Generate Fix

Simon Lukasik isimluk at fedoraproject.org
Tue Dec 17 09:49:33 UTC 2013


On 12/15/2013 08:45 PM, joescap at mm.st wrote:
> Going through the SCAP & STIG Workshop March 2013 I learned that I can
> generate a shell script to fix items that were discovered during the
> scan:
> # oscap xccdf generate fix --result-id
> xccdf_org.open-scap_testresult_stig-rhel6-server
> /var/www/html/studentX-results.xml
> 
> Is it possible to generate a shell script that has all the available
> remediations regardless of a pass or fail.  In other words I want to
> generate a remediation shell script that doesn't rely on the output
> results file, but has every remediation that is available in the xccdf
> included in the shell script.

Hello Joescap,

Have you tried to omit the --result-id option? When you provide
--profile instead of --result-id you should get the list of remediation
scripts for guidance.

There are two modes of generate-fix.

(1) If you include --result-id you will get a list of fixes which *were*
executed during the scan. (2) If you supply --profile instead, you will
get all the fixes processed, as if oscap was scanning.

The latter mode is more evolved. It supports text substitution, CPE,
datastreams, and tailoring support is on its way. The former is written
in XSLT and may be dropped/rewritten from future releases [1].

Best regards,

-- 
Simon Lukasik
Security Technologies

[1]:
https://git.fedorahosted.org/cgit/openscap.git/commit/?id=ec3a873eec3691fb7d967653c203409c0a8765dc



More information about the scap-security-guide mailing list