-
Bug
-
Resolution: Unresolved
-
Undefined
-
rhel-8.8.0
-
None
-
None
-
None
-
rhel-sst-security-compliance
-
ssg_security
-
1
-
False
-
-
No
-
None
-
Release Note Not Required
-
None
What were you trying to do that didn't work?
Problem:
========
Unable to perform OpenSCAP scan using tailoring files.
The customer downloaded the stig content from the URL(https://public.cyber.mil/stigs/), If he uses the default profile it works however if he creates a tailoring file using the Scapworkbend and then run the scan, the scan end up with the below exception:-
OpenSCAP Error: Unable to find namespace 'http://www.w3.org/1999/xlink' in the XML DOM tree. This is most likely an internal error!. [/builddir/build/BUILD/openscap-1.3.8/src/DS/rds.c:763]
Please provide the package NVR for which bug is seen:
scap-security-guide-0.1.72-2.el8_9.noarch
How reproducible:
100%
Steps to reproduce
- Created a tailoring file using the stig profile shared by the customer (U_RHEL_8_V1R12_STIG_SCAP_1-2_Benchmark.xml ) using the SCAPWorkbench in my RHEL 8.9 host and tried to run the scan and it failed with the same error.
Expected results
Should work without any issues.
Additional info:-
- oscap xccdf eval --profile xccdf_mil.disa.stig_profile_CAT_I_Only --report report.html --tailoring-file ./U_RHEL_8_V1R12_STIG_SCAP_1-2_Benchmark-tailoring.xml ./U_RHEL_8_V1R12_STIG_SCAP_1-2_Benchmark.xml
-
- Starting Evaluation —
-
Title RHEL 8 must be a vendor-supported release.
Rule xccdf_mil.disa.stig_rule_SV-230221r858734_rule
Ident CCI-000366
Result pass
Title RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Rule xccdf_mil.disa.stig_rule_SV-230223r928585_rule
Ident CCI-000068
Result fail
+-----> unexpected rule, my tailoring file only checked the first rule
[... more unexpected rules ... then failure ]
OpenSCAP Error: Unable to find namespace 'http://www.w3.org/1999/xlink' in the XML DOM tree. This is most likely an internal error!. [/builddir/build/BUILD/openscap-1.3.8/src/DS/rds.c:763]
Checking the source code, it fails while loading the tailoring file:
664 static int _ds_rds_create_from_dom(xmlDocPtr *ret, xmlDocPtr sds_doc,
665 xmlDocPtr tailoring_doc, const char *tailoring_filepath,
666 char *tailoring_doc_timestamp, xmlDocPtr xccdf_result_file_doc,
667 struct oscap_htable *oval_result_sources,
668 struct oscap_htable *oval_result_mapping,
669 struct oscap_htable *arf_report_mapping,
670 bool clone)
671 {
:
758 xmlNsPtr xlink_ns = xmlSearchNsByHref(doc, sds_res_node, BAD_CAST xlink_ns_uri);
759 if (!xlink_ns)
: