[Open-scap] oscap generate guide ignores profile

Rui Pedro Bernardino rui-p-bernardino at ptinovacao.pt
Thu Dec 12 09:52:12 UTC 2013


Hi,

I had the exact same issue: we required a document (call it a guide) clearly stating what rules each profile included for each of our customers/profiles.

I worked around it by creating a copy of the open-scap's /usr/share/openscap/xsl/, and tweaked 'security-guide.xsl' to match my needs. Next, run oscap against it, eg, by adding to SSG's Makefile:
guide: shorthand2xccdf
(...)
oscap xccdf generate custom --stylesheet tweaked-security-guide.xsl --profile customer-profile-1 $(OUT)/unlinked-notest-rhel-xccdf-guide.xml > $(OUT)/Guide-customer-profile-1.html
(...)

You should have some knowledge of XSLT to customize the transform; I had none, but with a bit of trial and error the result was satisfactory.

Regards

--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação

From: open-scap-list-bounces at redhat.com [mailto:open-scap-list-bounces at redhat.com] On Behalf Of Sven Vermeulen
Sent: quinta-feira, 12 de Dezembro de 2013 06:53
To: Shawn Wells
Cc: open-scap-list at redhat.com
Subject: Re: [Open-scap] oscap generate guide ignores profile


On Dec 12, 2013 3:37 AM, "Shawn Wells" <shawn at redhat.com<mailto:shawn at redhat.com>> wrote:
>
> On 12/11/13, 4:34 PM, WARREN wrote:
>>
>> Hi,
>>
>> One of the useful facilities in openscap is to generate a "security guide"
>>
>> When I run:
>> # oscap xccdf generate --profile Baseline guide --output \
>>       BaselineGuide.html solaris-xccdf.xml
>>
>> the guide produced includes everything from the XCCDF file and not
>> just for the "--profile" specified. I see a table at the end telling
>> me what would be selected (or not) for the profile selected, but it
>> seems to me that having everything in the guide is confusing, as the
>> different profiles call different checks (obviously) and having them
>> all there whether they are used or not seems like not the best idea.
>>
>> Is there some way to turn off this "feature"? perhaps by manipulating
>> a style sheet? or should I call it a bug?
>
>
> +1
>
> It'd be incredibly useful to generate a true guide, versus a checklist, per profile.

I don't think that is possible without changing the XCCDF schema. The content of a guide is provided by Group tags whereas the checks are Rule tags.

Profiles are used to toggle Rules, not Groups, so openscap cannot know which Groups to include and which don't.

At least, that is my feeble impression on the XCCDF standard. Might be wrong though.

Wkr,
  Sven
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131212/9eb343dc/attachment-0001.html>


More information about the scap-security-guide mailing list