-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-10.1
-
No
-
Low
-
rhel-security-compliance
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
Summary:
============
OpenSCAP currently does not provide a built-in way to enumerate the rules or variables associated with a specific XCCDF profile. Users must rely on manual XML parsing, which is fragile, error-prone, and inconsistent across SCAP datastream versions.
Problem Statement:
========================
Users cannot list which rules are selected by a profile without parsing the XML manually.
Users cannot list which content_value_var_* variables are used by a profile.
This makes tailoring validation, CI/CD automation, and audits difficult and error-prone.
Proposed Enhancement:
========================
--list-rules option which all rule IDs selected by the profile.
--list-values option which list all XCCDF variables (content_value_var_*) used by the profile, optionally including default values.
Use Cases:
============
Validate that tailoring files reference correct variable names.
Build automated CI/CD checks for compliance.
Enable auditors to quickly see which rules and variables apply for a profile.
Examples:
============
Manual XML parsing currently required:
# xmllint --format /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml \
| awk -v profile="xccdf_org.ssgproject.content_profile_cis_server_l1" '
/<xccdf-1.2:Profile id="/ {inside=($0 ~ profile)}
inside {print}
/<\/xccdf-1.2:Profile>/ && inside {exit}
'