Fwd: scap

Michael Boutillier michael.boutillier at gmail.com
Wed Aug 5 23:03:29 UTC 2015


Hi all,
Thirst thanks a lot for the all the good work done here ;)

I experience  a strange issue after building via make the ssg for
centos6 (0.1.24
release)

When running :

/usr/bin/oscap xccdf eval --profile pci-dss
/usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml

All check are not applicable



Looking at the content of the produced xccdf i notive that the platform tag
was still referencing rhel and not centos cpe


To make the resulting xccdf work on a centos6 I had to change the following
line in ssg-centos6-xccdf.xml:

*<ns0:platform idref="cpe:/o:linux: enterprise_linux:6" />*

by

*<ns0:platform idref="cpe:/o:centos:centos:6" />*


And now the command bellow work as expected

/usr/bin/oscap xccdf eval --profile pci-dss
/usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml





So I took a big breath and I try to run the enable-derivative.py by hand



When I run it with ds or xccdf the result  differs :



*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-xccdf.xml  -o /tmp/mike-centos6-xccdf.xml*

*[mike at caprica 6]$ grep platform /tmp/mike-centos6-xccdf.xml |grep cent*

 --> no output





*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-ds.xml  -o /tmp/mike-centos6-ds.xml*



*[mike at caprica 6]$ grep platform /tmp/mike-centos6-ds.xml |grep cent*

*  <ns9:platform idref="cpe:/o:centos:centos:6" />*

 --> we have the centos6 as expected





Digging deeper I thought that it is probably related to the following line:


*    benchmarks.extend([*

*        (XCCDF11_NS, elem)*

*        for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF11_NS)))*

*    ])*

*    benchmarks.extend([*

*        (XCCDF12_NS, elem)*

*        for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF12_NS)))*

*    ])                                                             *

For a strange reason the root.findall seems not to work with the xccdf file

I could not find out why this is not working….



XCCDF :

*<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1
<http://checklists.nist.gov/xccdf/1.1>"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
<http://www.w3.org/2001/XMLSchema-instance>" id="RHEL-6" resolved="1"
xml:lang="en-US">*



DS:

*<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2
<http://checklists.nist.gov/xccdf/1.2>"
id="xccdf_org.ssgproject.content_benchmark_RHEL-6" resolved="1"
xml:lang="en-US">*





To make a silly test I try the following


*  benchmarks.extend([*

*        (XCCDF11_NS, elem)*

*        for elem in
list(root.findall("."))
*

*    ])*



*../../shared/utils/enable-derivatives.py --enable-centos -i
output/ssg-rhel6-xccdf.xml  -o /tmp/mikeeeee*



*[mike at caprica 6]$ grep centos /tmp/mikeeeee*

*  <ns0:notice id="centos_warning"><html:div>*

*  <ns0:platform idref="cpe:/o:centos:centos:6" />*





The result make me think i'm on looking on the right spot, but I could not
find out why.

Somebody got an idea of what is going on? Or am I totaly missing something


Regards

Mike


PS : the same issue seems to affect RHEL7

REPS: i try to build on centos6 and fedora 21 (just in case i had a strange
python dep issue or something) : same result

-- 
Michael Boutillier
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150806/bfdb31f2/attachment.html>


More information about the scap-security-guide mailing list