Hi all,
Thirst thanks a lot for the all the good work done here ;)

I experience  a strange issue after building via make the ssg for centos6 (0.1.24 release

When running :

/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml

All check are not applicable


Looking at the content of the produced xccdf i notive that the platform tag was still referencing rhel and not centos cpe

To make the resulting xccdf work on a centos6 I had to change the following line in ssg-centos6-xccdf.xml:

<ns0:platform idref="cpe:/o:linux: enterprise_linux:6" />


<ns0:platform idref="cpe:/o:centos:centos:6" />

And now the command bellow work as expected

/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml



So I took a big breath and I try to run the enable-derivative.py by hand


When I run it with ds or xccdf the result  differs :


../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml  -o /tmp/mike-centos6-xccdf.xml

[mike@caprica 6]$ grep platform /tmp/mike-centos6-xccdf.xml |grep cent

 --> no output



../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-ds.xml  -o /tmp/mike-centos6-ds.xml


[mike@caprica 6]$ grep platform /tmp/mike-centos6-ds.xml |grep cent

  <ns9:platform idref="cpe:/o:centos:centos:6" />

 --> we have the centos6 as expected



Digging deeper I thought that it is probably related to the following line:


        (XCCDF11_NS, elem)

        for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF11_NS)))



        (XCCDF12_NS, elem)

        for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF12_NS)))


For a strange reason the root.findall seems not to work with the xccdf file

I could not find out why this is not working….



<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6" resolved="1" xml:lang="en-US">



<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.ssgproject.content_benchmark_RHEL-6" resolved="1" xml:lang="en-US">



To make a silly test I try the following


        (XCCDF11_NS, elem)

        for elem in list(root.findall("."))                                                                                                



../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml  -o /tmp/mikeeeee


[mike@caprica 6]$ grep centos /tmp/mikeeeee

  <ns0:notice id="centos_warning"><html:div>

  <ns0:platform idref="cpe:/o:centos:centos:6" />



The result make me think i'm on looking on the right spot, but I could not find out why.

Somebody got an idea of what is going on? Or am I totaly missing something



PS : the same issue seems to affect RHEL7

REPS: i try to build on centos6 and fedora 21 (just in case i had a strange python dep issue or something) : same result

Michael Boutillier