iankko
commented
9 years ago Hello Jan,
thank you for your report. This is a known issue - the RHEL/7 SCAP content was never ever been in the state, the make validate target could be switched on for it. As you correctly pointed out in:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2015-August/006546.html
it has been commented out in August 2014. If you would checkout the RHEL/7 git repository content from August 2014, you would find out the situation now is better than it was before (IOW make validate now shows less rules failing that it has in August 2014). So it's not the case the make validate would be failing just for couple of rules, and instead of fixing it, we would comment it out. The situation is different - the RHEL/7 content was never in shape, the make validate target could be switched on. We are progressing (meaning during the time less and less rules are reported to be invalid), but still didn't reach the state RHEL/7 content could have the make validate target switched on.
For RHEVM3 and Openstack cases you refer above the situation is even worse -- if you would have a look at the actual RHEVM3 and Openstack content, you would notice there are no OVAL rules / remediations defined at all for these products (what is in the repository now for both products being just "template" scripts for both products, but no content at all). Therefore it does not make sense to run make validate target for these two products. And that's also the reason, why we do not ship these benchmarks in downstreams RPM packages.
Jan.
mpreisler
I tried to run
make validateinRHEL/7directory. The output is below. I also found out that in SSG Makefile,make validatetarget is commented out for RHEL7, Openstack and RHEVM3 content. This must be fixed because the content should be validated.