I've been testing and it works fine on newer versions of openscap (those which includes --sudo option).
Adding --sudo to the evaluation args works fine, but we need all the program logic to decide whether to add --sudo to the args or not. And probably we need to store a flag to tell daemon when to run scans with sudo privileges.
I've been testing and it works fine on newer versions of openscap (those which includes --sudo option).
Adding --sudo to the evaluation args works fine, but we need all the program logic to decide whether to add --sudo to the args or not. And probably we need to store a flag to tell daemon when to run scans with sudo privileges.
Destination's machine mustn't require TTY to run sudo (scan fails if sudo requires a tty):
/etc/sudoers: Defaults requiretty -> #Defaults requiretty OR Defaults: !requiretty
It would be a "nice to have" feature whether allow users to run scans with sudo privileges or without them.