From 46a32f5d1cbdc2724ade52fc03b7cd93994346ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Fri, 30 Oct 2026 13:54:13 +0100 Subject: [PATCH] Fail if verbose log can't be created MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When running `oscap`, if the `--verbose-log-file` points to a directory that does not exist, `oscap` runs, does nothing, and exits with 0 indicating no error. No error gets printed to the shell. The reason is incorrect handling of return value of `oscap_set_verbose` in `oscap_module_process` in `utils/oscap-tool.c`. Moreover, the error messages use the `oscap_seterr` doesn’t print anything because the error stack isn't printed on the failure path. With this change, OpenSCAP will print an error message and terminate with 1 if a non-existing directory path is provided in the `--verbose-log-file` option. Resolves: https://redhat.atlassian.net/browse/RHEL-295815 --- tests/common/CMakeLists.txt | 3 +++ tests/common/test_verbose_error.c | 29 +++++++++++++++++++++++++++++ tests/utils/test_verbose_options.sh | 7 +++++++ utils/oscap-tool.c | 3 +++ 4 files changed, 42 insertions(+) create mode 100644 tests/common/test_verbose_error.c diff --git a/tests/common/CMakeLists.txt b/tests/common/CMakeLists.txt index 38e2a85818..e24d74d7d4 100644 --- a/tests/common/CMakeLists.txt +++ b/tests/common/CMakeLists.txt @@ -7,6 +7,9 @@ add_oscap_test_executable(test_oscap_util add_oscap_test("test_oscap_util.sh") +add_oscap_test_executable(test_verbose_error "test_verbose_error.c") +add_oscap_ctest("common/test_verbose_error" COMMAND test_verbose_error) + if(NOT WIN32) add_oscap_test_executable(test_tmpdir "test_tmpdir.c") add_oscap_test("test_tmpdir.sh") diff --git a/tests/common/test_verbose_error.c b/tests/common/test_verbose_error.c new file mode 100644 index 0000000000..0457019c02 --- /dev/null +++ b/tests/common/test_verbose_error.c @@ -0,0 +1,29 @@ +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include +#include +#include + +#include "common/public/oscap.h" +#include "common/public/oscap_debug.h" +#include "common/public/oscap_error.h" + +int main(void) +{ + oscap_init(); + oscap_clearerr(); + /* An empty filename cannot be opened, regardless of filesystem permissions. */ + bool success = oscap_set_verbose("INFO", ""); + const char *description = oscap_err_desc(); + int ret = 0; + if (success || !oscap_err() || oscap_err_family() != OSCAP_EFAMILY_OSCAP || + description == NULL || strstr(description, "Failed to open file") == NULL) { + fprintf(stderr, "Log initialization failure did not populate the library error queue.\n"); + ret = 1; + } + oscap_cleanup(); + return ret; +} diff --git a/tests/utils/test_verbose_options.sh b/tests/utils/test_verbose_options.sh index a15d14c00f..124a0893da 100755 --- a/tests/utils/test_verbose_options.sh +++ b/tests/utils/test_verbose_options.sh @@ -32,4 +32,11 @@ grep -q "I: oscap: Identified document type: Benchmark" "$verblofile" $OSCAP xccdf eval --verbose INFO --profile default --results "$results" --verbose-log-file "$verblofile" "$xccdf" >/dev/null 2>/dev/null grep -q "I: oscap: Identified document type: Benchmark" "$verblofile" +# A regular file cannot be used as the parent directory of the log file. +status=0 +$OSCAP info --verbose INFO --verbose-log-file "$verblofile/log" "$xccdf" >"$results" 2>"$stderr" || status=$? +test "$status" -eq 1 +test ! -s "$results" +grep -Fq "Failed to open file $verblofile/log:" "$stderr" + rm -f "$results" "$stderr" "$verblofile" diff --git a/utils/oscap-tool.c b/utils/oscap-tool.c index 4afcec69bf..e9bab1fc8f 100644 --- a/utils/oscap-tool.c +++ b/utils/oscap-tool.c @@ -364,9 +364,12 @@ int oscap_module_process(struct oscap_module *module, int argc, char **argv) if (module->func) { if (!check_verbose_options(&action)) { + ret = OSCAP_ERROR; goto cleanup; } if (!oscap_set_verbose(action.verbosity_level, action.f_verbose_log)) { + oscap_print_error(); + ret = OSCAP_ERROR; goto cleanup; } oscap_print_env_vars();