While running SCC 3.1.1.1 against the SSG 0.1-14-14 content, with either the stig-rhel6-server or usgcb-rhel6-server profile selected from the SCAP stream, and rpm_verify_permissions = false, there appears to be variables referenced in the OVAL file but are not declared in the XCCDF and the value is being used in XCCDF without being declared.
 
SCC errorlog snippets:
[ERROR] Could not find external variable with id 'oval:ssg:var:2224'.
[ERROR] Could not find external variable with id 'oval:ssg:var:2234'.
[ERROR] Could not find external variable with id 'oval:ssg:var:2237'.
 
OVAL/XCCDF snippets:
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object>
./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1436" version="1">
./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2224"/>
./Content/ssg-rhel6-oval.xml- </linux:partition_object>
./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:1440" version="1">
./Content/ssg-rhel6-oval.xml- <linux:name>vsftpd</linux:name>
./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object>
./Content/ssg-rhel6-oval.xml- </unix:runlevel_state>
./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1439" version="1">
./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2224"/>
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state>
./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1437" version="1">
./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
./Content/ssg-rhel6-oval.xml- </linux:partition_state>
./Content/ssg-rhel6-oval.xml- <value>/usr/sbin/usernetctl</value>
./Content/ssg-rhel6-oval.xml- </constant_variable>
./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2224" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2244" version="1"/>
./Content/ssg-rhel6-oval.xml- L25:L29
 
$ /bin/grep "2224" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml
$<null>
 
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object>
./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:1713" version="1">
./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2234"/>
./Content/ssg-rhel6-oval.xml- </linux:partition_object>
./Content/ssg-rhel6-oval.xml- <unix:file_object comment="/etc/passwd" id="oval:ssg:obj:1717" version="1">
./Content/ssg-rhel6-oval.xml- <unix:path>/etc</unix:path>
./Content/ssg-rhel6-oval.xml- <unix:filename>passwd</unix:filename>
./Content/ssg-rhel6-oval.xml- </unix:runlevel_state>
./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:1716" version="1">
./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2234"/>
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state>
./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:1714" version="1">
./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
./Content/ssg-rhel6-oval.xml- </linux:partition_state>
./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg:var:2257" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg:var:2258" version="1"/>
./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2234" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib dcredit" datatype="int" id="oval:ssg:var:2259" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg:var:2260" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="umask for user shell" datatype="string" id="oval:ssg:var:2261" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib minclass" datatype="int" id="oval:ssg:var:2262" version="1"/>
 
/bin/grep "2234" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml
$ <null>
 
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_object>
./Content/ssg-rhel6-oval.xml- <linux:partition_object id="oval:ssg:obj:2095" version="1">
./Content/ssg-rhel6-oval.xml: <linux:mount_point var_ref="oval:ssg:var:2237"/>
./Content/ssg-rhel6-oval.xml- </linux:partition_object>
./Content/ssg-rhel6-oval.xml- <linux:rpminfo_object id="oval:ssg:obj:2099" version="1">
./Content/ssg-rhel6-oval.xml- <linux:name>nfs-utils</linux:name>
./Content/ssg-rhel6-oval.xml- </linux:rpminfo_object>
./Content/ssg-rhel6-oval.xml- </unix:runlevel_state>
./Content/ssg-rhel6-oval.xml- <ind:textfilecontent54_state id="oval:ssg:ste:2098" version="1">
./Content/ssg-rhel6-oval.xml: <ind:subexpression datatype="string" var_ref="oval:ssg:var:2237"/>
./Content/ssg-rhel6-oval.xml- </ind:textfilecontent54_state>
./Content/ssg-rhel6-oval.xml- <linux:partition_state id="oval:ssg:ste:2096" version="1">
./Content/ssg-rhel6-oval.xml- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
./Content/ssg-rhel6-oval.xml- </linux:partition_state>
./Content/ssg-rhel6-oval.xml- <external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg:var:2267" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg:var:2268" version="1"/>
./Content/ssg-rhel6-oval.xml: <external_variable comment="removable partition" datatype="string" id="oval:ssg:var:2237" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="External variable for pam_cracklib ucredit" datatype="int" id="oval:ssg:var:2269" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg:var:2270" version="1"/>
./Content/ssg-rhel6-oval.xml- <external_variable comment="external variable for daemon umask" datatype="string" id="oval:ssg:var:2271" version="1"/>
./Content/ssg-rhel6-oval.xml- </variables>
 
$ /bin/grep "2237" /opt/scc/Resources/Content/ssg-rhel6-xccdf.xml
$ <null>