Package: openscap-scanner Version: 1.4.2+dfsg-1
Severity: normal The SCE engine in libopenscap33 falls back to /usr/bin/oscap-run-sce-script when a check script is not executable. That helper ships in openscap-utils, and nothing in the scanner's dependency chain pulls it in. With only openscap-scanner installed, every SCE check that takes the fallback ends in "error", and oscap prints nothing at default verbosity to say why. The fallback matters in practice. When evaluating a data stream, oscap extracts SCE scripts under /tmp, and both CIS and ANSSI BP-028 require /tmp to be mounted noexec. So the scanner fails on exactly the systems those benchmarks target. Minimal reproducer on a clean trixie install. No content or mounts needed, since chmod -x takes the same code path as a noexec /tmp. $ sudo apt install openscap-scanner $ mkdir sce-repro && cd sce-repro $ cat > bench.xml <<'XML' <?xml version="1.0" encoding="UTF-8"?> <Benchmark xmlns=" http://checklists.nist.gov/xccdf/1.2 " id="xccdf_org.example_benchmark_sce" resolved="1"> <status>draft</status> <version>1</version> <Rule id="xccdf_org.example_rule_sce" selected="true"> <title>SCE helper reproducer</title> <check system=" http://open-scap.org/page/SCE "> <check-content-ref href="check.sh"/> </check> </Rule> </Benchmark> XML $ printf '#!/bin/sh\nexit "$XCCDF_RESULT_PASS"\n' > check.sh $ chmod +x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result Result pass $ chmod -x check.sh; oscap xccdf eval bench.xml 2>&1 | grep -i result Result error $ sudo apt install openscap-utils $ oscap xccdf eval bench.xml 2>&1 | grep -i result Result pass Suggested fix: ship oscap-run-sce-script in openscap-common. It is a short bash script, so Architecture: all fits, and openscap-scanner already depends on openscap-common. openscap-scanner would work too. Either way the move needs Breaks/Replaces: openscap-utils (<< fixed version). Related: - Upstream: https://github.com/OpenSCAP/openscap/issues/2414 (triaged) - Upstream #2243, reported on Debian 13 and resolved by installing openscap-utils: https://github.com/OpenSCAP/openscap/issues/2243 - Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openscap/+bug/2166636 Ubuntu carries no delta, so a Debian fix reaches Ubuntu as well. Thomas Moore (realstuffie)
