Inquiry Regarding Handling of "pkg_manager" Variable for Systems Without Package Manager

[ZenByld]

Hello,

I am currently adding a product to complianceAsCode. This product is based on Linux but built with Buildroot. Therefore, I do not have a package manager in my system. In my product.yml file, there is a mandatory variable called pkg_manager. Consequently, I am forced to set the pkg_manager to yum, apt-get, etc. This leads to incorrect scan reports, with statuses consistently showing as "unknown" and errors of the type "OVAL object 'rpminfo_object' is not supported."

Could you please advise on how to handle the "pkg_manager" variable for systems that do not have a package manager?

Thank you in advance for your assistance.

[Mab879]

Thanks for your question.

So the pkg_manager field is used heavily to see if a package is installed by the given package manager. Many rules that are not directly related to packages' installation state still use the package manager check to if package is installed for applicability reasons. Unfortunately, the project isn't well setup for systems without a package manager.

What rules (or types of rules) are looking to use?

[ZenByld]

Hi Matthew,

Thank you for your feedback. I have quite a few rules failing because of pkg_manager. For example, "package_telnet_removed". What do you recommend for systems without a pkg_manager?

[Mab879]

In the project's current state I would recommend not using those rules. If you have an idea on how we should check these without a package manager maybe there can be change made to the project. They way those rules work, as you have discovered, using apt or rpm database to see if the package is installed.

[ZenByld]

In my opinion, verification via package managers makes perfect sense for traditional distributions. Perhaps what needs to be added is support for other mechanisms for systems that lack a package manager.

The issue with these package-manager-less systems is that they don't all have the same way of verifying package installations.

In embedded systems, the main build systems that provide systems without package managers are Yocto, Buildroot, and OpenWrt. We may consider addressing at least these three build systems, each with its own specificities. Thus, in the product.yml file, we can add support for pkg_manager: "buildroot or yocto or openwrt".

I work with Buildroot, so I can attempt to implement a clean mechanism for determining whether a package is installed or not. Others will likely do the same for Yocto and OpenWrt.

Currently, in which file is the parsing of pkg_manager and the implementation of the code to determine whether a package is installed or not implemented?

I could also search on my own, but if you have a starting point, it will save me some time.

[Mab879]

See is the code for the package_installed. That should give you a starting point. Would have to write some sort of OVAL test to see if package is installed.