I have observed this as well. I believe it is expected behavior and will happen whenever
it sees check systems other than OVAL or OCIL. It should still process all the OVAL and
OCIL checks and you should get results. Rules that have only OCIL-transitional checks
will be marked as NOTTESTED. I think the match error is related to the unknown check as
well.
I think Jeff pushed the OCIL-transitional fix so these errors will go away with the newest
version of the content (the ocilrefs version).
Jim
-----Original Message-----
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Robert Sanders
Sent: Tuesday, August 27, 2013 8:43 AM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: RE: SCC 3.1 results with SSG content
These results were with SCC 3.1 GA. I've got a copy of rc6, but it isn't on my
test machine right now. I need to scrape up some time and migrate that to my test
environment and rerun, but thought I drop the initial results.
-Rob
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells
[shawn(a)redhat.com]
Sent: Monday, August 26, 2013 10:28 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: SCC 3.1 results with SSG content
On 8/26/13 4:14 PM, Robert Sanders wrote:
Afternoonall,
Just wanted to post some interesting lines from running the SCC3.1
tool with the latest SSG yum content. I'm seeing a fair number of
items failing with messages like the following (an example line item):
RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate
Partition - (CCE-26435-8)
[ERROR] 'no line is returned' does not match
'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at
/</opt/scc/cscc>System/System_Functions.pm line 2855.
[ERROR] Check system [ocil-transitional] is not supported. Check will
not be performed.
Target System: RH64-64
Selected Profile: rht-ccp
Stream Name: ssg-rhel6-
Stream Version: 0.9
Stream Date: 2013-07-05
Rule ID: partition_for_tmp
This line is showing both example of the errors I've seen , the oval
match issue and the ocil-transitional stuff. It appears the errors
are always the same, and scattered independently through the 385
checks, for a total of 131 errors listed.
I have done exactly zero digging to see what is happening, just wanted
to toss this out to the collective eyeballs of the group.
That matches my own experiences with SCC 3.1:
http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_...
I had the opportunity to meet the SCC team at the MITRE SCAP DevDays,
then again at Mil-OSS Charleston a few weeks ago. They're a really great
group of people and have been working on updates which should be (IIRC)
incorporated into the SCC 3.1 RC6 release which dropped on 8/13.
I've yet to play with the RC6 build, but hope to over the coming week.
Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet
to undergo NIST validation, there may be some OVAL interpreter bugs to
workout within SCC. In my experience the SCC team has been incredibly
open to feedback, and many of them lurk here... perhaps they'll chirp up ;)
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide