Invalid Output using the scap-security-guide-0.1-6.noarch.rpm

Shawn Wells shawn at redhat.com
Thu Nov 1 05:01:01 UTC 2012


On 10/31/12 7:19 PM, Bueschel, Eric W CTR (US) wrote:
> OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in
> Benchmark.
>
> The prior version, 0.1-1, generated a useful output which I was able to
> convert to a useable document with:
>
> oscap xccdf generate report xccdf-results.xml > $HOSTNAME-openscap.html
>
>
> I would appreciate any help possible,

Hmm. I went and did a fresh clone & make:

$ git clone -b RHEL6 
ssh://shawndwells@git.fedorahosted.org/git/scap-security-guide.git
$ cd scap-security-guide/RHEL6
$ make all

And ran a scan. I get the garbled output, however my error is slightly 
different:
$ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml
.....
OpenSCAP Error: Selector ID(service_postfix_enabled) does not exist in 
Benchmark. [xccdf_policy.c:2059]


$ grep -in "service_postfix_enabled" output/ssg-rhel6-xccdf.xml
412:    <select idref="service_postfix_enabled" selected="true"/>

.... <select>'s within that range are indicating the rule is part of 
some profile, however there must be a matching rule. Probably a typo.

$ grep -in "service_postfix" output/ssg-rhel6-xccdf.xml
412:    <select idref="service_postfix_enabled" selected="true"/>
13535:      <Rule id="service_postfix_enable" severity="low" 
selected="false">

Went ahead and patched, recompiled the guide, and re-ran the scan:
$ make clean; make all
$ oscap xccdf eval --profile stig-server output/ssg-rhel6-xccdf.xml
......
OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist 
in Benchmark. [xccdf_policy.c:2059]

At least now our errors match up. I'll continue looking at this in the 
morning.


More information about the scap-security-guide mailing list