SCC 3.1 results with SSG content

Ronayne, James K. jkronay at nsa.gov
Thu Aug 29 15:24:36 UTC 2013


I have observed this as well.  I believe it is expected behavior and will happen whenever it sees check systems other than OVAL or OCIL.  It should still process all the OVAL and OCIL checks and you should get results.  Rules that have only OCIL-transitional checks will be marked as NOTTESTED.  I think the match error is related to the unknown check as well.
I think Jeff pushed the OCIL-transitional fix so these errors will go away with the newest version of the content (the ocilrefs version).

Jim




-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Robert Sanders
Sent: Tuesday, August 27, 2013 8:43 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: RE: SCC 3.1 results with SSG content

These results were with SCC 3.1 GA.  I've got a copy of rc6, but it isn't on my test machine right now.  I need to scrape up some time and migrate that to my test environment and rerun, but thought I drop the initial results.

-Rob

________________________________________
From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Shawn Wells [shawn at redhat.com]
Sent: Monday, August 26, 2013 10:28 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: SCC 3.1 results with SSG content

On 8/26/13 4:14 PM, Robert Sanders wrote:
> Afternoonall,
>   Just wanted to post some interesting lines from running the SCC3.1
> tool with the latest SSG yum content.  I'm seeing a fair number of
> items failing with messages like the following (an example line item):
>
>
> RH64-64: Processing (1 of 385) Ensure /tmp Located On Separate
> Partition - (CCE-26435-8)
> [ERROR] 'no line is returned' does not match
> 'oval:[A-Za-z0-9_\-\.]+:var:[1-9][0-9]*'. at
> /</opt/scc/cscc>System/System_Functions.pm line 2855.
> [ERROR] Check system [ocil-transitional] is not supported. Check will
> not be performed.
>        Target System:       RH64-64
>        Selected Profile:    rht-ccp
>        Stream Name:         ssg-rhel6-
>        Stream Version:      0.9
>        Stream Date:         2013-07-05
>        Rule ID:             partition_for_tmp
>
>
> This line is showing both example of the errors I've seen , the oval
> match issue and the ocil-transitional stuff.  It appears the errors
> are always the same, and scattered independently through the 385
> checks, for a total of 131 errors listed.
>
> I have done exactly zero digging to see what is happening, just wanted
> to toss this out to the collective eyeballs of the group.

That matches my own experiences with SCC 3.1:
http://people.redhat.com/swells/SCC/Logs/RHEL6_SCC-3.1_2013-02-17_102333_Error_Log.001.txt

I had the opportunity to meet the SCC team at the MITRE SCAP DevDays,
then again at Mil-OSS Charleston a few weeks ago. They're a really great
group of people and have been working on updates which should be (IIRC)
incorporated into the SCC 3.1 RC6 release which dropped on 8/13.

I've yet to play with the RC6 build, but hope to over the coming week.
Did you use SCC v3.1 GA, or one of the recent RC builds? As SCC has yet
to undergo NIST validation, there may be some OVAL interpreter bugs to
workout within SCC. In my experience the SCC team has been incredibly
open to feedback, and many of them lurk here... perhaps they'll chirp up ;)
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list