Bug 1182242

Summary: USGCB, OVAL validating: var_check has been supplied, var_ref missing
Product: Red Hat Enterprise Linux 7 Reporter: Martin Žember <mzember>
Component: openscapAssignee: Šimon Lukašík <slukasik>
Status: CLOSED ERRATA QA Contact: Martin Žember <mzember>
Severity: low Docs Contact:
Priority: low    
Version: 7.1CC: ebenes, ksrot, mpreisle, openscap-maint, ovasik, pvrabec
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openscap-1.1.1-3.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-05 09:07:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Žember 2015-01-14 17:06:31 UTC
Description of problem:
Validating of OVAL results displays:
var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided

Version-Release number of selected component (if applicable):
openscap-1.1.1-2.el7 (this did not happen in openscap-1.0.3-2.el7)

How reproducible:
At least once

Steps to Reproduce:
wget http://usgcb.nist.gov/usgcb/content/scap/USGCB-rhel5desktop-1.0.5.0.zip     # Downloading...they have a lot of outages. Sometimes it works sometimes it doesn't."
unzip USGCB-rhel5desktop-1.0.5.0.zip -d usgcb     # Unzipping"
oscap xccdf eval --profile united_states_government_configuration_baseline --results usgcb-xccdf-results.xml --oval-results usgcb/usgcb-rhel5desktop-xccdf.xml     # Evaluating profile 'usgcb'"
oscap xccdf validate-xml usgcb-xccdf-results.xml     # Validating XCCDF results"
oscap oval validate-xml --results --schematron usgcb-rhel5desktop-oval.xml.result.xml     # Validating OVAL results" 

Actual results:
The last command 'oscap oval validate-xml --results --schematron usgcb-rhel5desktop-oval.xml.result.xml' outputs this:
<?xml version="1.0"?>
oval:gov.nist.usgcb.rhel:obj:256 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:201061 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200841 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200831 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200800 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided

Invalid OVAL Results content(5.8) in usgcb-rhel5desktop-oval.xml.result.xml.
(return code 2)

Expected results:
Nothing (return code 0)

Additional info:

Comment 2 Martin Preisler 2015-01-15 13:25:25 UTC
I have just reproduced this issue with openscap from maint-1.0.

Are you sure this issue is not reproducible with openscap-1.0.3-2.el7? It could be that it was introduced between 1.0.3 and maint-1.0 HEAD.

$ ../run ../utils/.libs/oscap --v
OpenSCAP command line tool (oscap) 1.0.10
...

$ ../run ../utils/.libs/oscap xccdf eval --profile united_states_government_configuration_baseline --results usgcb-xccdf-results.xml --oval-results usgcb-rhel5desktop-xccdf.xml
...

$ ../run ../utils/.libs/oscap oval validate-xml --results --schematron usgcb-rhel5desktop-oval.xml.result.xml
<?xml version="1.0"?>
oval:gov.nist.usgcb.rhel:obj:256 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:201061 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200841 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200831 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided
oval:gov.nist.usgcb.rhel:obj:200800 - a var_check has been supplied for the ind-def:var_ref entity so a var_ref should also be provided

Invalid OVAL Results content(5.8) in usgcb-rhel5desktop-oval.xml.result.xml.

Comment 3 Martin Preisler 2015-01-15 13:43:37 UTC
Have bisected the revision tree and this is the commit that breaks.

$ git bisect good

aebc254a4e6993ef79a549c2f71b5a6a4eb3ed01 is the first bad commit
commit aebc254a4e6993ef79a549c2f71b5a6a4eb3ed01
Author: Martin Preisler <mpreisle>
Date:   Mon Nov 3 19:49:06 2014 +0100

    Export var_check in OVAL object when var_ref is present
    
    Fixes validation issues with schematron, such as:
    
    oval:mil.disa.fso.redhat.rhel6:obj:3184 - a var_ref has been supplied for the
    ind-def:pattern entity so a var_check should also be provided

That is the fix for bz#1159289.

Seems we used to export var_check too rarely and now we export it too often. Will investigate further.

Comment 6 Šimon Lukašík 2015-01-20 15:16:54 UTC
Note to myself, there was another commit by Martin, that needs to be cherry-picked here.

Comment 7 Šimon Lukašík 2015-01-20 16:10:53 UTC
Thanks for the acks, sir.

Comment 11 errata-xmlrpc 2015-03-05 09:07:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2015-0392.html