-
Notifications
You must be signed in to change notification settings - Fork 418
Description
Description of Problem:
I am trying to create a custom profile of DISA STIG for Red Hat Enterprise Linux 8. I am doing that in scap workbench->load content(Rhel8)->profile(DISA STIG Rhel8)->click customize-> provide customize ID->deselct all rules->select required rules(I selected 10)->ok->save customization only. Now I get a tailored .ds file. I am running the scan on a container. Below is the command I use,
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig_customized4 --tailoring-file ssg-rhel8-ds-10.xml --results scan_results.xml --report scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml
Now, the output is all the 10 rules I custom picked + 20 other rules. Not sure, what I am missing here.
Additionally, if I try something like this(explicitly providing rules in the command):
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --rule Verify_that_Shared_Library_Files_Have_Root_Ownership --results scan_results.xml --report scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml,
[the rule you see is the extra rule that gets scanned for but not present in my custom rule],
the output is “**OpenSCAP Error: Rule ‘Verify_that_Shared_Library_Files_Have_Root_Ownership’ not found in selected profile. [/builddir/build/BUILD/openscap-1.3.4/src/XCCDF_POLICY/xccdf_policy.c:2058]”**
- which makes sense but when I try with a rule that I know for sure is in the custom built profile, it still gives the same error. Any help is appreciated. Thanks in advance.