On Monday, August 05, 2013 01:23:47 PM Simon Lukasik wrote:
I do not believe such usage is precluded by XCCDF or OVAL. Nor does a cursory scan of SCAP 1.1 (§3.2.5.2 appears to be the only applicable section) or SCAP 1.2 (§3.2.5).
There is couple of places where the multiple variable values are described. However, the exact use case use shared with us is part of requirement SCAP.T.2000.5 within NISTIR-7511. (The automated test suite for SCAP.T.2000.5 contains the very same example as yours).
I cannot speak for other scanners. And I don't know if it is supported by ovaldi. Nevertheless, I wanted to raise this functionality to your attention.
Ovaldi was never intended to be a 100% complete and functional implementation. If it were, then nobody would be wasting time and money making other scanners. Its intention is to demonstrate many of the concepts in the OVAL language so that people writing a scanner can compare their against it for the things it has implemented. So, anyone pinning their hopes on doing complex things in ovaldi is likely to be in a hard spot.
Perhaps, there is indeed a risk of inter-operability loss assigned with usage of advanced concepts of SCAP. If so, then the standard needs to be more explicit next time.
It can always be better specified, but I don't think that helps in this situation. Everyone that needs reliable results must use a certified scanner. The purpose of certification is to make that scanners can do what's asked of them. If you do not use a certified scanner, then there is nothing to guarantee that the implementation is correct. This is why we are putting openscap through an evaluation...to be able to say it implements everything required in the standard to the extent that validation tests it.
-Steve