Implementation of openscap
Steve Grubb
sgrubb at redhat.com
Thu Sep 13 16:35:58 UTC 2012
On Thursday, September 13, 2012 08:20:24 AM Joe Wulf wrote:
> - Can a single edition (preferably the latest) of openscap combined with
> the latest content be 'brought' into the RHEL test/dev hosts and be
> successful in executing for scoring/assessment? - Has anyone tried this
> yet?
The answer is probably...
The oscap commandline tool depends on a library in the openscap package,
/usr/lib64/libopenscap.so.1.0.0. So, you would need to export LD_LIBRARY_PATH
with this nfs location so that it finds the correct one before the one that's
possibly installed.
The other thing is that the OVAL scan uses individual probe executables to do
certain checks. So, you would have to tell it how to find the new binaries.
Fortunately, this was addressed to get the self test working. You would export
OVAL_PROBE_DIR pointing to the directory where the probes are.
There are also schemas and various supporting xml files. If your content is
complete, you might not have any problems. But this is the only area where I
think you'd need to do experimenting in.
-Steve
More information about the scap-security-guide
mailing list