Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2020581

Summary: oscap xccdf eval allows multiple --rule options to be specified but only processes one
Product: Red Hat Enterprise Linux 9 Reporter: Jan Pazdziora (Red Hat) <jpazdziora>
Component: openscapAssignee: Jan Černý <jcerny>
Status: CLOSED ERRATA QA Contact: Matus Marhefka <mmarhefk>
Severity: low Docs Contact:
Priority: low    
Version: 9.0CC: jjaburek, jpazdziora, mhaicman, mmarhefk
Target Milestone: rcKeywords: AutoVerified, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openscap-1.3.6-2.el9 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-05-17 13:04:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Pazdziora (Red Hat) 2021-11-05 10:23:36 UTC
Description of problem:

When running oscap xccdf eval, it is possible to specify the --rule multiple times. However, oscap xccdf eval only uses one of the parameters, producing incorrect results.

Version-Release number of selected component (if applicable):

openscap-scanner-1.3.5-8.el9.s390x

How reproducible:

Deterministic.

Steps to Reproduce:
1. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --rule xccdf_org.ssgproject.content_rule_zipl_audit_argument --rule xccdf_org.ssgproject.content_rule_zipl_audit_backlog_limit_argument /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
2. echo $?
3. Be happy to see the command passed:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml' points out to the remote 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml file which is referenced from XCCDF content
Title   Extend Audit Backlog Limit for the Audit Daemon in zIPL
Rule    xccdf_org.ssgproject.content_rule_zipl_audit_backlog_limit_argument
Ident   CCE-84099-1
Result  pass

4. Check the rules one by one:
   for i in xccdf_org.ssgproject.content_rule_zipl_audit_argument xccdf_org.ssgproject.content_rule_zipl_audit_backlog_limit_argument ; do oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --rule $i /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml ; done

Actual results:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml' points out to the remote 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml file which is referenced from XCCDF content
Title   Enable Auditing to Start Prior to the Audit Daemon in zIPL
Rule    xccdf_org.ssgproject.content_rule_zipl_audit_argument
Ident   CCE-84096-7
Result  fail

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml' points out to the remote 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml file which is referenced from XCCDF content
Title   Extend Audit Backlog Limit for the Audit Daemon in zIPL
Rule    xccdf_org.ssgproject.content_rule_zipl_audit_backlog_limit_argument
Ident   CCE-84099-1
Result  pass

Expected results:

Either oscap should complain loudly if it sees multiple options where it only expects one, or it should properly evaluate all rules listed.

I would prefer the second option.

Additional info:

Comment 1 Jiri Jaburek 2021-11-10 18:53:44 UTC
Note that it is fairly common for unix-like CLI utilities to use the last (sometimes first) specified option and ignore others, without an explicit warning/error. This is so that a user can pre-set some behavior, ie. via shell alias, and then override it on the command line.

Try:  $ ls --color=never --color=always

The common way to document an option capable of being specified multiple times is to mention it in --help or the manpage.

Ie.      grep [OPTION...] -e PATTERNS ... [FILE...]

It would be nice if oscap supported multiple --rule arguments, but it not throwing an error is a perfectly standard behavior.

Comment 2 Jan Pazdziora (Red Hat) 2021-11-10 22:27:53 UTC
Yes, some options call for overrides. Others don't and actively report error if they cannot support the multiple values:

$ cp --target-directory=/one --target-directory=/two something
cp: multiple target directories specified

Comment 3 Jan Černý 2021-11-30 09:53:58 UTC
Hi,

We consider that the --rule option isn't targeted to a common customer, it's an option useful mainly for testers and developers.

There are situations that a rule isn't selected by the profile or is is conflicting with some other rule. If the --rule option is provided, do you expect that the rule is evaluated always? Currently, in such situations, this rule isn't evaluated, because it wouldn't be evaluated normally. (normally means if the --rule option isn't used).  I wonder if you would expect that behavior in your use-case. There are opinions that as an user providing the --rule option you want this rule evaluated and you want to ignore selections and conflicts. But there are other opinions that you want to test the rule including the selections and conflicts because you want to make the test as close to real as possible.

Another situation is when a rule requires another rule. If a rule specified by the `--rule` requires another rule, should the other rule be evaluated as well? Both options (yes and no) make sense, but I wonder if one of them would fit  more into your use case.

Comment 4 Jan Pazdziora (Red Hat) 2021-11-30 21:12:21 UTC
For my development and testing scenarios, evaluating all rules specified with --rule (irrespectively of selections and conflicts) and including required rules would make the most sense.

Comment 5 Jan Černý 2022-01-11 10:13:37 UTC
There is a PR opened in upstream in https://github.com/OpenSCAP/openscap/pull/1832

Comment 6 Jan Černý 2022-01-20 09:59:53 UTC
https://github.com/OpenSCAP/openscap/pull/1832

Comment 15 errata-xmlrpc 2022-05-17 13:04:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: openscap), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2449