First time running openscap, getting notapplicable

Martin Preisler mpreisle at redhat.com
Sun Nov 16 14:10:04 UTC 2014


----- Original Message -----
> From: "Grant Schoep" <matobinder at gmail.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Saturday, November 15, 2014 2:04:55 AM
> Subject: First time running openscap, getting notapplicable
> 
> Using RHEL 5.11
> Built openscap-1.1.1

Please send us `oscap --v`. I don't see any reason why it shouldn't include
cpe:/o:redhat:enterprise_linux:5 but would like to know for sure.

> xccdf.xml source from
> Downloaded "Red Hat 5 Manual STIG - Version 1, Release 8"
> from http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.aspx
> 
> That contains the U_RedHat_5_V1R8_Manual-xccdf.xml file.

Just a note, this is not scap-security-guide, it's a different content from
different authors. I will try to help regardless.

It's a manual check content. That probably means that the checks are described
but not automated. They don't bundle any OVAL files as far as I can see, XCCDF
alone won't do any checks.

>From a cursory glance at the XCCDF file they use 2 check systems, one is OVAL
but they don't include the oval.xml file. The other is "C-36041r1_chk". I have
no idea what that is. It uses a file that's also not included.

> I just tried running it, and all results show "notapplicable"

Are you sure it's notapplicable? I would expect 'notchecked' in this case.

> Looking through the docs, it does seem to point out, and google seems to
> also point out that I need to be running on the right platform.  It seems I
> am.
> 
> This is truly a Redhat 5 workstation(or server), not CentOS.
> 
> My command looks like this
> oscap xccdf eval --profile MAC-1_Public --results result.xml
> U_RedHat_5_V1R8_Manual-xccdf.xml
> 
> The zip file from iase website didn't contain a CPE file, so I assumed one
> was not needed? Though I have a feeling this is my problem.

openscap supports several CPE platforms without any CPE files. RHEL5 is among
them. So yes, CPE file shouldn't be necessary. See `oscap --v` for a list of
inbuilt CPE platforms.

> NOTE, that when I running I do see this message to stderr
> WARNING: Skipping ./oval.xml file which is referenced from XCCDF content

Yeah, that's openscap telling you that it can't find the checks.
 
-- 
Martin Preisler


More information about the scap-security-guide mailing list