Group-Writable Directories" 8. Button "OK" 9. Button "Scan" It will pass but warn about "Entity has no value!". From oscap source: 1. Value Warning (1 occurence) ------------------------------- "W: oscap: Entity has no value!" (on STDERR) Title Ensure that Root's Path Does Not Include World or Group-Writable Directories Rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write Ident CCE-80672-9 W: oscap: Entity has no value! Result pass -> This is what openscap source tells about the message ./src/OVAL/probes/public/probe-api.h #define PROBE_ENT_STRVAL(ent, dst, dstlen, invalid_exp, zerolen_exp) \ do { \ SEXP_t *___r; \ \ if ((___r = probe_ent_getval(ent)) == NULL) { \ dW("Entity has no value!"); \ <<<<<<<<<<< invalid_exp \ } else { \ if (!SEXP_stringp(___r)) { \ dE("Invalid type"); \ SEXP_free(___r); \ invalid_exp \ } \ else if (SEXP_string_length(___r) == 0) { \ SEXP_free(___r); \ zerolen_exp \ } else { \ SEXP_string_cstr_r(___r, dst, dstlen); \ SEXP_free(___r); \ } \ } \ } while (0) Here, ent(entity) can be a string, key, path+filename or filepath typecasted to typedef struct SEXP SEXP_t; probe_ent_getval() function checks if it contains "var_ref" then return value else validate list if fails return NULL. <<<<<<<< This is the case. NULL is returned # oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write --profile "(all)" /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml Title Ensure that Root's Path Does Not Include World or Group-Writable Directories Rule xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write Ident CCE-80672-9 W: oscap: Entity has no value! <<<<<<<< Result pass Will this fix? scap-security-guide-0.1.43/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/oval/shared.xml <ind:environmentvariable58_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1"> - <ind:pid xsi:nil="true" datatype="int" /> + <ind:pid datatype="int" />0</ind:pid> Version-Release number of selected component (if applicable): scap-security-guide-0.1.42-11.el8.noarch How reproducible: All times Steps to Reproduce: 1. 2. 3. Actual results: confusing string "Entity has no value!" appears in output. Expected results: Some meaning message should be seen instead of "Entity has no value!". Additional info: