Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(scanner/redhatbase): fix cmd in scanUpdatablePackages #2156

Merged
merged 1 commit into from
Mar 25, 2025
Merged

fix(scanner/redhatbase): fix cmd in scanUpdatablePackages #2156

merged 1 commit into from
Mar 25, 2025

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Mar 25, 2025 •
edited
Loading

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

fedora 40

$ sh-5.2# repoquery --version
4.21.1
  Installed: dnf-0:4.21.1-1.fc40.noarch at Thu Oct 31 05:48:20 2024
  Built    : Fedora Project at Fri Aug 16 14:34:26 2024

  Installed: rpm-0:4.19.1.1-1.fc40.x86_64 at Thu Oct 31 05:48:20 2024
  Built    : Fedora Project at Wed Feb  7 15:55:53 2024

fedora 41

sh-5.2# repoquery --version
4.23.0
  Installed: rpm-0:4.20.1-1.fc41.x86_64 at Tue Mar 25 05:07:30 2025
  Built    : Fedora Project at Tue Mar 11 09:18:03 2025

Since the output of repoquery --version in Fedora 41 does not include dnf, the repoquery command for dnf is not selected. Therefore, a warning is generated.

vuls/scanner/redhatbase.go

Line 771 in 6aa3811

isDnf := o.exec(util.PrependProxyEnv(`repoquery --version | grep dnf`), o.sudo.repoquery()).isSuccess()

Therefore, in Fedora 41 and later, a fixed repoquery command is used.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

before

$ vuls scan
[Mar 25 14:37:21]  INFO [localhost] vuls-0.30.0-358cbf59b8480330cebed319dee1bfc4c5704c7e-2025-03-18T06:42:29Z
[Mar 25 14:37:21]  INFO [localhost] Start scanning
[Mar 25 14:37:21]  INFO [localhost] config: /home/vuls/config.toml
[Mar 25 14:37:21]  INFO [localhost] Validating config...
[Mar 25 14:37:21]  INFO [localhost] Detecting Server/Container OS... 
[Mar 25 14:37:21]  INFO [localhost] Detecting OS of servers... 
[Mar 25 14:37:22]  INFO [localhost] (1/1) Detected: docker: fedora 41
[Mar 25 14:37:22]  INFO [localhost] Detecting OS of containers... 
[Mar 25 14:37:22]  INFO [localhost] Checking Scan Modes... 
[Mar 25 14:37:22]  INFO [localhost] Detecting Platforms... 
[Mar 25 14:37:24]  INFO [localhost] (1/1) docker is running on other
[Mar 25 14:37:24]  INFO [docker] Scanning OS pkg in fast-root mode
[Mar 25 14:37:24]  WARN [docker] err: Failed to scan updatable packages:
    github.com/future-architect/vuls/scanner.(*redhatBase).scanPackages
        github.com/future-architect/vuls/scanner/redhatbase.go:439
  - Failed to SSH: execResult: servername: docker
      cmd: /usr/bin/ssh -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/mainek00n/.vuls/cm-a3722a6d-%C -o Controlpersist=10m -l root -p 2222 -i /home/vuls-targets-docker/.ssh/id_rsa -o PasswordAuthentication=no 127.0.0.1
      exitstatus: 2
      stdout: 
      stderr: stty: 'standard input': Inappropriate ioctl for device
    usage: dnf repoquery [-c CONFIG_FILE] [-q] [-v] [--version]
                         [--installroot PATH]] [--nodocs] [--noplugins]
                         [--enableplugin PLUGIN]] [--disableplugin PLUGIN]]
                         [--releasever RELEASEVER]
                         [--releasever-major RELEASEVER_MAJOR]
                         [--releasever-minor RELEASEVER_MINOR] [--setopt SETOPTS]
                         [--skip-broken] [-h] [--allowerasing] [-b | --nobest]
                         [-C] [-R MINUTES] [-d DEBUG_LEVEL] [--debugsolver]
                         [--showduplicates] [-e ERRORLEVEL] [--obsoletes]
                         [--rpmverbosity DEBUG_LEVEL_NAME] [-y] [--assumeno]
                         [--enablerepo REPO] [--disablerepo REPO | --repo REPO]
                         [--enable | --disable] [-x PACKAGE]
                         [--disableexcludes {all, main, REPOID}]
                         [--repofrompath REPO,PATH] [--noautoremove]
                         [--nogpgcheck] [--color COLOR] [--refresh] [-4] [-6]
                         [--destdir DESTDIR] [--downloadonly] [--transient]
                         [--comment COMMENT] [--bugfix] [--enhancement]
                         [--newpackage] [--security] [--advisory ADVISORY]
                         [--bz BUGZILLA] [--cve CVES]
                         [--sec-severity {Critical,Important,Moderate,Low}]
                         [--forcearch ARCH] [-a] [--show-duplicates] [--arch ARCH]
                         [-f FILE [FILE ...]] [--whatconflicts REQ]
                         [--whatdepends REQ] [--whatobsoletes REQ]
                         [--whatprovides REQ] [--whatrequires REQ]
                         [--whatrecommends REQ] [--whatenhances REQ]
                         [--whatsuggests REQ] [--whatsupplements REQ] [--alldeps |
                         --exactdeps] [--recursive] [--deplist] [--resolve]
                         [--tree] [--srpm] [--latest-limit LATEST_LIMIT]
                         [--disable-modular-filtering] [-i] [-l] [-s]
                         [--changelogs] [--qf QUERYFORMAT] [--querytags] [--nevra]
                         [--nvr] [--envra] [--groupmember] [--duplicates |
                         --installonly | --unsatisfied] [--location]
                         [--conflicts | --depends | --enhances | --provides |
                         --recommends | --requires | --requires-pre | --suggests |
                         --supplements] [--available] [--installed | --extras |
                         --upgrades | --unneeded | --userinstalled] [--recent]
                         [KEY ...]
    dnf repoquery: error: unrecognized arguments: --pkgnarrow=updates
    
      err: %!s(<nil>):
    github.com/future-architect/vuls/scanner.(*redhatBase).scanUpdatablePackages
        github.com/future-architect/vuls/scanner/redhatbase.go:782
[Mar 25 14:37:25]  WARN [docker] Failed to detect a init system: File: /proc/1/exe -> /usr/sbin/sshd
[Mar 25 14:37:25]  WARN [localhost] Some warnings occurred during scanning on docker. Please fix the warnings to get a useful information. Execute configtest subcommand before scanning to know the cause of the warnings. warnings: [Failed to scan updatable packages:
    github.com/future-architect/vuls/scanner.(*redhatBase).scanPackages
        github.com/future-architect/vuls/scanner/redhatbase.go:439
  - Failed to SSH: execResult: servername: docker
      cmd: /usr/bin/ssh -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/mainek00n/.vuls/cm-a3722a6d-%C -o Controlpersist=10m -l root -p 2222 -i /home/vuls-targets-docker/.ssh/id_rsa -o PasswordAuthentication=no 127.0.0.1
      exitstatus: 2
      stdout: 
      stderr: stty: 'standard input': Inappropriate ioctl for device
    usage: dnf repoquery [-c CONFIG_FILE] [-q] [-v] [--version]
                         [--installroot PATH]] [--nodocs] [--noplugins]
                         [--enableplugin PLUGIN]] [--disableplugin PLUGIN]]
                         [--releasever RELEASEVER]
                         [--releasever-major RELEASEVER_MAJOR]
                         [--releasever-minor RELEASEVER_MINOR] [--setopt SETOPTS]
                         [--skip-broken] [-h] [--allowerasing] [-b | --nobest]
                         [-C] [-R MINUTES] [-d DEBUG_LEVEL] [--debugsolver]
                         [--showduplicates] [-e ERRORLEVEL] [--obsoletes]
                         [--rpmverbosity DEBUG_LEVEL_NAME] [-y] [--assumeno]
                         [--enablerepo REPO] [--disablerepo REPO | --repo REPO]
                         [--enable | --disable] [-x PACKAGE]
                         [--disableexcludes {all, main, REPOID}]
                         [--repofrompath REPO,PATH] [--noautoremove]
                         [--nogpgcheck] [--color COLOR] [--refresh] [-4] [-6]
                         [--destdir DESTDIR] [--downloadonly] [--transient]
                         [--comment COMMENT] [--bugfix] [--enhancement]
                         [--newpackage] [--security] [--advisory ADVISORY]
                         [--bz BUGZILLA] [--cve CVES]
                         [--sec-severity {Critical,Important,Moderate,Low}]
                         [--forcearch ARCH] [-a] [--show-duplicates] [--arch ARCH]
                         [-f FILE [FILE ...]] [--whatconflicts REQ]
                         [--whatdepends REQ] [--whatobsoletes REQ]
                         [--whatprovides REQ] [--whatrequires REQ]
                         [--whatrecommends REQ] [--whatenhances REQ]
                         [--whatsuggests REQ] [--whatsupplements REQ] [--alldeps |
                         --exactdeps] [--recursive] [--deplist] [--resolve]
                         [--tree] [--srpm] [--latest-limit LATEST_LIMIT]
                         [--disable-modular-filtering] [-i] [-l] [-s]
                         [--changelogs] [--qf QUERYFORMAT] [--querytags] [--nevra]
                         [--nvr] [--envra] [--groupmember] [--duplicates |
                         --installonly | --unsatisfied] [--location]
                         [--conflicts | --depends | --enhances | --provides |
                         --recommends | --requires | --requires-pre | --suggests |
                         --supplements] [--available] [--installed | --extras |
                         --upgrades | --unneeded | --userinstalled] [--recent]
                         [KEY ...]
    dnf repoquery: error: unrecognized arguments: --pkgnarrow=updates
    
      err: %!s(<nil>):
    github.com/future-architect/vuls/scanner.(*redhatBase).scanUpdatablePackages
        github.com/future-architect/vuls/scanner/redhatbase.go:782]


Scan Summary
================
docker	fedora41	216 installed, 0 updatable

Warning: [Failed to scan updatable packages:
    github.com/future-architect/vuls/scanner.(*redhatBase).scanPackages
        github.com/future-architect/vuls/scanner/redhatbase.go:439
  - Failed to SSH: execResult: servername: docker
      cmd: /usr/bin/ssh -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/home/mainek00n/.vuls/cm-a3722a6d-%C -o Controlpersist=10m -l root -p 2222 -i /home/vuls-targets-docker/.ssh/id_rsa -o PasswordAuthentication=no 127.0.0.1
      exitstatus: 2
      stdout: 
      stderr: stty: 'standard input': Inappropriate ioctl for device
    usage: dnf repoquery [-c CONFIG_FILE] [-q] [-v] [--version]
                         [--installroot PATH]] [--nodocs] [--noplugins]
                         [--enableplugin PLUGIN]] [--disableplugin PLUGIN]]
                         [--releasever RELEASEVER]
                         [--releasever-major RELEASEVER_MAJOR]
                         [--releasever-minor RELEASEVER_MINOR] [--setopt SETOPTS]
                         [--skip-broken] [-h] [--allowerasing] [-b | --nobest]
                         [-C] [-R MINUTES] [-d DEBUG_LEVEL] [--debugsolver]
                         [--showduplicates] [-e ERRORLEVEL] [--obsoletes]
                         [--rpmverbosity DEBUG_LEVEL_NAME] [-y] [--assumeno]
                         [--enablerepo REPO] [--disablerepo REPO | --repo REPO]
                         [--enable | --disable] [-x PACKAGE]
                         [--disableexcludes {all, main, REPOID}]
                         [--repofrompath REPO,PATH] [--noautoremove]
                         [--nogpgcheck] [--color COLOR] [--refresh] [-4] [-6]
                         [--destdir DESTDIR] [--downloadonly] [--transient]
                         [--comment COMMENT] [--bugfix] [--enhancement]
                         [--newpackage] [--security] [--advisory ADVISORY]
                         [--bz BUGZILLA] [--cve CVES]
                         [--sec-severity {Critical,Important,Moderate,Low}]
                         [--forcearch ARCH] [-a] [--show-duplicates] [--arch ARCH]
                         [-f FILE [FILE ...]] [--whatconflicts REQ]
                         [--whatdepends REQ] [--whatobsoletes REQ]
                         [--whatprovides REQ] [--whatrequires REQ]
                         [--whatrecommends REQ] [--whatenhances REQ]
                         [--whatsuggests REQ] [--whatsupplements REQ] [--alldeps |
                         --exactdeps] [--recursive] [--deplist] [--resolve]
                         [--tree] [--srpm] [--latest-limit LATEST_LIMIT]
                         [--disable-modular-filtering] [-i] [-l] [-s]
                         [--changelogs] [--qf QUERYFORMAT] [--querytags] [--nevra]
                         [--nvr] [--envra] [--groupmember] [--duplicates |
                         --installonly | --unsatisfied] [--location]
                         [--conflicts | --depends | --enhances | --provides |
                         --recommends | --requires | --requires-pre | --suggests |
                         --supplements] [--available] [--installed | --extras |
                         --upgrades | --unneeded | --userinstalled] [--recent]
                         [KEY ...]
    dnf repoquery: error: unrecognized arguments: --pkgnarrow=updates
    
      err: %!s(<nil>):
    github.com/future-architect/vuls/scanner.(*redhatBase).scanUpdatablePackages
        github.com/future-architect/vuls/scanner/redhatbase.go:782]



To view the detail, vuls tui is useful.
To send a report, run vuls report -h.

after

$ vuls scan
[Mar 25 14:27:51]  INFO [localhost] vuls-v0.30.0-build-20250325_142536_6aa3811
[Mar 25 14:27:51]  INFO [localhost] Start scanning
[Mar 25 14:27:51]  INFO [localhost] config: /home/vuls/config.toml
[Mar 25 14:27:51]  INFO [localhost] Validating config...
[Mar 25 14:27:51]  INFO [localhost] Detecting Server/Container OS... 
[Mar 25 14:27:51]  INFO [localhost] Detecting OS of servers... 
[Mar 25 14:27:51]  INFO [localhost] (1/1) Detected: docker: fedora 41
[Mar 25 14:27:51]  INFO [localhost] Detecting OS of containers... 
[Mar 25 14:27:51]  INFO [localhost] Checking Scan Modes... 
[Mar 25 14:27:51]  INFO [localhost] Detecting Platforms... 
[Mar 25 14:27:53]  INFO [localhost] (1/1) docker is running on other
[Mar 25 14:27:53]  INFO [docker] Scanning OS pkg in fast-root mode
[Mar 25 14:28:10]  WARN [docker] Failed to detect a init system: File: /proc/1/exe -> /usr/sbin/sshd


Scan Summary
================
docker	fedora41	216 installed, 14 updatable





To view the detail, vuls tui is useful.
To send a report, run vuls report -h.

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Mar 25, 2025
@MaineK00n MaineK00n requested a review from shino March 25, 2025 05:38
shino
shino approved these changes Mar 25, 2025
View reviewed changes
Copy link
Collaborator

@shino shino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🍻

@MaineK00n MaineK00n merged commit ccaadbb into master Mar 25, 2025
7 checks passed
@MaineK00n MaineK00n deleted the MaineK00n/f41 branch March 25, 2025 07:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shino shino shino approved these changes

Assignees

@MaineK00n MaineK00n

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MaineK00n @shino