<div dir="ltr">Shawn, thanks for the detailed explanation. Rather than faking the system into thinking it&#39;s running RHEL6, would it be possible to update the oval definitions to include CentOS as an applicable platform?<br>
 <br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 15, 2014 at 1:10 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 8/14/14, 5:25 PM, Jeremiah Jahn wrote:<br>
&gt; I&#39;m using it for SL6. The problem is in openscap-cpe-oval.xml. The<br>
&gt; test for release is searching on RedHat only.<br>
&gt;<br>
&gt; I&#39;ve changed mine to the following: notice the (redhat|sl) on the<br>
&gt; second line. You should be able to change it to whatever the<br>
&gt; centos-release rpm says. I can&#39;t remember right now if SSG is where I<br>
&gt; got the original xml file, or if it&#39;s the one from open-scap. It&#39;s<br>
&gt; very possible that you&#39;ll have to make sure that you&#39;ll have to alter<br>
&gt; the ssg-rhel6-cpe-dictionary.xml to point to your altered cpe-oval<br>
&gt; file. I&#39;ve attached them just incase, but it took some tweaking.<br>
&gt;<br>
&gt; &lt;rpminfo_state id=&quot;oval:org.open-scap.cpe.rhel:ste:6&quot; version=&quot;1&quot;<br>
&gt; xmlns=&quot;<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5#linux</a>&quot;&gt;<br>
&gt;                   &lt;name operation=&quot;pattern match&quot;&gt;^(redhat|sl)-release&lt;/name&gt;<br>
&gt;                   &lt;version operation=&quot;pattern match&quot;&gt;^6[^\d]&lt;/version&gt;<br>
&gt;             &lt;/rpminfo_state&gt;<br>
<br>
<br>
</div>To illustrate how CPE works, as part of Greg&#39;s question....<br>
<br>
Step 1: In your OVAL check, you define which platforms the check is<br>
written for. This is done by the &lt;affected&gt; stanzas, such as:<br>
<br>
&gt;       &lt;affected family=&quot;unix&quot;&gt;<br>
&gt;         &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;<br>
&gt;       &lt;/affected&gt;<br>
<br>
<br>
Step 2: When an SCAP interpreter parses each OVAL rule, it will parse<br>
the &lt;affected&gt; tag above. For each &lt;platform&gt; listed, it will find the<br>
associated &lt;cpi-item&gt; to find what &lt;check&gt; needs to be ran. This will<br>
tell the SCAP interpreter if the OVAL rule is applicable for the system<br>
being scanned.<br>
<br>
For example, from SSG&#39;s CPE dictionary:<br>
<br>
&gt;       &lt;cpe-item name=&quot;cpe:/o:redhat:enterprise_linux:6&quot;&gt;<br>
&gt;             &lt;title xml:lang=&quot;en-us&quot;&gt;Red Hat Enterprise Linux 6&lt;/title&gt;<br>
&gt;             &lt;!-- the check references an OVAL file that contains an inventory definition --&gt;<br>
&gt;             &lt;check system=&quot;<a href="http://oval.mitre.org/XMLSchema/oval-definitions-5" target="_blank">http://oval.mitre.org/XMLSchema/oval-definitions-5</a>&quot; href=&quot;filename&quot;&gt;installed_OS_is_rhel6&lt;/check&gt;<br>

&gt;       &lt;/cpe-item&gt;<br>
<br>
In this case, if the &lt;platform&gt; tag matches the cpe-item/title, then the<br>
cpe-item/check will be ran. In the case of &quot;Red Hat Enterprise Linux 6&quot;<br>
the OVAL check &quot;installed_OS_is_rhel6&quot; will be ran.<br>
<br>
The installed_OS_is_rhel6 OVAL check queries the system to see if the<br>
redhat-release-{server workstation}-6 RPM is installed, for example:<br>
<br>
<a href="https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/installed_OS_is_rhel6.xml#L46#L55" target="_blank">https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/installed_OS_is_rhel6.xml#L46#L55</a><br>

&gt;   &lt;linux:rpminfo_test check=&quot;all&quot; check_existence=&quot;at_least_one_exists&quot; comment=&quot;redhat-release-server is version 6&quot; id=&quot;test_rhel_server&quot; version=&quot;1&quot;&gt;<br>
&gt;     &lt;linux:object object_ref=&quot;obj_rhel_server&quot; /&gt;<br>
&gt;     &lt;linux:state state_ref=&quot;state_rhel_server&quot; /&gt;<br>
&gt;   &lt;/linux:rpminfo_test&gt;<br>
&gt;   &lt;linux:rpminfo_state id=&quot;state_rhel_server&quot; version=&quot;1&quot;&gt;<br>
&gt;     &lt;linux:version operation=&quot;pattern match&quot;&gt;^6\.\d+$&lt;/linux:version&gt;<br>
&gt;   &lt;/linux:rpminfo_state&gt;<br>
&gt;   &lt;linux:rpminfo_object id=&quot;obj_rhel_server&quot; version=&quot;1&quot;&gt;<br>
&gt;     &lt;linux:name&gt;redhat-release-server&lt;/linux:name&gt;<br>
&gt;   &lt;/linux:rpminfo_object&gt;<br>
<br>
<br>
If the the check passes, the SCAP interpreter knows the particular OVAL<br>
rule is applicable to the system, executes the probes, and you get a<br>
pass/fail result. If the installed_OS_is_rhel6 check fails, the OVAL<br>
rule will be marked as &quot;Not Applicable.&quot;<br>
<br>
<br>
For users running derivative operating systems (CentOS, Scientific...)<br>
you can edit your CPE dictionary&#39;s regex like Jeremiah outlined. This<br>
will &quot;fake&quot; the system into thinking it&#39;s running RHEL6 and allow the<br>
check to be ran.<br>
<div class="HOEnZb"><div class="h5">--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br><br clear="all"><br>-- <br>Sincerely,<div><br></div><div>James</div>

</div>