Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-143569

[RFE] Add list-rules and list-values option to oscap xccdf eval CLI for specific profile

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-10.1
    • openscap
    • rhel-security-compliance
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Summary:
      ============
      OpenSCAP currently does not provide a built-in way to enumerate the rules or variables associated with a specific XCCDF profile. Users must rely on manual XML parsing, which is fragile, error-prone, and inconsistent across SCAP datastream versions.

      Problem Statement:
      ========================

      Users cannot list which rules are selected by a profile without parsing the XML manually.
      Users cannot list which content_value_var_* variables are used by a profile.
      This makes tailoring validation, CI/CD automation, and audits difficult and error-prone.

      Proposed Enhancement:
      ========================

      --list-rules option which  all rule IDs selected by the profile.

      --list-values option which list all XCCDF variables (content_value_var_*) used by the profile, optionally including default values.

      Use Cases:
      ============
      Validate that tailoring files reference correct variable names.
      Build automated CI/CD checks for compliance.
      Enable auditors to quickly see which rules and variables apply for a profile.

      Examples:
      ============

      Manual XML parsing currently required:

      # xmllint --format /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml \
      | awk -v profile="xccdf_org.ssgproject.content_profile_cis_server_l1" '
      /<xccdf-1.2:Profile id="/ {inside=($0 ~ profile)}
      inside {print}
      /<\/xccdf-1.2:Profile>/ && inside {exit}
      '

              jcerny@redhat.com Jan Cerny
              rhn-support-vbhope Vaibhav Bhope
              Jan Cerny Jan Cerny
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: