<div dir="ltr"><div class="gmail_default" style="font-size:small">Bond,</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">You have to two files for CentOS:</div><div class="gmail_default" style="font-size:small">- <span style="font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;line-height:inherit;background-color:transparent;color:rgb(51,51,51);font-size:14px">ssg-centos6-cpe-dictionary.xml</span></div><div class="gmail_default" style="font-size:small"><span style="line-height:inherit;font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px">- </span><span style="line-height:inherit;font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px">ssg-centos6-cpe-oval.xml</span></div><div class="gmail_default" style="font-size:small"><span style="line-height:inherit;font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;background-color:transparent;color:rgb(51,51,51);font-size:14px"><br></span></div><div class="gmail_default"><span style="color:rgb(51,51,51);font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;font-size:14px">ssg-centos6-cpe-dictionary.xml describes the platform. (CPE stands for Common Platform Enumeration).</span></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px"><br></span></font></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px">But </span></font><span style="color:rgb(51,51,51);font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;font-size:14px">ssg-centos6-cpe-oval.xml consists of the &quot;Open Vulnerability Assessment Language&quot; code that _tests_ whether your platform is is CentOS. You must have both, b/c the first file refers to the second file.</span></div><div class="gmail_default"><span style="color:rgb(51,51,51);font-family:Consolas,&#39;Liberation Mono&#39;,Menlo,Courier,monospace;font-size:14px"><br></span></div><div class="gmail_default"><font color="#333333" face="Consolas, Liberation Mono, Menlo, Courier, monospace"><span style="font-size:14px">You can get them here:</span></font></div><div class="gmail_default"><div class="gmail_default"><a href="https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-dictionary.xml">https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-dictionary.xml</a></div><div class="gmail_default"><a href="https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-oval.xml">https://raw.githubusercontent.com/GovReady/govready/xplatform/templates/ssg-centos6-cpe-oval.xml</a></div><div><br></div><div>You can put the files anywhere, just make sure they are in the same directory together, and reference the full path/to/ssg-centos6-cpe-dictionary.xml</div><div><br></div><div>Greg</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 6, 2015 at 5:46 PM, Bond Masuda <span dir="ltr">&lt;<a href="mailto:bond.masuda@hexadiam.com" target="_blank">bond.masuda@hexadiam.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks Jan! Please see inline response below...<br>
<span class=""><br>
On 07/04/2015 04:32 AM, Jan Lieskovsky wrote:<br>
&gt; Hello Bond,<br>
&gt;<br>
&gt;   thank you for your report.<br>
&gt;<br>
&gt; ----- Original Message -----<br>
&gt;<br>
</span><span class="">&gt; I can reproduce that issue, when issuing just &#39;plain&#39; &quot;make&quot; in the<br>
&gt; scap-security-guide-0.1.23 folder. The issue is Fedora content by<br>
&gt; default requires OVAL-5.11 language version already, and the version<br>
&gt; of the openscap RPM you are trying to build Fedora content against<br>
&gt; (openscap-1.0.8-1.0.1.el6.centos.1.x86_64) does not support OVAL-5.11<br>
&gt; language version yet.<br>
&gt;<br>
&gt; We will correct this problem in an official way in the upcoming 0.1.24<br>
&gt; upstream release (should be available for download during next week).<br>
&gt;<br>
&gt; For now please use the following workaround (in the scap-security-guide-0.1.23<br>
&gt; directory after expanding the tarball), issue the following command:<br>
&gt;<br>
&gt; # make SSG_VERSION_IS_GIT_SNAPSHOT=no rpm<br>
&gt;<br>
&gt; This will correctly produce working RPM that can be subsequently used<br>
&gt; on RHEL-6 / CentOS6 system.<br>
<br>
</span>Yes, I was able to build the RPM, however not able to run with oscap.<br>
More below...<br>
<span class=""><br>
&gt;&gt; As of SCAP Security Guide release 0.1.23, CentOS content is now available<br>
&gt;&gt; (any older version will require tweaking). See the announcement here:<br>
&gt;&gt; <a href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-June/006462.html" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-June/006462.html</a><br>
&gt;&gt;<br>
&gt;&gt; You can download and build the SSG content from<br>
&gt;&gt; <a href="https://github.com/OpenSCAP/scap-security-guide" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide</a><br>
&gt;&gt;<br>
&gt;&gt; When you run the XCCDF, you have to specify the CentOS XCCDF like below:<br>
&gt;&gt;<br>
&gt;&gt; # oscap xccdf eval --profile stig-rhel6-server-upstream \<br>
&gt;&gt; --results /tmp/`hostname`-ssg-results.xml \<br>
&gt;&gt; --report /tmp/`hostname`-ssg-results.html \<br>
&gt;&gt; --cpe /usr/share/xml/scap/ssg/content/ssg-centos6-cpe-dictionary.xml \<br>
&gt;&gt; /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml<br>
&gt;&gt;<br>
&gt;&gt; Please note that I believe that ssg-centos6-cpe-dictionary.xml is not being<br>
&gt;&gt; built with SSG. OpenSCAP is here: <a href="https://github.com/openscap/openscap" rel="noreferrer" target="_blank">https://github.com/openscap/openscap</a> and<br>
&gt;&gt; the announcement here: So I believe all that needs to be done is:<br>
&gt;&gt;<br>
&gt;&gt; # oscap xccdf eval --profile stig-rhel6-server-upstream \<br>
&gt;&gt; --results /tmp/`hostname`-ssg-results.xml \<br>
&gt;&gt; --report /tmp/`hostname`-ssg-results.html \<br>
&gt;&gt; /usr/share/xml/scap/ssg/content/ssg-centos6-xccdf.xml<br>
&gt;&gt;<br>
<br>
</span>Trying to run the last command above without specifying CPE, results in<br>
all tests being &quot;notapplicable&quot;. And I confirmed there is no<br>
cpe-dictionary.xml being built for CentOS6.<br>
<br>
What am I missing?<br>
<div class="HOEnZb"><div class="h5">-Bond<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br></div>