Your message dated Fri, 23 Oct 2026 12:49:27 +0000
with message-id <[email protected]>
and subject line Bug#1149128: fixed in openscap 1.4.5+dfsg-1
has caused the Debian Bug report #1149128,
regarding openscap-scanner: SCE checks fail without openscap-utils when scripts
are not executable
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149128: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149128
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: openscap-scanner
Version: 1.4.2+dfsg-1
Severity: normal
The SCE engine in libopenscap33 falls back to /usr/bin/oscap-run-sce-script
when a check script is not executable. That helper ships in openscap-utils,
and nothing in the scanner's dependency chain pulls it in. With only
openscap-scanner installed, every SCE check that takes the fallback ends in
"error", and oscap prints nothing at default verbosity to say why.
The fallback matters in practice. When evaluating a data stream, oscap
extracts SCE scripts under /tmp, and both CIS and ANSSI BP-028 require /tmp
to be mounted noexec. So the scanner fails on exactly the systems those
benchmarks target.
Minimal reproducer on a clean trixie install. No content or mounts needed,
since chmod -x takes the same code path as a noexec /tmp.
$ sudo apt install openscap-scanner
$ mkdir sce-repro && cd sce-repro
$ cat > bench.xml <<'XML'
<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns=" http://checklists.nist.gov/xccdf/1.2 "
id="xccdf_org.example_benchmark_sce" resolved="1">
<status>draft</status>
<version>1</version>
<Rule id="xccdf_org.example_rule_sce" selected="true">
<title>SCE helper reproducer</title>
<check system=" http://open-scap.org/page/SCE ">
<check-content-ref href="check.sh"/>
</check>
</Rule>
</Benchmark>
XML
$ printf '#!/bin/sh\nexit "$XCCDF_RESULT_PASS"\n' > check.sh
$ chmod +x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result
Result pass
$ chmod -x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result
Result error
$ sudo apt install openscap-utils
$ oscap xccdf eval bench.xml 2>&1 | grep -i result
Result pass
Suggested fix: ship oscap-run-sce-script in openscap-common. It is a short
bash script, so Architecture: all fits, and openscap-scanner already depends
on openscap-common. openscap-scanner would work too. Either way the move
needs Breaks/Replaces: openscap-utils (<< fixed version).
Related:
- Upstream: https://github.com/OpenSCAP/openscap/issues/2414 (triaged)
- Upstream #2243, reported on Debian 13 and resolved by installing
openscap-utils: https://github.com/OpenSCAP/openscap/issues/2243
- Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openscap/+bug/2166636
Ubuntu carries no delta, so a Debian fix reaches Ubuntu as well.
Thomas Moore (realstuffie)
--- End Message ---
--- Begin Message ---
Source: openscap
Source-Version: 1.4.5+dfsg-1
Done: Håvard F. Aasen <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openscap, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Håvard F. Aasen <[email protected]> (supplier of updated openscap package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 20 Oct 2026 20:35:01 +0200
Source: openscap
Architecture: source
Version: 1.4.5+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Håvard F. Aasen <[email protected]>
Changed-By: Håvard F. Aasen <[email protected]>
Closes: 1149128
Changes:
openscap (1.4.5+dfsg-1) unstable; urgency=medium
.
* New upstream release.
* Rebase patches, removed two patches included in latest upstream release.
* Bump debhelper to 14.
* Remove substvars ${*:Depends} no longer necessary.
* Remove obsolete break/replace fields.
* Update copyright years.
* Update symbols after new upstream release.
* Ship oscap-run-sce-script in openscap-common instead of openscap-utils.
Thanks to Thomas Moore for the patch (Closes: #1149128, LP: #2166636)
Checksums-Sha1:
1968ea4bb0c8c0e3622bd42c4cb70378aac9ed00 2344 openscap_1.4.5+dfsg-1.dsc
41153c8dad973155be2b2eedc5a0d36c576daa65 5417640
openscap_1.4.5+dfsg.orig.tar.xz
cee6047adf0c37af49387b75100618ac4a47c31b 23604
openscap_1.4.5+dfsg-1.debian.tar.xz
c113ae8edb2c91532cf8c63f0ee50d40cf4a5537 16263
openscap_1.4.5+dfsg-1_amd64.buildinfo
Checksums-Sha256:
e0ddf7d86dbc5ff54c398ae1433dd0ef663a74184472b1a01042df66b798c9e7 2344
openscap_1.4.5+dfsg-1.dsc
c0c785776c47671f6edbfd648f505b27a71b358fed65b6c1fb8241cee6aece8c 5417640
openscap_1.4.5+dfsg.orig.tar.xz
ce02bc67c0850ead0c9782d48e7b92aa31d47403f1feca424591d8299f5e3c45 23604
openscap_1.4.5+dfsg-1.debian.tar.xz
37ac7e56925ca0e8c1fcec79cc4e0e9e239116bd9692d6cd3c05d6d294ec216e 16263
openscap_1.4.5+dfsg-1_amd64.buildinfo
Files:
ea7bbcfe4269d382a7aface6de725685 2344 admin optional openscap_1.4.5+dfsg-1.dsc
308a3a3df2bced7b21cc04d59d668d1d 5417640 admin optional
openscap_1.4.5+dfsg.orig.tar.xz
6341a05173b34a5d62a6d0a5b6d13094 23604 admin optional
openscap_1.4.5+dfsg-1.debian.tar.xz
c0fa68f6d90e4622bfea8a2652e76f80 16263 admin optional
openscap_1.4.5+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iI0EARYKADUWIQSD/42dLkLq3fzhpN2I4w6v/UfCtwUCattQbhccaGF2YXJkLmYu
YWFzZW5AcGZmdC5ubwAKCRCI4w6v/UfCt/njAQCKBV7soFZL1FMPTQWXScxD280O
eR9ZFPcQ9dp9oYbaMgEA87DHYUQH+ftNaZKEGzUC2RpTXi8vopOsC2JVhBCR2w4=
=sxPq
-----END PGP SIGNATURE-----
pgp23CLlP0Qqs.pgp
Description: PGP signature
--- End Message ---
