cannot eval latest rhel6-xccdf-scap-security-guide.xml

Petr Lautrbach plautrba at redhat.com
Wed May 16 16:41:47 UTC 2012


Hello,

I'm trying to run a scan against server profile but there seems to be invalid
definition content:

$ su -c 'oscap xccdf eval --profile server --results results.xml --report report.html rhel6/src/output/rhel6-xccdf-scap-security-guide.xml'
Password:
1 1877 In file 'rhel6/src/output/rhel6-oval-scap-security-guide.xml' on line 3517: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}criterion': No match found for key-sequence ['oval:scap-security-guide:tst:857'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}testKeyRef'.
Invalid OVAL Definition content in rhel6/src/output/rhel6-oval-scap-security-guide.xml


I found out that this error occurs since commit 712c179fdd6349f4c7f4bb115ba0ba41ab88a19f [1].

There is also invalid XCCDF export since commit 104058265f497b26d86621e84dc233a2ca387a32 [2].

$ su -c 'oscap xccdf eval --profile server --results results.xml --report report.html rhel6/src/output/rhel6-xccdf-scap-security-guide.xml'
Password:
...
1 1843 In file 'results.xml' on line 10141: Element '{http://checklists.nist.gov/xccdf/1.1}Benchmark': Character content other than whitespace is not allowed because the content type is 'element-only'.
1 1843 In file 'results.xml' on line 10146: Element '{http://checklists.nist.gov/xccdf/1.1}Benchmark': Character content other than whitespace is not allowed because the content type is 'element-only'.
...
1 1843 In file 'results.xml' on line 12170: Element '{http://checklists.nist.gov/xccdf/1.1}Benchmark': Character content other than whitespace is not allowed because the content type is 'element-only'.
1 1843 In file 'results.xml' on line 12172: Element '{http://checklists.nist.gov/xccdf/1.1}Benchmark': Character content other than whitespace is not allowed because the content type is 'element-only'.
XCCDF Results are NOT exported correctly.
OpenSCAP Error: Validation failure


$ oscap --version
OSCAP util (oscap) 0.8.2
Copyright 2009,2010 Red Hat Inc., Durham, North Carolina.

OVAL Version:   5.8
XCCDF Version:  1.1.4
CPE Version:    2.2
CVSS Version:   2.0



[1] commit 712c179fdd6349f4c7f4bb115ba0ba41ab88a19f [1]
Author: Mike Palmiotto <mpalmiotto at tresys.com>
Date:   Wed Apr 18 16:28:38 2012 -0400

     M1 Incomplete Guidance - Logging and Auditing


[2] commit 104058265f497b26d86621e84dc233a2ca387a32
Author: Shawn Wells <shawn at redhat.com>
Date:   Sat May 12 18:35:58 2012 -0400

     Committing remainder of Auxilary patch

     Apparently some of Jeffs patches were dropped from my commit.
     Reference https://fedorahosted.org/scap-security-guide/changeset/a87ed9


Regards,

Petr
-- 
Petr Lautrbach, Red Hat, Inc.
http://cz.redhat.com


More information about the scap-security-guide mailing list