RHSecurityCompliance / contest

Content Testing for ComplianceAsCode/content
Other
4 stars 7 forks source link

YAML-result-reporting code is not robust enough #226

Closed comps closed 1 week ago

comps commented 3 months ago

It seems there is a corner case that resulted in

- "name": "/playbook: Ensure sysctl kernel.unprivileged_bpf_disabled is set"
  "result": "error"
  "note": "{\"changed\": false, \"msg\": \"Failed to reload sysctl: kernel.core_pattern = \nkernel.core_uses_pid = 0\nkernel.perf_event_paranoid = 2\nsysctl: setting key \\"kernel.unprivileged_bpf_disabled\\": Operation not permitted\n\"}"
- "name": "/"
  "result": "error"
  "note": "CalledProcessError: Command '['scp', '-q', '-i', '/var/lib/libvirt/images/contest.sshkey', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/dev/null', PosixPath('/root/upstream-content/build/ssg-rhel10-ds.xml'), 'root@192.168.121.140:scan-ds.xml']' returned non-zero exit status 255."
  "log": ['../output.txt']

probably from

2024-07-17 00:39:35 test.py:46: lib.results.report_plain:182: ERROR playbook: Ensure sysctl kernel.unprivileged_bpf_disabled is set ({"changed": false, "msg": "Failed to reload sysctl: kernel.core_pattern = \nkernel.core_uses_pid = 0\nkernel.perf_event_paranoid = 2\nsysctl: setting key \"kernel.unprivileged_bpf_disabled\": Operation not permitted\n"})

It seems the lib.results code isn't able to deal with \" in test name (or note), changing it to \\", which just escapes the \ and leaves " intact to break the YAML syntax.

comps commented 1 week ago

This should no longer be an issue after switching to PyYAML.