Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1479

[RFE] oscap to run rules based on policy reference

    • rhel-sst-security-compliance
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None

      Description of problem:
      The execution of compliance checks is often based on requirements of the policy, and not on the rules of the SCAP profile. When a user wants to check for particular requirement coverage, they need to parse the XML themselves.

      There's expectation this is quite common step, and while it's not too hard to achieve it, there's also no point for each customer to recreate some kind of automation for that.

      Having something like `oscap xccdf eval --profile stig --reference '800-53:CM-6(a)' ssg-rhel7-ds.xml` which would execute only subset of stig profile that has the reference

      Version-Release number of selected component (if applicable):
      openscap-1.3.6

      How reproducible:
      it's a new feature request

      Steps to Reproduce:
      1. `oscap xccdf eval --profile stig --reference '800-53:CM-6(a)' ssg-rhel7-ds.xml`

      • to run the subset of profile rules that conforms the reference
        2. `oscap xccdf eval --profile stig --reference 800-53:CM-6 ssg-rhel7-ds.xml`
      • to run the subset of profile rules that conforms the references CM-6(a) CM-6(b) ...
        3. `oscap info -profile stig-references ssg-rhel7-ds.xml
      • will print list of possible references related to the profile available in the content

      Actual results:
      Not implemented

      Expected results:
      Implemented

      Additional info:
      This might require some update to the content as well - the references at the moment are identified in the XCCDF via URLs, which is not that cool.

              jcerny@redhat.com Jan Cerny
              mhaicman@redhat.com Marek Haicman
              Jan Cerny Jan Cerny
              Milan Lysonek Milan Lysonek
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: