Skip to content

Commit 9b38fc2

Browse files
evgenyzevgenyz
authored
Merge pull request #2052 from jan-cerny/block_paths
Skip certain paths from scanning
2 parents 3222734 + 2d20f33 commit 9b38fc2

24 files changed

+410
-13
lines changed

‎docs/manual/manual.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1647,6 +1647,7 @@ not considered local by the scanner:
16471647
* `SOURCE_DATE_EPOCH` - Timestamp in seconds since epoch. This timestamp will be used instead of the current time to populate `timestamp` attributes in SCAP source data streams created by `oscap ds sds-compose` sub-module. This is used for reproducible builds of data streams.
16481648
* `OSCAP_PROBE_MEMORY_USAGE_RATIO` - maximum memory usage ratio (used/total) for OpenSCAP probes, default: 0.1
16491649
* `OSCAP_PROBE_MAX_COLLECTED_ITEMS` - maximal count of collected items by OpenSCAP probe for a single OVAL object evaluation
1650+
* `OSCAP_PROBE_IGNORE_PATHS` - Skip given paths during evaluation. If multiple paths should be skipped they need to be separated by a colon. The paths should be absolute canonical paths.
16501651

16511652
Also, OpenSCAP uses `libcurl` library which also can be configured using environment variables. See https://curl.se/libcurl/c/libcurl-env.html[the list of libcurl environment variables].
16521653

‎src/OVAL/probes/independent/filehash58_probe.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,10 @@ static int filehash58_cb(const char *prefix, const char *p, const char *f, const
152152
memcpy (pbuf + plen, f, sizeof (char) * flen);
153153
pbuf[plen+flen] = '\0';
154154

155+
if (probe_path_is_blocked(pbuf, ctx->blocked_paths)) {
156+
return 0;
157+
}
158+
155159
/*
156160
* Open the file
157161
*/

‎src/OVAL/probes/independent/filehash_probe.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,10 @@ static int filehash_cb (const char *prefix, const char *p, const char *f, probe_
105105
pbuf[plen+flen] = '\0';
106106
include_filepath = oval_schema_version_cmp(over, OVAL_SCHEMA_VERSION(5.6)) >= 0;
107107

108+
if (probe_path_is_blocked(pbuf, ctx->blocked_paths)) {
109+
return 0;
110+
}
111+
108112
/*
109113
* Open the file
110114
*/

‎src/OVAL/probes/independent/textfilecontent54_probe.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@
5353
#include "common/debug_priv.h"
5454
#include "common/util.h"
5555
#include "common/oscap_pcre.h"
56+
#include "common/list.h"
57+
5658
#include "textfilecontent54_probe.h"
5759

5860
#define FILE_SEPARATOR '/'
@@ -118,9 +120,8 @@ struct pfdata {
118120
oscap_pcre_t *compiled_regex;
119121
};
120122

121-
static int process_file(const char *prefix, const char *path, const char *file, void *arg, oval_schema_version_t over)
123+
static int process_file(const char *prefix, const char *path, const char *file, struct pfdata *pfd, oval_schema_version_t over, struct oscap_list *blocked_paths)
122124
{
123-
struct pfdata *pfd = (struct pfdata *) arg;
124125
int ret = 0, path_len, file_len, cur_inst = 0, fd = -1, substr_cnt,
125126
buf_size = 0, buf_used = 0, ofs = 0, buf_inc = 4096;
126127
char **substrs = NULL;
@@ -144,6 +145,9 @@ static int process_file(const char *prefix, const char *path, const char *file,
144145

145146
memcpy(whole_path + path_len, file, file_len + 1);
146147

148+
if (probe_path_is_blocked(whole_path, blocked_paths)) {
149+
goto cleanup;
150+
}
147151
/*
148152
* If stat() fails, don't report an error and just skip the file.
149153
* This is an expected situation, because the fts_*() functions
@@ -361,7 +365,7 @@ int textfilecontent54_probe_main(probe_ctx *ctx, void *arg)
361365
if (ofts_ent->fts_info == FTS_F
362366
|| ofts_ent->fts_info == FTS_SL) {
363367
// todo: handle return code
364-
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd, over);
368+
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd, over, ctx->blocked_paths);
365369
}
366370
oval_ftsent_free(ofts_ent);
367371
}

‎src/OVAL/probes/independent/textfilecontent_probe.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ struct pfdata {
136136
probe_ctx *ctx;
137137
};
138138

139-
static int process_file(const char *prefix, const char *path, const char *filename, void *arg, oval_schema_version_t over)
139+
static int process_file(const char *prefix, const char *path, const char *filename, void *arg, oval_schema_version_t over, struct oscap_list *blocked_paths)
140140
{
141141
struct pfdata *pfd = (struct pfdata *) arg;
142142
int ret = 0, path_len, filename_len;
@@ -170,6 +170,10 @@ static int process_file(const char *prefix, const char *path, const char *filena
170170
}
171171
memcpy(whole_path + path_len, filename, filename_len + 1);
172172

173+
if (probe_path_is_blocked(whole_path, blocked_paths)) {
174+
goto cleanup;
175+
}
176+
173177
/*
174178
* If stat() fails, don't report an error and just skip the file.
175179
* This is an expected situation, because the fts_*() functions
@@ -294,7 +298,7 @@ int textfilecontent_probe_main(probe_ctx *ctx, void *arg)
294298
if (ofts_ent->fts_info == FTS_F
295299
|| ofts_ent->fts_info == FTS_SL) {
296300
// todo: handle return code
297-
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd, over);
301+
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd, over, ctx->blocked_paths);
298302
}
299303
oval_ftsent_free(ofts_ent);
300304
}

‎src/OVAL/probes/independent/xmlfilecontent_probe.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,9 +142,8 @@ static xmlDocPtr strip_ns(xmlDocPtr doc)
142142
return result;
143143
}
144144

145-
static int process_file(const char *prefix, const char *path, const char *filename, void *arg)
145+
static int process_file(const char *prefix, const char *path, const char *filename, struct pfdata *pfd, struct oscap_list *blocked_paths)
146146
{
147-
struct pfdata *pfd = (struct pfdata *) arg;
148147
int ret = 0, path_len, filename_len;
149148
char *whole_path = NULL;
150149
xmlDoc *doc = NULL;
@@ -171,6 +170,10 @@ static int process_file(const char *prefix, const char *path, const char *filena
171170

172171
memcpy(whole_path + path_len, filename, filename_len + 1);
173172

173+
if (probe_path_is_blocked(whole_path, blocked_paths)) {
174+
goto cleanup;
175+
}
176+
174177
if (prefix == NULL) {
175178
doc = xmlParseFile(whole_path);
176179
} else {
@@ -393,7 +396,7 @@ int xmlfilecontent_probe_main(probe_ctx *ctx, void *arg)
393396

394397
if ((ofts = oval_fts_open_prefixed(prefix, path_ent, filename_ent, filepath_ent, behaviors_ent, probe_ctx_getresult(ctx))) != NULL) {
395398
while ((ofts_ent = oval_fts_read(ofts)) != NULL) {
396-
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd);
399+
process_file(prefix, ofts_ent->path, ofts_ent->file, &pfd, ctx->blocked_paths);
397400
oval_ftsent_free(ofts_ent);
398401
}
399402

‎src/OVAL/probes/independent/yamlfilecontent_probe.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,9 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f
396396
yaml_parser_initialize(&parser);
397397

398398
char *filepath = oscap_path_join(path, filename);
399+
if (probe_path_is_blocked(filepath, ctx->blocked_paths)) {
400+
goto cleanup;
401+
}
399402
char *filepath_with_prefix = oscap_path_join(prefix, filepath);
400403

401404
FILE *yaml_file = fopen(filepath_with_prefix, "r");

‎src/OVAL/probes/probe-api.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1794,4 +1794,20 @@ SEXP_t *probe_obj_getmask(SEXP_t *obj)
17941794
SEXP_free(objents);
17951795
return (mask);
17961796
}
1797+
1798+
bool probe_path_is_blocked(const char *path, struct oscap_list *blocked_paths)
1799+
{
1800+
bool res = false;
1801+
struct oscap_iterator *it = oscap_iterator_new(blocked_paths);
1802+
while (oscap_iterator_has_more(it)) {
1803+
const char *item = oscap_iterator_next(it);
1804+
if (oscap_path_startswith(path, item)) {
1805+
res = true;
1806+
break;
1807+
}
1808+
}
1809+
oscap_iterator_free(it);
1810+
return res;
1811+
}
1812+
17971813
/// @}

‎src/OVAL/probes/probe/probe.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ struct probe_ctx {
9494
int offline_mode;
9595
double max_mem_ratio;
9696
size_t max_collected_items;
97+
struct oscap_list *blocked_paths;
9798
};
9899

99100
typedef enum {

‎src/OVAL/probes/probe/worker.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -972,6 +972,23 @@ static SEXP_t *probe_set_eval(probe_t *probe, SEXP_t *set, size_t depth)
972972
return result;
973973
}
974974

975+
static void _add_blocked_paths(struct oscap_list *bpaths)
976+
{
977+
char *envar = getenv("OSCAP_PROBE_IGNORE_PATHS");
978+
if (envar == NULL) {
979+
return;
980+
}
981+
#ifdef OS_WINDOWS
982+
dW("OSCAP_PROBE_IGNORE_PATHS isn't effective on Windows.");
983+
#else
984+
char **paths = oscap_split(envar, ":");
985+
for (int i = 0; paths[i]; ++i) {
986+
oscap_list_add(bpaths, strdup(paths[i]));
987+
}
988+
free(paths);
989+
#endif
990+
}
991+
975992
/**
976993
* Worker thread function. This functions handles the evalution of objects and sets.
977994
* @param msg_in SEAP message with the request which contains the object to be evaluated
@@ -1083,6 +1100,9 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
10831100
}
10841101
}
10851102

1103+
pctx.blocked_paths = oscap_list_new();
1104+
_add_blocked_paths(pctx.blocked_paths);
1105+
10861106
/* simple object */
10871107
pctx.icache = probe->icache;
10881108
pctx.filters = probe_prepare_filters(probe, probe_in);
@@ -1142,6 +1162,7 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
11421162
SEXP_free(pctx.filters);
11431163
SEXP_free(probe_in);
11441164
SEXP_free(mask);
1165+
oscap_list_free(pctx.blocked_paths, free);
11451166
*ret = PROBE_EUNKNOWN;
11461167
return (NULL);
11471168
}
@@ -1181,6 +1202,7 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
11811202
}
11821203

11831204
SEXP_free(pctx.filters);
1205+
oscap_list_free(pctx.blocked_paths, free);
11841206
}
11851207

11861208
SEXP_free(probe_in);

0 commit comments

Comments
 (0)