SCC 3.1 results with SSG content

Shawn Wells shawn at redhat.com
Tue Aug 27 02:28:48 UTC 2013


On 8/26/13 4:14 PM, Robert Sanders wrote:
> Afternoonall,
>   Just wanted to post some interesting lines from running the SCC3.1 
> tool with the latest SSG yum content.  I'm seeing a fair number of 
> items failing with messages like the following (an example line item):
>
>
> RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate 
> Partition - (CCE-26435-8)
> [ERROR] 'no line is returned' does not match 
> 'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at 
> /</opt/scc/cscc>System/System_Functions.pm line 2855.
> [ERROR] Check system [ocil-transitional] is not supported. Check will 
> not be performed.
>        Target System:       RH64-64
>        Selected Profile:    rht-ccp
>        Stream Name:         ssg-rhel6-
>        Stream Version:      0.9
>        Stream Date:         2013-07-05
>        Rule ID:             partition_for_tmp
>
>
> This line is showing both example of the errors I've seen , the oval 
> match issue and the ocil-transitional stuff.  It appears the errors 
> are always the same, and scattered independently through the 385 
> checks, for a total of 131 errors listed.
>
> I have done exactly zero digging to see what is happening, just wanted 
> to toss this out to the collective eyeballs of the group.

That matches my own experiences with SCC 3.1:
http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_Error_Log.001.txt

I had the opportunity to meet the SCC team at the MITRE SCAP DevDays, 
then again at Mil-OSS Charleston a few weeks ago. They're a really great 
group of people and have been working on updates which should be (IIRC) 
incorporated into the SCC 3.1 RC6 release which dropped on 8/13.

I've yet to play with the RC6 build, but hope to over the coming week. 
Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet 
to undergo NIST validation, there may be some OVAL interpreter bugs to 
workout within SCC. In my experience the SCC team has been incredibly 
open to feedback, and many of them lurk here... perhaps they'll chirp up ;)


More information about the scap-security-guide mailing list