Hi all,
Thirst thanks a lot for the all the good work done here ;)
I experience a strange issue after building via make the ssg for
centos6 (0.1.24
release)
When running :
/usr/bin/oscap xccdf eval --profile pci-dss
/usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml
All check are not applicable
Looking at the content of the produced xccdf i notive that the platform tag
was still referencing rhel and not centos cpe
To make the resulting xccdf work on a centos6 I had to change the following
line in ssg-centos6-xccdf.xml:
*<ns0:platform idref="cpe:/o:linux: enterprise_linux:6" />*
by
*<ns0:platform idref="cpe:/o:centos:centos:6" />*
And now the command bellow work as expected
/usr/bin/oscap xccdf eval --profile pci-dss
/usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml
So I took a big breath and I try to run the enable-derivative.py by hand
When I run it with ds or xccdf the result differs :
*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-xccdf.xml -o /tmp/mike-centos6-xccdf.xml*
*[mike@caprica 6]$ grep platform /tmp/mike-centos6-xccdf.xml |grep cent*
--> no output
*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-ds.xml -o /tmp/mike-centos6-ds.xml*
*[mike@caprica 6]$ grep platform /tmp/mike-centos6-ds.xml |grep cent*
* <ns9:platform idref="cpe:/o:centos:centos:6" />*
--> we have the centos6 as expected
Digging deeper I thought that it is probably related to the following line:
* benchmarks.extend([*
* (XCCDF11_NS, elem)*
* for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF11_NS)))*
* ])*
* benchmarks.extend([*
* (XCCDF12_NS, elem)*
* for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF12_NS)))*
* ]) *
For a strange reason the root.findall seems not to work with the xccdf file
I could not find out why this is not working….
XCCDF :
*<Benchmark
xmlns="http://checklists.nist.gov/xccdf/1.1
<
http://checklists.nist.gov/xccdf/1.1>"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
<
http://www.w3.org/2001/XMLSchema-instance>" id="RHEL-6"
resolved="1"
xml:lang="en-US">*
DS:
*<Benchmark
xmlns="http://checklists.nist.gov/xccdf/1.2
<
http://checklists.nist.gov/xccdf/1.2>"
id="xccdf_org.ssgproject.content_benchmark_RHEL-6" resolved="1"
xml:lang="en-US">*
To make a silly test I try the following
* benchmarks.extend([*
* (XCCDF11_NS, elem)*
* for elem in
list(root.findall("."))
*
* ])*
*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-xccdf.xml -o /tmp/mikeeeee*
*[mike@caprica 6]$ grep centos /tmp/mikeeeee*
* <ns0:notice id="centos_warning"><html:div>*
* <ns0:platform idref="cpe:/o:centos:centos:6" />*
The result make me think i'm on looking on the right spot, but I could not
find out why.
Somebody got an idea of what is going on? Or am I totaly missing something
Regards
Mike
PS : the same issue seems to affect RHEL7
REPS: i try to build on centos6 and fedora 21 (just in case i had a strange
python dep issue or something) : same result
--
Michael Boutillier