-
Notifications
You must be signed in to change notification settings - Fork 6
Description
🐛 Summary
Currently if the vulnscan.py will only delete the policy it creates if a job is able to run to successful completion. This can result in a number of orphaned policies for failed jobs on the Nessus server.
To reproduce
You can see that the policy removal logic in
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 454 to 459 in 5a60049
| # delete policy | |
| LOGGER.info("Deleting policy id: %s", new_policy_id) | |
| result = controller.policy_delete(new_policy_id) | |
| if not result: | |
| error_exit("No result returned when deleting policy") | |
| LOGGER.info("Policy deleted successfully") |
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 77 to 79 in 5a60049
| def error_exit(message): | |
| print(message, file=sys.stderr) | |
| sys.exit(1) |
and so anywhere the job bombs out that uses it will be affected:
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 400 to 401 in 5a60049
| if not new_scan.get("scan", {}).get("uuid"): | |
| error_exit("New scan was not created") |
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 413 to 414 in 5a60049
| if not scan_launch_response.get("scan_uuid"): | |
| error_exit("New scan was not launched") |
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 428 to 429 in 5a60049
| if not scan_found: | |
| error_exit(f"Scan was never seen. id: {new_scan_id}") |
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 442 to 443 in 5a60049
| if not report: | |
| error_exit(f"Downloaded report was empty for scan id: {new_scan_id}") |
cyhy-commander/cyhy_commander/jobs/vulnscan.py
Lines 450 to 451 in 5a60049
| if not result: | |
| error_exit("No result returned when deleting scan") |
Expected behavior
The job leaves no orphaned items on the Nessus server.