Public bug reported:
Ubuntu 26.04.1 LTS
openscap-scanner: 1.4.3+dfsg-1build1
OpenSCAP: 1.4.3
The openscap-scanner package does not install or depend on the
oscap-run-sce-script helper, although the OpenSCAP SCE engine uses it when
/tmp is mounted with noexec.
Initial package set:
openscap-scanner
openscap-common
libopenscap33
With /tmp mounted noexec:
$ command -v oscap-run-sce-script
command not found
$ sudo oscap xccdf eval \
--tailoring-file ~/.config/openscap/ubuntu2604-server-testing.xml \
--profile xccdf_local_profile_cis_l1_server_quick \
--rule xccdf_org.ssgproject.content_rule_apt_configure_check_date \
--cpe build/ssg-ubuntu2604-cpe-dictionary.xml \
--progress \
build/ssg-ubuntu2604-ds.xml
xccdf_org.ssgproject.content_rule_apt_configure_check_date:error
OpenSCAP Error: Unable to open file:
'/usr/share/openscap/cpe/openscap-cpe-dict.xml'
Installing openscap-utils provides:
/usr/bin/oscap-run-sce-script
With the same /tmp noexec mount and the same command, the result
becomes:
xccdf_org.ssgproject.content_rule_apt_configure_check_date:pass
The upstream OpenSCAP fix for this behavior is issue #528:
https://github.com/OpenSCAP/openscap/issues/528
Expected behavior:
openscap-scanner should work with noexec /tmp using the SCE fallback,
without requiring users to discover and install an unrelated optional
utilities package.
Possible fixes include moving oscap-run-sce-script into a package installed
with openscap-scanner, or creating a small runtime helper package.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: openscap-scanner 1.4.3+dfsg-1build1
ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Mon Sep 7 17:24:36 2026
InstallationDate: Installed on 2025-11-07 (304 days ago)
InstallationMedia: Kubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
SourcePackage: openscap
UpgradeStatus: Upgraded to resolute on 2026-02-15 (204 days ago)
** Affects: openscap (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166636
Title:
openscap-scanner SCE checks fail with /tmp mounted noexec unless
openscap-utils is installed
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openscap/+bug/2166636/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
