help with OVAL transforms

Shawn Wells shawn at redhat.com
Mon Apr 22 03:35:00 UTC 2013


On 4/21/13 10:39 PM, Jeffrey Blank wrote:
> Rule selection specified by a Profile overrides selection specified in 
> the Rule itself.
> Any Rules which are not explicitly marked as "selected=false" will be 
> evaluated.
>
> Thus, our convention is to mark all Rules as "selected=false" in the 
> actual Rule attribute, because we wish to have Profile-driven 
> evaluation.  (And all of our Profiles only ever feature "selected=true".)
>
> Please see page 20 of 
> http://csrc.nist.gov/publications/nistir/ir7275-rev4/NISTIR-7275r4.pdf
>
> Note there that the default is "true" for selection in a Rule.  So, if 
> we weren't intentionally de-selecting each Rule using its attribute 
> (selected=false), even in a Profile-driven evaluation (which did not 
> include the Rule!) it would default to true and be evaluated. Yes, 
> this would be quite unexpected.  This is explained by the fact that 
> the earlier versions of XCCDF has no Profiles. The thought (at that 
> time, from what I can infer) is that end-users would receive a body of 
> XCCDF and then select/de-select (using tooling) what they wanted (and 
> save the resulting XCCDF content as their own).
>
> But that is not the way it turned out.  The way it turned out was that 
> widespread authoring/modification of XCCDF never really occurred, and 
> instead XCCDF really only took hold as a means of expressing a small 
> number of government security baselines (all of which were expressed 
> as Profiles, rarely modified, due to the inadequacy or lack of 
> adoption of any tooling for authoring).
>
> So I hardly blame you for being confused.  The decision tree for XCCDF 
> evaluation is vastly more complicated than needed for any use case 
> I've ever seen (or could practically imagine).

Jeff pinged me offline and it turns out this was caused by the id tag 
within the OVAL not matching the filename. I threw together a patch here:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-April/003061.html


More information about the scap-security-guide mailing list