Bug 2020580
| Summary: | [RFE] Allow specifying --exclude-rules to evaluate all rules in a profile except some | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Jan Pazdziora (Red Hat) <jpazdziora> |
| Component: | openscap | Assignee: | Jan Černý <jcerny> |
| Status: | CLOSED ERRATA | QA Contact: | Matus Marhefka <mmarhefk> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.0 | CC: | jpazdziora, mhaicman, mmarhefk |
| Target Milestone: | rc | Keywords: | AutoVerified, FutureFeature, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | openscap-1.3.6-2.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-17 13:04:37 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jan Pazdziora (Red Hat)
2021-11-05 10:23:27 UTC
As a workaround there is the "autotailor" utility which can be used to create the tailoring file on the command line. Thanks for the pointer. Quickly checking the man page and the --help output, I came up with # autotailor -u xccdf_org.ssgproject.content_rule_grub2_uefi_password /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml xccdf_org.ssgproject.content_profile_ospp > tailor.xml # oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp tailor.xml but that gave me OpenSCAP Error: Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unrecognized document type for: ./file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:341] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Unable to open file: './file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml' [/builddir/build/BUILD/openscap-1.3.5/src/source/oscap_source.c:288] Invalid (null) ((null)) content in ./file:///usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml [/builddir/build/BUILD/openscap-1.3.5/src/XCCDF/xccdf_session.c:713] Is that expected or a bug? Hello Jan, the omission is in the second command. The tailoring file is not the right source, and the command that works is: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --tailoring-file tailor.xml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml So the behavior is not a bug, but I understand the output you've got is not very user friendly, nor guiding you the right way. There is a PR opened in upstream in https://github.com/OpenSCAP/openscap/pull/1832 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: openscap), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2449 |