-
Story
-
Resolution: Done-Errata
-
Normal
-
rhel-8.6.0
-
rhel-sst-security-compliance
-
ssg_security
-
None
-
False
-
-
No
-
None
-
-
Pass
-
None
-
-
Unspecified
-
None
Description of problem:
The execution of compliance checks is often based on requirements of the policy, and not on the rules of the SCAP profile. When a user wants to check for particular requirement coverage, they need to parse the XML themselves.
There's expectation this is quite common step, and while it's not too hard to achieve it, there's also no point for each customer to recreate some kind of automation for that.
Having something like `oscap xccdf eval --profile stig --reference '800-53:CM-6(a)' ssg-rhel7-ds.xml` which would execute only subset of stig profile that has the reference
Version-Release number of selected component (if applicable):
openscap-1.3.6
How reproducible:
it's a new feature request
Steps to Reproduce:
1. `oscap xccdf eval --profile stig --reference '800-53:CM-6(a)' ssg-rhel7-ds.xml`
- to run the subset of profile rules that conforms the reference
2. `oscap xccdf eval --profile stig --reference 800-53:CM-6 ssg-rhel7-ds.xml` - to run the subset of profile rules that conforms the references CM-6(a) CM-6(b) ...
3. `oscap info -profile stig-references ssg-rhel7-ds.xml - will print list of possible references related to the profile available in the content
Actual results:
Not implemented
Expected results:
Implemented
Additional info:
This might require some update to the content as well - the references at the moment are identified in the XCCDF via URLs, which is not that cool.
- external trackers
- links to
-
RHBA-2024:130343 openscap bug fix and enhancement update