Bug 2081777 - [RFE] Support the --local-files oscap argument
Summary: [RFE] Support the --local-files oscap argument
Keywords:
Status: VERIFIED
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: SCAP Plugin
Version: 6.10.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: 6.14.0
Assignee: satellite6-bugs
QA Contact: addubey
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-05-04 15:25 UTC by Marek Hulan
Modified: 2023-07-31 17:57 UTC (History)
13 users (show)

Fixed In Version: rubygem-foreman_scap_client-0.5.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2211952 2227867 (view as bug list)
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
hotfix rpm (26.61 KB, application/x-rpm)
2023-06-01 14:11 UTC, Chris Roberts
no flags Details
hotfix doc rpm (207.02 KB, application/x-rpm)
2023-06-01 14:11 UTC, Chris Roberts
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker SAT-17633 0 None None None 2023-05-09 15:17:30 UTC
Red Hat Issue Tracker SAT-17970 0 None None None 2023-05-31 00:34:55 UTC

Description Marek Hulan 2022-05-04 15:25:40 UTC
Description of problem:

The new version of oscap 1.3.6, probably released around 8.6/9.0 will stop look at current working directory for the local cache of oval files. Instead it will provide explicit --local-files argument, that we'll have to start using to preserve the functionality. This has impact on the customers who use the solution from https://bugzilla.redhat.com/show_bug.cgi?id=1957288

Expected results:

Today we rely on the files being present in /root, the foreman_scap_client could just add such definition on the oscap >= 1.3.6. The directory may be configurable, but that would require also changes to ansible role and the puppet module to modify the config file. I think that is not mandatory for this RFE.

Additional info:

This should be a follow up of https://bugzilla.redhat.com/show_bug.cgi?id=1957288

Comment 1 Satyajit Das 2022-07-07 08:53:09 UTC
Hello Team,

Any workaround available for now, using which we can pass the parameter( --local-files) in the config file (/etc/foreman_scap_client/config.yaml ), so that during the scan it should refer to the file and perform the checks and upload the report to the satellite.

Regards,

Comment 2 Marek Hulan 2022-08-24 18:35:53 UTC
There is no easy workaround, the only way to make this work now is to manually patch the foreman_scap_client code on every client. This is the line, that needs to be modified

https://github.com/theforeman/foreman_scap_client/blob/master/lib/foreman_scap_client/client.rb#L39

Comment 11 Marek Hulan 2023-05-09 15:13:28 UTC
The new version of foreman_scap_client 0.5.1 was released in the upstream and includes the fix.

Comment 13 Chris Roberts 2023-06-01 14:11:20 UTC
Created attachment 1968314 [details]
hotfix rpm

Comment 14 Chris Roberts 2023-06-01 14:11:52 UTC
Created attachment 1968315 [details]
hotfix doc rpm

Comment 15 Chris Roberts 2023-06-01 14:13:09 UTC
Hotfix instructions:

1. Download the RPM's from the BZ to a folder on the satellite and cd to that directory
2. # yum localinstall *
3. # foreman-maintain service restart

Comment 16 Marek Hulan 2023-06-02 10:05:09 UTC
This package is typically installed on scanned hosts, not Satellite itself. People need to distribute this to their hosts.

Comment 17 Leos Stejskal 2023-06-12 11:37:54 UTC
Hi Patrick,
can we release a new snap of the client repo so QAs can test the change?


Note You need to log in before you can comment on or make changes to this bug.