Version: 1.4.2+dfsg-1
Severity: normal
The SCE engine in libopenscap33 falls back to /usr/bin/oscap-run-sce-script
when a check script is not executable. That helper ships in openscap-utils,
and nothing in the scanner's dependency chain pulls it in. With only
openscap-scanner installed, every SCE check that takes the fallback ends in
"error", and oscap prints nothing at default verbosity to say why.
The fallback matters in practice. When evaluating a data stream, oscap
extracts SCE scripts under /tmp, and both CIS and ANSSI BP-028 require /tmp
to be mounted noexec. So the scanner fails on exactly the systems those
benchmarks target.
Minimal reproducer on a clean trixie install. No content or mounts needed,
since chmod -x takes the same code path as a noexec /tmp.
$ sudo apt install openscap-scanner
$ mkdir sce-repro && cd sce-repro
$ cat > bench.xml <<'XML'
<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns=" http://checklists.nist.gov/xccdf/1.2 "
id="xccdf_org.example_benchmark_sce" resolved="1">
<status>draft</status>
<version>1</version>
<Rule id="xccdf_org.example_rule_sce" selected="true">
<title>SCE helper reproducer</title>
<check system=" http://open-scap.org/page/SCE ">
<check-content-ref href="check.sh"/>
</check>
</Rule>
</Benchmark>
XML
$ printf '#!/bin/sh\nexit "$XCCDF_RESULT_PASS"\n' > check.sh
$ chmod +x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result
Result pass
$ chmod -x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result
Result error
$ sudo apt install openscap-utils
$ oscap xccdf eval bench.xml 2>&1 | grep -i result
Result pass
Suggested fix: ship oscap-run-sce-script in openscap-common. It is a short
bash script, so Architecture: all fits, and openscap-scanner already depends
on openscap-common. openscap-scanner would work too. Either way the move
needs Breaks/Replaces: openscap-utils (<< fixed version).
Related:
- Upstream: https://github.com/OpenSCAP/openscap/issues/2414 (triaged)
- Upstream #2243, reported on Debian 13 and resolved by installing
openscap-utils: https://github.com/OpenSCAP/openscap/issues/2243
- Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openscap/+bug/2166636
Ubuntu carries no delta, so a Debian fix reaches Ubuntu as well.
Thomas Moore (realstuffie)