Skip to content

Commit f2d9ec9

Browse files
committed
Fixed oscap-ssh failing to retrieve the result files when executing with --sudo
Depending on the umask configuration of the target system, "sudo oscap" may create the result files in temporary directory with 600 permissions, which makes retrieving the log (as the regular user that ssh'ed to the system) impossible: ~~~ $ oscap-ssh --sudo user@system 22 xccdf eval ... [...] oscap exit code: 0 Copying back requested files... scp: /tmp/tmp.0kfbPWEy6u/report.html: Permission denied Failed to copy the HTML report back to local machine! ~~~ Scenario to reproduce the failure: set a default umask in /etc/sudoers: ~~~ Defaults umask = 0077 ~~~ The fix consists in changing the result files' ownership from "root" to user's back, all while in the single sudo (using two sudo commands wouldn't be nice since the user may get the password prompt twice, depending on the sudo's configuration).
1 parent b641536 commit f2d9ec9

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

utils/oscap-ssh

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,12 @@ echo "Starting the evaluation..."
280280
# changing directory because of --oval-results support. oval results files are
281281
# dumped into PWD, and we can't be sure by the file names - we need controlled
282282
# environment
283-
ssh_execute_with_command_and_options "cd $REMOTE_TEMP_DIR; $OSCAP_SUDO oscap $(command_array_to_string oscap_args)" "$SSH_TTY_ALLOCATION_OPTION"
283+
if [ -z "$OSCAP_SUDO" ]; then
284+
ssh_execute_with_command_and_options "cd $REMOTE_TEMP_DIR; oscap $(command_array_to_string oscap_args)" "$SSH_TTY_ALLOCATION_OPTION"
285+
else
286+
OSCAP_CMD="oscap $(command_array_to_string oscap_args); rc=\$?; chown \$SUDO_USER $REMOTE_TEMP_DIR/*; exit \$rc"
287+
ssh_execute_with_command_and_options "cd $REMOTE_TEMP_DIR; $OSCAP_SUDO sh -c '$OSCAP_CMD'" "$SSH_TTY_ALLOCATION_OPTION"
288+
fi
284289
OSCAP_EXIT_CODE=$?
285290
echo "oscap exit code: $OSCAP_EXIT_CODE"
286291

0 commit comments

Comments
 (0)