Bug 1795563
| Summary: | Openscap removes blank lines from Ansible remediations generated from datastream | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Vojtech Polasek <vpolasek> |
| Component: | openscap | Assignee: | Jan Černý <jcerny> |
| Status: | CLOSED ERRATA | QA Contact: | Matus Marhefka <mmarhefk> |
| Severity: | medium | Docs Contact: | Jan Fiala <jafiala> |
| Priority: | medium | ||
| Version: | 8.2 | CC: | jafiala, jcerny, lmanasko, matyc, mhaicman, mmarhefk |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openscap-1.3.2-7.el8 | Doc Type: | Bug Fix |
| Doc Text: |
.OpenSCAP no longer removes blank lines from YAML multi-line strings
Previously, OpenSCAP removed blank lines from YAML multi-line strings within generated Ansible remediations from a datastream. This affected Ansible remediations and caused the `openscap` utility to fail the corresponding Open Vulnerability and Assessment Language (OVAL) checks, producing false positive results. The issue is now fixed and as a result, `openscap` no longer removes blank lines from YAML multi-line strings.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-04 02:29:43 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 1
Jan Černý
2020-01-28 12:02:21 UTC
This has been fixed in upstream in https://github.com/OpenSCAP/openscap/pull/1476 I agree with the general message, but I propose to rephrase two points Consequence: As some Ansible remediations contain literal configuration file content, removing blank lines affects corresponding remediations. In some cases, this may result in loss of alignment with the corresponding OVAL check. As the blank lines are removed by the openscap when generating Ansible remediations, applying these Ansible remediations and scanning the system using openscap will assert corresponding OVAL checks as failed. Blank lines don't have functional effect, so the failed check reported by the scanner is a false positive. Workaround (if any): Check with the rule description and waive scan results which are failing because of missing blank lines, or use Bash remediations instead of Ansible remediations. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (openscap bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4623 |