Implementation of openscap

Steve Grubb sgrubb at redhat.com
Thu Sep 13 16:35:58 UTC 2012


On Thursday, September 13, 2012 08:20:24 AM Joe Wulf wrote:
> -  Can a single edition (preferably the latest) of openscap combined with
> the latest content be 'brought' into the RHEL test/dev hosts and be
> successful in executing for scoring/assessment? -  Has anyone tried this
> yet?

The answer is probably...

The oscap commandline tool depends on a library in the openscap package, 
/usr/lib64/libopenscap.so.1.0.0. So, you would need to export LD_LIBRARY_PATH 
with this nfs location so that it finds the correct one before the one that's 
possibly installed.

The other thing is that the OVAL scan uses individual probe executables to do 
certain checks. So, you would have to tell it how to find the new binaries. 
Fortunately, this was addressed to get the self test working. You would export 
OVAL_PROBE_DIR pointing to the directory where the probes are.

There are also schemas and various supporting xml files. If your content is 
complete, you might not have any problems. But this is the only area where I 
think you'd need to do experimenting in.

-Steve


More information about the scap-security-guide mailing list