<div dir="ltr"><div class="gmail_quote">Hi all,</div><div class="gmail_quote">Thirst thanks a lot for the all the good work done here ;)</div><div class="gmail_quote"><br></div><div class="gmail_quote">I experience a strange issue after building via make the ssg for centos6 (<span style="color:rgb(33,63,77);font-family:Helvetica,arial,nimbussansl,liberationsans,freesans,clean,sans-serif,'Segoe UI Emoji','Segoe UI Symbol';font-size:18px;font-weight:bold;line-height:25.2000007629395px;background-color:rgb(230,241,246)">0.1.24 release</span>) </div><div class="gmail_quote"><div lang="EN-US" link="blue" vlink="purple"><p class="MsoNormal"><u></u></p>
<p class="MsoNormal">When running : <u></u><u></u></p>
<p class="MsoNormal">/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml<u></u><u></u></p>
<p class="MsoNormal">All check are not applicable<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Looking at the content of the produced xccdf i notive that the platform tag was still referencing rhel and not centos cpe</p><p class="MsoNormal"><br></p><p class="MsoNormal">To make the resulting xccdf work on a centos6 I had to change the following line in ssg-centos6-xccdf.xml:</p><p class="MsoNormal"><u></u></p>
<p class="MsoNormal"><i><ns0:platform idref="cpe:/o:linux: enterprise_linux:6" /></i><u></u><u></u></p>
<p class="MsoNormal">by<u></u><u></u></p>
<p class="MsoNormal"><i><ns0:platform idref="cpe:/o:centos:centos:6" /></i><u></u><u></u></p>
<p class="MsoNormal"><br></p><p class="MsoNormal">And now the command bellow work as expected</p><p class="MsoNormal">/usr/bin/oscap xccdf eval --profile pci-dss /usr/share/xml/scap/ssg-centos6-xccdf/ssg-centos6-xccdf.xml<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">So I took a big breath and I try to run the enable-derivative.py by hand<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When I run it with ds or xccdf the result differs :
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><i><font size="1">../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml -o /tmp/mike-centos6-xccdf.xml<u></u><u></u></font></i></p>
<p class="MsoNormal"><i><font size="1">[mike@caprica 6]$ grep platform /tmp/mike-centos6-xccdf.xml |grep cent</font></i><u></u><u></u></p>
<p class="MsoNormal"><u></u> --> no output<u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><font size="1"><i>../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-ds.xml -o /tmp/mike-centos6-ds.xml<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i><u></u> <u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i>[mike@caprica 6]$ grep platform /tmp/mike-centos6-ds.xml |grep cent<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i> <ns9:platform idref="cpe:/o:centos:centos:6" /></i></font><u></u><u></u></p>
<p class="MsoNormal"><u></u> --> we have the centos6 as expected<u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Digging deeper I thought that it is probably related to the following line:</p><p class="MsoNormal"><font size="1"><i><br></i></font></p><p class="MsoNormal"><font size="1"><i><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> benchmarks.extend([<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> (XCCDF11_NS, elem)<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF11_NS)))<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> ])<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> benchmarks.extend([<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> (XCCDF12_NS, elem)<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> for elem in list(root.findall(".//{%s}Benchmark" % (XCCDF12_NS)))<u></u><u></u></i></font></p>
<p class="MsoNormal" style="margin-left:36.0pt"><font size="1"><i> ]) </i></font> </p><p class="MsoNormal" style="margin-left:36.0pt"><u></u></p>
<p class="MsoNormal">For a strange reason the root.findall seems not to work with the xccdf file</p><p class="MsoNormal">I could not find out why this is not working….<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">XCCDF : <u></u><u></u></p>
<p class="MsoNormal"><font size="1"><i><Benchmark xmlns="<a href="http://checklists.nist.gov/xccdf/1.1" target="_blank">http://checklists.nist.gov/xccdf/1.1</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>" id="RHEL-6" resolved="1" xml:lang="en-US"><u></u><u></u></i></font></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DS:<u></u><u></u></p>
<p class="MsoNormal"><font size="1"><i><Benchmark xmlns="<a href="http://checklists.nist.gov/xccdf/1.2" target="_blank">http://checklists.nist.gov/xccdf/1.2</a>" id="xccdf_org.ssgproject.content_benchmark_RHEL-6" resolved="1" xml:lang="en-US"></i></font><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">To make a silly test I try the following<u></u><u></u></p><p class="MsoNormal"><br></p>
<p class="MsoNormal"><font size="1"><i> benchmarks.extend([<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i> (XCCDF11_NS, elem)</i></font></p>
<p class="MsoNormal"><font size="1"><i> for elem in list(root.findall("."))
<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i> ])<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i><u></u> </i></font></p>
<p class="MsoNormal"><font size="1"><i>../../shared/utils/enable-derivatives.py --enable-centos -i output/ssg-rhel6-xccdf.xml -o /tmp/mikeeeee</i></font></p>
<p class="MsoNormal"><font size="1"><i><u></u> <u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i>[mike@caprica 6]$ grep centos /tmp/mikeeeee<u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i> <ns0:notice id="centos_warning"><html:div><u></u><u></u></i></font></p>
<p class="MsoNormal"><font size="1"><i> <ns0:platform idref="cpe:/o:centos:centos:6" /></i></font><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">The result make me think i'm on looking on the right spot, but I could not find out why.</p><p class="MsoNormal">Somebody got an idea of what is going on? Or am I totaly missing something</p><p class="MsoNormal"><br></p><p class="MsoNormal">Regards</p><p class="MsoNormal">Mike</p><p class="MsoNormal"><br></p><p class="MsoNormal">PS : the same issue seems to affect RHEL7</p><p class="MsoNormal">REPS: i try to build on centos6 and fedora 21 (just in case i had a strange python dep issue or something) : same result</p></div></div><div><br></div>-- <br><div class="gmail_signature">Michael Boutillier<br><br></div>
</div>