<div dir="ltr"><div class="gmail_default" style="font-size:small">Bond,</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">You have to two files for CentOS:</div><div class="gmail_default" style="font-size:small">- <span style="font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:inherit;background-color:transparent;color:rgb(51,51,51);font-size:14px">ssg-centos6-cpe-dictionary.xml</span></div><div class="gmail_default" style="font-size:small"><span style="line-height:inherit;font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px">- </span><span style="line-height:inherit;font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px">ssg-centos6-cpe-oval.xml</span></div><div class="gmail_default" style="font-size:small"><span style="line-height:inherit;font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px"><br></span></div><div class="gmail_default"><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:14px">ssg-centos6-cpe-dictionary.xml describes the platform. (CPE stands for Common Platform Enumeration).</span></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px"><br></span></font></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px">But </span></font><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:14px">ssg-centos6-cpe-oval.xml consists of the "Open Vulnerability Assessment Language" code that _tests_ whether your platform is is CentOS. You must have both, b/c the first file refers to the second file.</span></div><div class="gmail_default"><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:14px"><br></span></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px">You can get them here:</span></font></div><div class="gmail_default"><div class="gmail_default"><a href="https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-dictionary.xml">https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-dictionary.xml</a></div><div class="gmail_default"><a href="https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-oval.xml">https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-oval.xml</a></div><div><br></div><div>You can put the files anywhere, just make sure they are in the same directory together, and reference the full path/to/ssg-centos6-cpe-dictionary.xml</div><div><br></div><div>Greg</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 6, 2015 at 5:46 PM, Bond Masuda <span dir="ltr"><<a href="mailto:bond.masuda@hexadiam.com" target="_blank">bond.masuda@hexadiam.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Jan! Please see inline response below...<br>
<span class=""><br>
On 07/04/2015 04:32 AM, Jan Lieskovsky wrote:<br>
> Hello Bond,<br>
><br>
> thank you for your report.<br>
><br>
> ----- Original Message -----<br>
><br>
</span><span class="">> I can reproduce that issue, when issuing just 'plain' "make" in the<br>
> scap-security-guide-0.1.23 folder. The issue is Fedora content by<br>
> default requires OVAL-5.11 language version already, and the version<br>
> of the openscap RPM you are trying to build Fedora content against<br>
> (openscap-1.0.8-1.0.1.el6.centos.1.x86_64) does not support OVAL-5.11<br>
> language version yet.<br>
><br>
> We will correct this problem in an official way in the upcoming 0.1.24<br>
> upstream release (should be available for download during next week).<br>
><br>
> For now please use the following workaround (in the scap-security-guide-0.1.23<br>
> directory after expanding the tarball), issue the following command:<br>
><br>
> # make SSG_VERSION_IS_GIT_SNAPSHOT=no rpm<br>
><br>
> This will correctly produce working RPM that can be subsequently used<br>
> on RHEL-6 / CentOS6 system.<br>
<br>
</span>Yes, I was able to build the RPM, however not able to run with oscap.<br>
More below...<br>
<span class=""><br>
>> As of SCAP Security Guide release 0.1.23, CentOS content is now available<br>
>> (any older version will require tweaking). See the announcement here:<br>
>> <a href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-June/006462.html" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-June/006462.html</a><br>
>><br>
>> You can download and build the SSG content from<br>
>> <a href="https://github.com/OpenSCAP/scap-security-guide" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide</a><br>
>><br>
>> When you run the XCCDF, you have to specify the CentOS XCCDF like below:<br>
>><br>
>> # oscap xccdf eval --profile stig-rhel6-server-upstream \<br>
>> --results /tmp/`hostname`-ssg-results.xml \<br>
>> --report /tmp/`hostname`-ssg-results.html \<br>
>> --cpe /usr/share/xml/scap/ssg/content/ssg-centos6-cpe-dictionary.xml \<br>
>> /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml<br>
>><br>
>> Please note that I believe that ssg-centos6-cpe-dictionary.xml is not being<br>
>> built with SSG. OpenSCAP is here: <a href="https://github.com/openscap/openscap" rel="noreferrer" target="_blank">https://github.com/openscap/openscap</a> and<br>
>> the announcement here: So I believe all that needs to be done is:<br>
>><br>
>> # oscap xccdf eval --profile stig-rhel6-server-upstream \<br>
>> --results /tmp/`hostname`-ssg-results.xml \<br>
>> --report /tmp/`hostname`-ssg-results.html \<br>
>> /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml<br>
>><br>
<br>
</span>Trying to run the last command above without specifying CPE, results in<br>
all tests being "notapplicable". And I confirmed there is no<br>
cpe-dictionary.xml being built for CentOS6.<br>
<br>
What am I missing?<br>
<div class="HOEnZb"><div class="h5">-Bond<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br></div>