you will see it passes. But if I check manually I can see that the file
JBOSS_HOME/server/[PROFILE]/deploy/hdscanner-jboss-beans.xml
hasn't been deleted. So my conclusion is that the rule should have failed.
And I'm not sure what you mean with "oval results". if you tell how to generate it I will post it.
regards,
Ivan
> To: "SCAP Security Guide" <scap-security-guide@lists.fedorahosted.org>No idea what xccdfexec.jar is. Is it a wrapper around oscap? The arguments look familiar.
> Sent: Tuesday, April 22, 2014 8:00:39 PM
> Subject: Re: oscap & jboss on Fedora
>
> Martin,
>
> I was able to run xccdf and oscan after editing the eap5-xccdf.xml file. I
> did comment out all '<platform idref="cpe:/a:redhat..' lines (5 lines in
> total).
>
> java -jar xccdfexec.jar -result bla.xml --report bla.html --profile
> eap5_full -c eap5-cpe-oval.xml -C eap5-cpe-dictionary.xl -P eap5_full
We need more specifics, else I can't comment. Give us a particular rule that passed and shouldn't have. Post your xccdf result file, post your oval results.
>
> Did run and asked me a lot's of questions. The same questions as can be
> found in the JBossEAP5_Guide.html document. Based on my answers it
> generated a few xml files. But am I mistaken or doesn't  xccdfexec cheeck
> anything?
>
> Oscap did check some things by it self (by inspecting jboss xml files I
> supose). I run it with the following options:
>
> oscap xccdf eval --results bla.xml --report bla.html --profile eap5-full
> -cpe eap5-cpe-dictionary.xml eap5-xccdf.xml
>
>
> It generated the bla.html file and most of the checks were done. Previously
> I did check the Jboss by hand and I think oscap is not very meticulous.
> Some checks did get the passed status and I'm sure it should have failed.
> Any comments on this/
--
Martin Preisler
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide