Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update oscap-bootc to verify it runs in bootable container env #2180

Merged
merged 1 commit into from
Nov 27, 2024
Merged

Update oscap-bootc to verify it runs in bootable container env #2180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion openscap.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,6 @@ Summary: OpenSCAP Utilities
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
Requires: rpmdevtools rpm-build
Requires: %{name}-scanner%{?_isa} = %{epoch}:%{version}-%{release}
Requires: %{name}-engine-sce%{?_isa} = %{epoch}:%{version}-%{release}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't this disrupt any existing deployment? For example, if someone installs the utils package expecting it will also install sce engine so they can use sce content and they don't realize they are missing this package now that is not installed when installing the utils anymore. Might be a well hidden corner case, but this could break someone's use case.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was only added because of oscap-bootc in https://github.com/OpenSCAP/openscap/pull/2169/files#diff-e361a9e64280ac40f420ea0d5c0fd49d76d21287b799ee013f2377c0cecc8814 so it should be safe to remove for now. It is not expected that SCE checks will be used outside of oscap-bootc use case. If it will change in the future then the openscap-engine-sce package will need to be added as a dependency to other sub-packages like openscap-scanner, etc.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Becker is correct, but this change hasn't been released yet, so if we remove it now we just revert to the previous state which is fine, therefore Matus is correct.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense, thanks


%description utils
The %{name}-utils package contains command-line tools build on top
Expand Down
20 changes: 13 additions & 7 deletions utils/oscap-bootc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ import subprocess
import sys
import tempfile

from pathlib import Path


def parse_args():
parser = argparse.ArgumentParser(
Expand Down Expand Up @@ -52,17 +54,21 @@ def parse_args():
return parser.parse_args()


def ensure_sce_installed():
query_cmd = ["rpm", "-q", "openscap-engine-sce"]
query_process = subprocess.run(query_cmd, capture_output=True)
if query_process.returncode != 0:
def verify_bootc_build_env():
rv = subprocess.run(
["rpm", "-q", "bootc"],
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
bootc_env = (rv.returncode == 0)
container_env = Path("/run/.containerenv").exists()
if not bootc_env or not container_env:
raise RuntimeError(
"The script requires to have the openscap-engine-sce package "
"installed.")
"This script is supposed to be used only in the bootable "
"container build environment.")


def install_sce_dependencies():
required_packages = [
"openscap-engine-sce",
"setools-console" # seinfo is used by the sebool template
]
install_cmd = ["dnf", "-y", "install"] + required_packages
Expand Down Expand Up @@ -124,7 +130,7 @@ def scan_and_remediate(args):

def main():
args = parse_args()
ensure_sce_installed()
verify_bootc_build_env()
install_sce_dependencies()
pre_scan_fix(args)
scan_and_remediate(args)
Expand Down
Loading