Skip to content

Commit c70bc47

Browse files
jan-cernyjan-cerny
committed
Merge branch 'maint-1.2' into maint-1.3
 Conflicts: cpe/openscap-cpe-dict.xml cpe/openscap-cpe-oval.xml
2 parents 6ed1c04 + e121009 commit c70bc47

14 files changed

+128
-30
lines changed

‎cpe/openscap-cpe-dict.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,10 @@
214214
<title xml:lang="en-us">Wind River Linux 8</title>
215215
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.wrlinux:def:8</check>
216216
</cpe-item>
217+
<cpe-item name="cpe:/o:windriver:wrlinux:1019">
218+
<title xml:lang="en-us">Wind River Linux 1019</title>
219+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.wrlinux:def:1019</check>
220+
</cpe-item>
217221
<cpe-item name="cpe:/o:microsoft:windows_7">
218222
<title xml:lang="en-us">Microsoft Windows 7</title>
219223
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="openscap-cpe-oval.xml">oval:org.open-scap.cpe.windows:def:7</check>

‎cpe/openscap-cpe-oval.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -651,6 +651,19 @@
651651
<criterion comment="Wind River Linux version is 8." test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" />
652652
</criteria>
653653
</definition>
654+
<definition class="inventory" id="oval:org.open-scap.cpe.wrlinux:def:1019" version="1" >
655+
<metadata>
656+
<title>Wind River Linux 1019</title>
657+
<affected family="unix">
658+
<platform>Wind River Linux 1019</platform>
659+
</affected>
660+
<reference ref_id="cpe:/o:windriver:wrlinux:1019" source="CPE"/>
661+
<description>The operating system installed on the system is Wind River Linux 1019</description>
662+
</metadata>
663+
<criteria>
664+
<criterion comment="Wind River Linux version is 1019." test_ref="oval:org.open-scap.cpe.wrlinux:tst:1019" />
665+
</criteria>
666+
</definition>
654667
<definition class="inventory" id="oval:org.open-scap.cpe.windows:def:7" version="1">
655668
<metadata>
656669
<title>Microsoft Windows 7</title>
@@ -1006,6 +1019,17 @@
10061019
<object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:2"/>
10071020
<state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:8"/>
10081021
</textfilecontent54_test>
1022+
<textfilecontent54_test
1023+
id="oval:org.open-scap.cpe.wrlinux:tst:1019"
1024+
check="all"
1025+
check_existence="all_exist"
1026+
comment="Check /etc/os-release for VERSION 1019 specification."
1027+
version="1"
1028+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
1029+
>
1030+
<object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:3"/>
1031+
<state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:10"/>
1032+
</textfilecontent54_test>
10091033
<rpminfo_test check="all" check_existence="only_one_exists" comment="redhat-release-virtualization-host RPM package is installed" id="oval:org.open-scap.cpe.rhevh:tst:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
10101034
<object object_ref="oval:org.open-scap.cpe.rhevh:obj:1" />
10111035
</rpminfo_test>
@@ -1083,6 +1107,17 @@
10831107
<pattern operation="pattern match">^VERSION=.([[:digit:]]*)</pattern>
10841108
<instance operation="greater than or equal" datatype="int">1</instance>
10851109
</textfilecontent54_object>
1110+
<textfilecontent54_object
1111+
id="oval:org.open-scap.cpe.wrlinux-release:obj:3"
1112+
comment="Check VERSION specification in /etc/os-release."
1113+
version="1"
1114+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
1115+
>
1116+
<path>/etc</path>
1117+
<filename>os-release</filename>
1118+
<pattern operation="pattern match">^VERSION=.(\d*.\d*)</pattern>
1119+
<instance operation="greater than or equal" datatype="int">1</instance>
1120+
</textfilecontent54_object>
10861121
<rpminfo_object id="oval:org.open-scap.cpe.rhevh:obj:1" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
10871122
<name>redhat-release-virtualization-host</name>
10881123
</rpminfo_object>
@@ -1266,6 +1301,14 @@
12661301
>
12671302
<subexpression operation="pattern match">8</subexpression>
12681303
</textfilecontent54_state>
1304+
<textfilecontent54_state
1305+
id="oval:org.open-scap.cpe.wrlinux-release:ste:10"
1306+
comment="Check the /etc/os-release file for VERSION 1019 specification."
1307+
version="1"
1308+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
1309+
>
1310+
<subexpression operation="pattern match">10.19</subexpression>
1311+
</textfilecontent54_state>
12691312
<textfilecontent54_state id="oval:org.open-scap.cpe.rhevh:ste:2" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
12701313
<subexpression operation="pattern match">7</subexpression>
12711314
</textfilecontent54_state>

‎docs/manual/manual.adoc

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,50 @@ Ident CCE-3967-7
459459
Result pass
460460
----
461461

462+
The meaning of results is defined by https://csrc.nist.gov/CSRC/media/Publications/nistir/7275/rev-4/final/documents/nistir-7275r4_updated-march-2012_clean.pdf[XCCDF Specification].
463+
This table lists the possible results of a single rule:
464+
465+
.XCCDF results
466+
|===
467+
|Result |Description |Example Situation
468+
469+
|pass
470+
|The target system or system component satisfied all the conditions of the rule.
471+
|
472+
473+
|fail
474+
|The target system or system component did not satisfy all the conditions of the rule.
475+
|
476+
477+
|error
478+
|The checking engine could not complete the evaluation, therefore the status of the target’s compliance with the rule is not certain.
479+
|OpenSCAP was run with insufficient privileges and could not gather all of the necessary information.
480+
481+
|unknown
482+
|The testing tool encountered some problem and the result is unknown.
483+
|OpenSCAP was unable to interpret the output of the checking engine (the output has no meaning to OpenSCAP).
484+
485+
|notapplicable
486+
|The rule was not applicable to the target of the test.
487+
|The rule might have been specific to a different version of the target OS, or it might have been a test against a platform feature that was not installed.
488+
489+
|notchecked
490+
|The rule was not evaluated by the checking engine. This status is designed for rules that have no <xccdf:check> elements or that correspond to an unsupported checking system. It may also correspond to a status returned by a checking engine if the checking engine does not support the indicated check code.
491+
|The rule does not reference any OVAL check.
492+
493+
|notselected
494+
|The rule was not selected in the benchmark. OpenSCAP does not display rules that were not selected.
495+
|The rule exists in the benchmark, but is not a part of selected profile.
496+
497+
|informational
498+
|The rule was checked, but the output from the checking engine is simply information for auditors or administrators; it is not a compliance category. This status value is designed for rules whose main purpose is to extract information from the target rather than test the target.
499+
|
500+
501+
|fixed
502+
|The rule had failed, but was then fixed by automated remediation.
503+
|
504+
|===
505+
462506
The CPE dictionary is used to determine whether the content is
463507
applicable on the target platform or not. Any content that is not
464508
applicable will result in each relevant XCCDF rule being evaluated to
@@ -1859,3 +1903,12 @@ Again, usage of the tool mimics usage and options of `oscap` tool.
18591903

18601904

18611905

1906+
== Frequently Asked Questions (FAQs)
1907+
*Why do I get "notchecked" results when I use e.g. https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Red_Hat_Enterprise_Linux_7_V2R3_STIG.zip[STIG checklist]?*
1908+
1909+
The downloaded guidance contains rule descriptions, but it doesn't contain OVAL checks which could be used for evaluation by OpenSCAP. You can find guidances with implemented OVAL checks and also with remediations at https://github.com/ComplianceAsCode/content[ComplianceAsCode] project, which contains wide range of profiles.
1910+
1911+
*I try to apply a tailoring file, but OpenSCAP still evaluates rules that I have unselected. How can I enforce my changes of the profile?*
1912+
1913+
Make sure that you provide the ID of the customized profile in `--profile` option instead of the ID of the original profile.
1914+
If you created the tailoring file using SCAP Workbench, you were prompted to choose the ID of the customized profile. You can display the ID of the customized profile by running `oscap info <your_tailoring_file>`. By default, the ID of the customized profile ends with `_customized` suffix.

‎src/SCE/sce_engine.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -425,6 +425,9 @@ xccdf_test_result_type_t sce_engine_eval_rule(struct xccdf_policy *policy, const
425425
if (value == NULL)
426426
{
427427
value = xccdf_value_binding_get_value(binding);
428+
if (value == NULL) {
429+
value = "";
430+
}
428431
}
429432
xccdf_operator_t operator = xccdf_value_binding_get_operator(binding);
430433

‎src/XCCDF_POLICY/xccdf_policy.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -592,10 +592,10 @@ _xccdf_policy_rule_get_applicable_check(struct xccdf_policy *policy, struct xccd
592592

593593
// Only print a warning if we didn't select a check but could've otherwise.
594594
if (print_oval_warning) {
595-
printf("WARNING: Skipping rule that uses OVAL but is possibly malformed; "
595+
dW("Skipping rule that uses OVAL but is possibly malformed; "
596596
"an incorrect content reference prevents this check from being evaluated.\n");
597597
} else if (print_general_warning && result == NULL) {
598-
printf("WARNING: Skipping rule that requires an unregistered check system "
598+
dW("Skipping rule that requires an unregistered check system "
599599
"or incorrect content reference to evaluate. "
600600
"Please consider providing a valid SCAP/OVAL instead of %s\n",
601601
warning_check_system);

‎tests/API/XCCDF/unittests/test_xccdf_check_processing_selector_empty.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ $OSCAP xccdf eval --profile xccdf_moc.elpmaxe.www_profile_1 --results $result $s
1313

1414
echo "Stderr file = $stderr"
1515
echo "Result file = $result"
16-
[ -f $stderr ]; [ ! -s $stderr ]; rm $stderr
16+
grep "Skipping rule that requires an unregistered check system or incorrect content reference to evaluate." $stderr
17+
rm $stderr
1718

1819
$OSCAP xccdf validate $result
1920

‎tests/API/XCCDF/unittests/test_xccdf_check_unsupported_check_system.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ stderr=`mktemp`
99

1010
$OSCAP xccdf eval --results $result $srcdir/test_xccdf_check_unsupported_check_system.xml 2> $stderr
1111
echo "Stderr file = $stderr"
12-
[ -f $stderr ]; [ ! -s $stderr ]; rm $stderr
12+
grep "Skipping rule that requires an unregistered check system or incorrect content reference to evaluate." $stderr
13+
rm $stderr
1314

1415
$OSCAP xccdf validate $result
1516

‎tests/API/XCCDF/unittests/test_xccdf_check_without_content_refs.sh

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ $OSCAP xccdf eval --results $result $srcdir/test_xccdf_check_without_content_ref
1111

1212
echo "Stderr file = $stderr"
1313
echo "Result file = $result"
14-
[ -f $stderr ]; [ ! -s $stderr ]; rm $stderr
14+
[ -f $stderr ]
15+
grep "Skipping rule that uses OVAL but is possibly malformed; an incorrect content reference prevents this check from being evaluated." $stderr
16+
rm $stderr
1517

1618
$OSCAP xccdf validate $result
1719

‎tests/API/XCCDF/unittests/test_xccdf_multiple_testresults.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ tmpdir=$(dirname $result)
1717
for i in {1..5}; do
1818
$OSCAP xccdf eval --results $result $result 2> $stderr
1919
[ -f $stderr ]
20-
[ "`cat $stderr`" == "WARNING: Skipping $tmpdir/non_existent.oval.xml file which is referenced from XCCDF content" ]
20+
grep "Skipping $tmpdir/non_existent\.oval\.xml file which is referenced from XCCDF content" $stderr
2121
:> $stderr
2222

2323
$OSCAP xccdf validate $result

‎tests/API/XCCDF/unittests/test_xccdf_notchecked_has_check.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ $OSCAP xccdf eval --results $result $srcdir/${name}.xccdf.xml 2> $stderr
1414
echo "Stderr file = $stderr"
1515
echo "Result file = $result"
1616
[ -f $stderr ]
17-
[ "WARNING: Skipping $srcdir/_non_existent_.oval.xml file which is referenced from XCCDF content" == "`cat $stderr`" ]
17+
grep "Skipping $srcdir/_non_existent_\.oval\.xml file which is referenced from XCCDF content" $stderr
1818
rm $stderr
1919

2020
$OSCAP xccdf validate $result

0 commit comments

Comments
 (0)