When running :
/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml
All check are not applicable
Looking at the content of the produced xccdf i notive that the platform tag was still referencing rhel and not centos cpe
To make the resulting xccdf work on a centos6 I had to change the following line in ssg-centos6-xccdf.xml:
<ns0:platform idref="cpe:/o:linux: enterprise_linux:6" />
by
<ns0:platform idref="cpe:/o:centos:centos:6" />
And now the command bellow work as expected
/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml
So I took a big breath and I try to run the enable-derivative.py by hand
When I run it with ds or xccdf the result differs :
../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml -o /tmp/mike-centos6-xccdf.xml
[mike@caprica 6]$ grep platform /tmp/mike-centos6-xccdf.xml |grep cent
--> no output
../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-ds.xml -o /tmp/mike-centos6-ds.xml
[mike@caprica 6]$ grep platform /tmp/mike-centos6-ds.xml |grep cent
<ns9:platform idref="cpe:/o:centos:centos:6" />
--> we have the centos6 as expected
Digging deeper I thought that it is probably related to the following line:
benchmarks.extend([
(XCCDF11_NS, elem)
for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF11_NS)))
])
benchmarks.extend([
(XCCDF12_NS, elem)
for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF12_NS)))
])
For a strange reason the root.findall seems not to work with the xccdf file
I could not find out why this is not working….
XCCDF :
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6" resolved="1" xml:lang="en-US">
DS:
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.ssgproject.content_benchmark_RHEL-6" resolved="1" xml:lang="en-US">
To make a silly test I try the following
benchmarks.extend([
(XCCDF11_NS, elem)
for elem in list(root.findall("."))
])
../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml -o /tmp/mikeeeee
[mike@caprica 6]$ grep centos /tmp/mikeeeee
<ns0:notice id="centos_warning"><html:div>
<ns0:platform idref="cpe:/o:centos:centos:6" />
The result make me think i'm on looking on the right spot, but I could not find out why.
Somebody got an idea of what is going on? Or am I totaly missing something
Regards
Mike
PS : the same issue seems to affect RHEL7
REPS: i try to build on centos6 and fedora 21 (just in case i had a strange python dep issue or something) : same result