Skip to content

Commit e52a6fb

Browse files
jan-cernyjan-cerny
committed
Do not execute probes if they don't support offline mode
If a probe didn't support offline mode, eg. systemdunitproperty probe, we didn't call chroot and we executed the probe_*main function which meant it scanned the host. We should terminate and return notapplicable if offline mode is requested and the probe does not support it.
1 parent ffba4b9 commit e52a6fb

File tree

2 files changed

+71
-78
lines changed

2 files changed

+71
-78
lines changed

‎src/OVAL/probes/probe/input_handler.c

Lines changed: 62 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -122,99 +122,86 @@ void *probe_input_handler(void *arg)
122122

123123
if (oid != NULL) {
124124
SEXP_VALIDATE(oid);
125+
probe_out = probe_rcache_sexp_get(probe->rcache, oid);
125126

126-
if (probe->offline_mode && probe->supported_offline_mode == PROBE_OFFLINE_NONE) {
127-
dW("Requested offline mode is not supported by %s probe.", oval_subtype_get_text(probe->subtype));
128-
/* Return a dummy. */
129-
probe_out = probe_cobj_new(SYSCHAR_FLAG_NOT_APPLICABLE, NULL, NULL, NULL);
130-
probe_ret = 0;
131-
SEXP_free(oid);
127+
if (probe_out == NULL) { /* cache miss */
128+
SEXP_t *skip_flag, *obj_mask;
129+
130+
skip_flag = probe_obj_getattrval(probe_in, "skip_eval");
131+
obj_mask = probe_obj_getmask(probe_in);
132132
SEXP_free(probe_in);
133-
oid = NULL;
134133
probe_in = NULL;
135-
}
136-
else {
137-
probe_out = probe_rcache_sexp_get(probe->rcache, oid);
138-
139-
if (probe_out == NULL) { /* cache miss */
140-
SEXP_t *skip_flag, *obj_mask;
141134

142-
skip_flag = probe_obj_getattrval(probe_in, "skip_eval");
143-
obj_mask = probe_obj_getmask(probe_in);
144-
SEXP_free(probe_in);
145-
probe_in = NULL;
135+
if (skip_flag != NULL) {
136+
oval_syschar_collection_flag_t cobj_flag;
146137

147-
if (skip_flag != NULL) {
148-
oval_syschar_collection_flag_t cobj_flag;
138+
cobj_flag = SEXP_number_geti_32(skip_flag);
139+
probe_out = probe_cobj_new(cobj_flag, NULL, NULL, obj_mask);
149140

150-
cobj_flag = SEXP_number_geti_32(skip_flag);
151-
probe_out = probe_cobj_new(cobj_flag, NULL, NULL, obj_mask);
141+
if (probe_rcache_sexp_add(probe->rcache, oid, probe_out) != 0) {
142+
/* TODO */
143+
abort();
144+
}
152145

153-
if (probe_rcache_sexp_add(probe->rcache, oid, probe_out) != 0) {
154-
/* TODO */
155-
abort();
156-
}
146+
probe_ret = 0;
147+
SEXP_free(oid);
148+
SEXP_free(skip_flag);
149+
SEXP_free(obj_mask);
150+
} else {
157151

158-
probe_ret = 0;
159-
SEXP_free(oid);
160-
SEXP_free(skip_flag);
161-
SEXP_free(obj_mask);
152+
SEXP_free(oid);
153+
SEXP_free(skip_flag);
154+
SEXP_free(obj_mask);
155+
156+
probe_pwpair_t *pair = malloc(sizeof(probe_pwpair_t));
157+
pair->probe = probe;
158+
pair->pth = probe_worker_new();
159+
pair->pth->sid = SEAP_msg_id(seap_request);
160+
pair->pth->msg = seap_request;
161+
pair->pth->msg_handler = &probe_worker;
162+
163+
if (rbt_i32_add(probe->workers, pair->pth->sid, pair->pth, NULL) != 0) {
164+
/*
165+
* Getting here means that there is already a
166+
* thread handling the message with the given
167+
* ID.
168+
*/
169+
dW("Attempt to evaluate an object "
170+
"(ID=%u) " // TODO: 64b IDs
171+
"which is already being evaluated by an other thread.", pair->pth->sid);
172+
173+
free(pair->pth);
174+
free(pair);
175+
SEAP_msg_free(seap_request);
162176
} else {
177+
/* OK */
178+
179+
if (pthread_create(&pair->pth->tid, &pth_attr, &probe_worker_runfn, pair))
180+
{
181+
dE("Cannot start a new worker thread: %d, %s.", errno, strerror(errno));
163182

164-
SEXP_free(oid);
165-
SEXP_free(skip_flag);
166-
SEXP_free(obj_mask);
167-
168-
probe_pwpair_t *pair = malloc(sizeof(probe_pwpair_t));
169-
pair->probe = probe;
170-
pair->pth = probe_worker_new();
171-
pair->pth->sid = SEAP_msg_id(seap_request);
172-
pair->pth->msg = seap_request;
173-
pair->pth->msg_handler = &probe_worker;
174-
175-
if (rbt_i32_add(probe->workers, pair->pth->sid, pair->pth, NULL) != 0) {
176-
/*
177-
* Getting here means that there is already a
178-
* thread handling the message with the given
179-
* ID.
180-
*/
181-
dW("Attempt to evaluate an object "
182-
"(ID=%u) " // TODO: 64b IDs
183-
"which is already being evaluated by an other thread.", pair->pth->sid);
183+
if (rbt_i32_del(probe->workers, pair->pth->sid, NULL) != 0)
184+
dE("rbt_i32_del: failed to remove worker thread (ID=%u)", pair->pth->sid);
184185

186+
SEAP_msg_free(pair->pth->msg);
185187
free(pair->pth);
186188
free(pair);
187-
SEAP_msg_free(seap_request);
188-
} else {
189-
/* OK */
190189

191-
if (pthread_create(&pair->pth->tid, &pth_attr, &probe_worker_runfn, pair))
192-
{
193-
dE("Cannot start a new worker thread: %d, %s.", errno, strerror(errno));
190+
probe_ret = PROBE_EUNKNOWN;
191+
probe_out = NULL;
194192

195-
if (rbt_i32_del(probe->workers, pair->pth->sid, NULL) != 0)
196-
dE("rbt_i32_del: failed to remove worker thread (ID=%u)", pair->pth->sid);
197-
198-
SEAP_msg_free(pair->pth->msg);
199-
free(pair->pth);
200-
free(pair);
201-
202-
probe_ret = PROBE_EUNKNOWN;
203-
probe_out = NULL;
204-
205-
goto __error_reply;
206-
}
193+
goto __error_reply;
207194
}
208-
209-
seap_request = NULL;
210-
continue;
211195
}
212-
} else {
213-
/* cache hit */
214-
SEXP_free(oid);
215-
SEXP_free(probe_in);
216-
probe_ret = 0;
196+
197+
seap_request = NULL;
198+
continue;
217199
}
200+
} else {
201+
/* cache hit */
202+
SEXP_free(oid);
203+
SEXP_free(probe_in);
204+
probe_ret = 0;
218205
}
219206
} else {
220207
/* the `id' was not found in the input object */

‎src/OVAL/probes/probe/worker.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -982,12 +982,16 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
982982
*/
983983
rootdir = getenv("OSCAP_PROBE_ROOT");
984984
if ((rootdir != NULL) && (strlen(rootdir) > 0)) {
985-
probe->offline_mode = true;
986-
987985
preload_libraries_before_chroot(); // todo - maybe useless for own mode
988986

989-
if (probe->supported_offline_mode & PROBE_OFFLINE_OWN) {
987+
if (probe->supported_offline_mode == PROBE_OFFLINE_NONE) {
988+
dW("Requested offline mode is not supported by %s probe.", oval_subtype_get_text(probe->subtype));
989+
*ret = 0;
990+
return probe_cobj_new(SYSCHAR_FLAG_NOT_APPLICABLE, NULL, NULL, NULL);
991+
992+
} else if (probe->supported_offline_mode & PROBE_OFFLINE_OWN) {
990993
dI("Switching probe to PROBE_OFFLINE_OWN mode.");
994+
probe->offline_mode = true;
991995
probe->selected_offline_mode = PROBE_OFFLINE_OWN;
992996

993997
} else if (probe->supported_offline_mode & PROBE_OFFLINE_CHROOT) {
@@ -1008,12 +1012,14 @@ SEXP_t *probe_worker(probe_t *probe, SEAP_msg_t *msg_in, int *ret)
10081012
* mechanism to control this behaviour in the future.
10091013
*/
10101014
dI("Switching probe to PROBE_OFFLINE_CHROOT mode.");
1015+
probe->offline_mode = true;
10111016
probe->selected_offline_mode = PROBE_OFFLINE_CHROOT;
10121017
}
10131018
}
10141019

10151020
if (getenv("OSCAP_PROBE_RPMDB_PATH") != NULL) {
10161021
dI("Switching probe to PROBE_OFFLINE_RPMDB mode.");
1022+
probe->offline_mode = true;
10171023
probe->selected_offline_mode = PROBE_OFFLINE_RPMDB;
10181024
}
10191025
#endif

0 commit comments

Comments
 (0)