oscap & jboss on Fedora

Martin Preisler mpreisle at redhat.com
Fri May 2 15:34:17 UTC 2014


----- Original Message -----
> From: "Ivan Saez Scheihing" <saezscheihing at gmail.com>
> To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
> Sent: Tuesday, April 29, 2014 1:45:08 PM
> Subject: Re: oscap & jboss on Fedora
> 
> Martin,
> 
> Thank you for your answer. See attachment for xccdf result file.
> If you look at the rule
> Result for Disable Hot Deployment in production
> 
> you will see it passes. But if I check manually I can see that the file
> 
> JBOSS_HOME/server/[PROFILE]/deploy/hdscanner-jboss-beans.xml

Without knowing any details about the particular rule I will just say that it could a bug in the content. The content is what tells openscap what it should check. OVAL results will greatly help in debugging the issue.

> hasn't been deleted. So my conclusion is that the rule should have failed.
> 
> And I'm not sure what you mean with "oval results". if you tell how to
> generate it I will post it.

Add --oval-results to the command line you use to run oscap. It will create an XML file with OVAL results. These may contain details we need to debug the issue.

> 
[snip]
> > No idea what xccdfexec.jar is. Is it a wrapper around oscap? The arguments
> > look familiar.

I still need an answer to this.

-- 
Martin Preisler


More information about the scap-security-guide mailing list