SCE & run scripts without permissions

[ybznek]

According to open-scap mailing list,

we are not able to execute SCE scripts without exec permissions (e.g. from /tmp with noexec mount option.)

In my opinion, we can parse shebang from script and use interpret to run it (/usr/bin/bash /tmp/sce.sh) - in similar way we run remediations. Can we run binary files in such way?

[ybznek]

@mpreisler You are much more familiar with SCE, can you please share your thoughts?

[mpreisler]

There are various tricks to do that, for example:

/usr/lib64/ld-linux-x86-64.so.2 /usr/bin/ls

It's tough to create a portable one. This will be different for linux32, linux64, bsd, OSX, ...

If we decide to do any of these tricks we should implement something like oscap-run-sce-script.sh which wraps all of them so we don't keep them in the C code. That also means that we will be shipping a ready-made execute permission bypassing code but to be honest everybody knows about these tricks so I don't think it matters that much.