On 6/5/15 7:22 AM, Greg Elin wrote:
I am going to offer an answer but I am not 100% certain it is correct.
At the start of each XCCDF XML file is a section that defines profiles using the
Within each profile tag is a list of rules that are checked (eg, selected=true) for that
To my knowledge, it is the setting in the profile tag overrides the selected=true in the
I found this counter intuitive to my experience with CSS in which the inline setting
overrides the top of file setting. But from another perspective of you are evaluating the
defined profile rather than a singe rule, so the order of overrides make sense.
Sent from my iPhone
> >On Jun 4, 2015, at 4:26 AM, thomas belarbi<thomas.belarbi(a)gmail.com>
> >I'm working currently on secure OS and I' ve to enforce a CentOS 7
> >I get with yum the package scap-security-guide.
> >I adapt xml files (XCCDF) to work with CentOS 7
> >I pass all the rule at "selected='true'" in different files :
> >I execute a run with oscap xccdf eval --profile "rht-ccp"
> >I obtain 42 passed , 48 failed and 304 other
> >The "Other" are "notchecked"
> >The current engine support all the rules ? Or not ?
> >I assumed that the rule is postionned to "notchecked" if there is
nothing to check.
> >So , for example, I install "Squid" and rerun a global check and the
rule "Disable Squid", "Uninstall Squid" are still
> >Can you guide me with my problem ?
> >Thank you very very much if you can
SSG represents a catalog of security relevant configuration controls.
These are expressed as XCCDF rules.
Groupings of XCCDF rules are called profiles, such as the CCP profile
you mentioned. Others include the DoD STIG, PCI, etc.
The "not selected" just indicates some number of rules were not enabled
in your profile.
Rule results showing "not checked" means that the rule was selected in
your profile, but automation content likely does not exist. An example
is "Ensure Software Patches Installed." Almost all profiles want you to
apply patches, but attesting you did so through SCAP is sometimes
infeasible. So the rule is selected in the profile, but shows up as "not
checked" in the HTML reports -- meaning some human verification is