> Using RHEL 5.11
> Built openscap-1.1.1

Please send us `oscap --v`. I don't see any reason why it shouldn't include
cpe:/o:redhat:enterprise_linux:5 but would like to know for sure.

Here goes' I see it there.
OpenSCAP command line tool (oscap) 1.1.1
Copyright 2009--2014 Red Hat Inc., Durham, North Carolina.

==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.10.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1

==== Capabilities added by auto-loaded plugins ====
No plugins have been auto-loaded...

==== Paths ====
Schema files: /home/gschoep/prod/Linux_x86_64/openscap-1.1.1/share/openscap/schemas
Default CPE files: /home/gschoep/prod/Linux_x86_64/openscap-1.1.1/share/openscap/cpe
Probes: /home/gschoep/prod/Linux_x86_64/openscap-1.1.1/libexec/openscap

==== Inbuilt CPE names ====
Red Hat Enterprise Linux - cpe:/o:redhat:enterprise_linux
Red Hat Enterprise Linux 5 - cpe:/o:redhat:enterprise_linux:5
Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Community Enterprise Operating System 5 - cpe:/o:centos:centos:5
Community Enterprise Operating System 6 - cpe:/o:centos:centos:6
Community Enterprise Operating System 7 - cpe:/o:centos:centos:7
Fedora 16 - cpe:/o:fedoraproject:fedora:16
Fedora 17 - cpe:/o:fedoraproject:fedora:17
Fedora 18 - cpe:/o:fedoraproject:fedora:18
Fedora 19 - cpe:/o:fedoraproject:fedora:19
Fedora 20 - cpe:/o:fedoraproject:fedora:20
Fedora 21 - cpe:/o:fedoraproject:fedora:21
Fedora 22 - cpe:/o:fedoraproject:fedora:22
Red Hat Enterprise Linux Optional Productivity Applications - cpe:/a:redhat:rhel_productivity
Red Hat Enterprise Linux Optional Productivity Applications 5 - cpe:/a:redhat:rhel_productivity:5

==== Supported OVAL objects and associated OpenSCAP probes ====
system_info                  probe_system_info
family                       probe_family
filehash                     probe_filehash
environmentvariable          probe_environmentvariable
textfilecontent54            probe_textfilecontent54
textfilecontent              probe_textfilecontent
variable                     probe_variable
xmlfilecontent               probe_xmlfilecontent
environmentvariable58        probe_environmentvariable58
filehash58                   probe_filehash58
inetlisteningservers         probe_inetlisteningservers
partition                    probe_partition
iflisteners                  probe_iflisteners
selinuxboolean               probe_selinuxboolean
selinuxsecuritycontext       probe_selinuxsecuritycontext
systemdunitproperty          probe_systemdunitproperty
systemdunitdependency        probe_systemdunitdependency
file                         probe_file
interface                    probe_interface
password                     probe_password
process                      probe_process
runlevel                     probe_runlevel
shadow                       probe_shadow
uname                        probe_uname
xinetd                       probe_xinetd
sysctl                       probe_sysctl
process58                    probe_process58
gconf                        probe_gconf
routingtable                 probe_routingtable
 
 
> xccdf.xml source from
> Downloaded "Red Hat 5 Manual STIG - Version 1, Release 8"
> from http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.aspx
>
> That contains the U_RedHat_5_V1R8_Manual-xccdf.xml file.

Just a note, this is not scap-security-guide, it's a different content from
different authors. I will try to help regardless.

It's a manual check content. That probably means that the checks are described
but not automated. They don't bundle any OVAL files as far as I can see, XCCDF
alone won't do any checks.

>From a cursory glance at the XCCDF file they use 2 check systems, one is OVAL
but they don't include the oval.xml file. The other is "C-36041r1_chk". I have
no idea what that is. It uses a file that's also not included.

> I just tried running it, and all results show "notapplicable"

Are you sure it's notapplicable? I would expect 'notchecked' in this case.

Yep. notapplicable. I tried removing the "Platform" lines, as suggested in one thread I saw, and it switched to notchecked. 

> Looking through the docs, it does seem to point out, and google seems to
> also point out that I need to be running on the right platform.  It seems I
> am.
>
> This is truly a Redhat 5 workstation(or server), not CentOS.
>
> My command looks like this
> oscap xccdf eval --profile MAC-1_Public --results result.xml
> U_RedHat_5_V1R8_Manual-xccdf.xml
>
> The zip file from iase website didn't contain a CPE file, so I assumed one
> was not needed? Though I have a feeling this is my problem.

openscap supports several CPE platforms without any CPE files. RHEL5 is among
them. So yes, CPE file shouldn't be necessary. See `oscap --v` for a list of
inbuilt CPE platforms.

> NOTE, that when I running I do see this message to stderr
> WARNING: Skipping ./oval.xml file which is referenced from XCCDF content

Yeah, that's openscap telling you that it can't find the checks.


So I also tried on a RHEL6 machine. Seeing same thing.

Is there a "debug" mode or something I can run to see what openscap "thinks" is the OS? If its not matching  cpe:/o:redhat:enterprise_linux:5 (or 6) then maybe its getting confused and getting some totally different value.

I guess I have the source code, I could try look at something in there... suggestions on where to start would be good