Bug 1781074
| Summary: | scap-workbench fails when using the firefox profile | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Christophe Besson <cbesson> | ||||||||||
| Component: | scap-workbench | Assignee: | Matěj Týč <matyc> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Matus Marhefka <mmarhefk> | ||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | high | ||||||||||||
| Version: | 8.1 | CC: | ableisch, jcerny, lcervako, mhaicman, mthacker, wsato | ||||||||||
| Target Milestone: | rc | Keywords: | Regression, Reproducer | ||||||||||
| Target Release: | 8.2 | Flags: | pm-rhel:
mirror+
|
||||||||||
| Hardware: | All | ||||||||||||
| OS: | All | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | scap-workbench-1.2.0-4.el8 | Doc Type: | If docs needed, set a value | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2020-04-28 16:04:54 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Attachments: |
|
||||||||||||
Hello, thank you for reporting this behavior! The issue is not functional in nature. Culprit is increased verbosity of `oscap` command line utility. When OVAL is missing, output is like that: Title The DoD Root Certificate Exists Rule xccdf_org.ssgproject.content_rule_firefox_preferences-dod_root_certificate_installed Ident CCE-82056-3 WARNING: Skipping rule that requires an unregistered check system or incorrect content reference to evaluate. Please consider providing a valid SCAP/OVAL instead of http://scap.nist.gov/schema/ocil/2 Result notchecked Title Enable Shared System Certificates Rule xccdf_org.ssgproject.content_rule_firefox_preferences-enable_ca_trust Ident CCE-82057-1 WARNING: Skipping rule that requires an unregistered check system or incorrect content reference to evaluate. Please consider providing a valid SCAP/OVAL instead of http://scap.nist.gov/schema/ocil/2 Result notchecked Notice the WARNING line. SCAP Workbench fails to understand this new output, and prints out these awful lines. Workaround is - ignore these particular warnings. The customer saw these errors message on stderr: 08:25:10 error The 'oscap' process has written the following content to stderr: chown: cannot access '/tmp/SCAP': No such file or directory 08:25:10 error The 'oscap' process has written the following content to stderr: chown: cannot access 'Workbench.bGnNch': No such file or directory 08:25:10 error The 'oscap' process has written the following content to stderr: chown: cannot access '/tmp/SCAP': No such file or directory 08:25:10 error The 'oscap' process has written the following content to stderr: chown: cannot access 'Workbench.FYmUgl': No such file or directory This looks like the filename contained a space "/tmp/SCAP Workbench.FYmUgl" and wasn't quoted properly. Best solution would be to avoid whitespaces entirely. It seems to be a known issue: https://github.com/OpenSCAP/scap-workbench/issues/196 Are you sure this is not a functional issue? Created attachment 1643861 [details]
strace of scap-workbench from the GUI
I uploaded a new strace, as I reproduced the customer issue only through the GUI (error messages didn't appear through "ssh -X"...). Maybe this bug should be moved to the "openscap-scanner" component. The issue may be caused by using the default template of QTemporaryFile() which uses QCoreApplication::applicationName() suffixed by some arbitrary numbers: QTemporaryFile::QTemporaryFile() Constructs a QTemporaryFile using as file template the application name returned by QCoreApplication::applicationName() (otherwise qt_temp) followed by ".XXXXXX". The file is stored in the system's temporary directory, QDir::tempPath(). In order to avoid those whitespaces QTemporaryFile() will need to get a suitable template as parameter or QTemporaryFile::setFileTemplate() to be initailized. The spaces in temporary files names will be remove by https://github.com/OpenSCAP/scap-workbench/pull/239 Fixed by that PR. Created attachment 1662153 [details]
Result with regression (scap-workbench-1.2.0-3.el8)
Created attachment 1662154 [details]
Result with fix (scap-workbench-1.2.0-4.el8)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1748 |
Created attachment 1643231 [details] scap-workbench strace Description of problem: While selecting the Firefox profile/policy to run a scan, the following message appeared in the console: 04:42:08 | info | Querying capabilities... 04:42:08 | info | Creating temporary files... 04:42:08 | info | Starting the oscap process... 04:42:08 | info | Processing... 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. ':' encountered while not reading rule ID, newline and/or rule result are missing! Read buffer is 'WARNING'. 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. ':' encountered while not reading rule ID, newline and/or rule result are missing! Read buffer is ' Skipping rule that requires an unregistered check system or incorrect content reference to evaluate. Please consider providing a valid SCAP/OVAL instead of http'. 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. Newline encountered while reading rule ID, rule result and/or ':' are missing! Read buffer is 'notchecked'. 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. ':' encountered while not reading rule ID, newline and/or rule result are missing! Read buffer is 'WARNING'. 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. ':' encountered while not reading rule ID, newline and/or rule result are missing! Read buffer is ' Skipping rule that requires an unregistered check system or incorrect content reference to evaluate. Please consider providing a valid SCAP/OVAL instead of http'. 04:42:08 | warning | Error when parsing scan progress output from stdout of the 'oscap' process. Newline encountered while reading rule ID, rule result and/or ':' are missing! Read buffer is 'notchecked'. 04:42:09 | info | The oscap tool has finished. Reading results... 04:42:09 | info | Processing has been finished! Version-Release number of selected component (if applicable): scap-workbench-1.2.0-3.el8.x86_64 Steps to Reproduce: 1. Install the needed packages: # yum install scap-security-guide scap-workbench firefox xorg-x11-xauth 2. Launch the GUI with: # scap-workbench & 3. Select "Firefox" in the first screen, then click on the "Scan" button. Actual results: Messages above appears on the console. Expected results: Working scan. Additional info: I attach the related strace, but I don't think that can help to find out what happens.