search

OpenSCAP / openscap

NIST Certified SCAP 1.2 toolkit
https://www.open-scap.org/tools/openscap-base
GNU Lesser General Public License v2.1
1.38k stars 380 forks source link

issue with CIS benchmarks #1501

Closed themeswordpress closed 9 months ago

themeswordpress commented 4 years ago

i am trying to apply the following command but I have faced the following issue :

Command :

oscap xccdf eval --profile xccdf_org.cisecurity.benchmarks_profile_Level1-_Server --results-arf arf.xml --report report.html CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-xccdf.xml

ubuntu@ip-172-31-31-157:~/ubuntu-scap$ oscap xccdf eval --profile xccdf_org.cisecurity.benchmarks_profile_Level1-_Server --results-arf arf.xml --report report.html CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-xccdf.xml

OpenSCAP Error: File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 4467: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5#shell}shellcommand_test': This element is not expected. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 5756: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5#shell}shellcommand_object': This element is not expected. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 7377: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5#shell}shellcommand_state': This element is not expected. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 19: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}criterion': No match found for key-sequence ['oval:org.cisecurity.benchmarks.o_canonical_ubuntu_linux:tst:10002'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}testKeyRef'. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 32: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}criterion': No match found for key-sequence ['oval:org.cisecurity.benchmarks.o_canonical_ubuntu_linux:tst:10003'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}testKeyRef'. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 45: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}criterion': No match found for key-sequence ['oval:org.cisecurity.benchmarks.o_canonical_ubuntu_linux:tst:10004'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}testKeyRef'. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 58: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}criterion': No match found for key-sequence ['oval:org.cisecurity.benchmarks.o_canonical_ubuntu_linux:tst:10005'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}testKeyRef'. [../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Ben

themeswordpress commented 4 years ago

More info

[../../../src/XCCDF/xccdf_session.c:453] File './CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml' line 8380: Element '{http://oval.mitre.org/XMLSchema/oval-definitions-5}object_component': No match found for key-sequence ['oval:org.cisecurity.benchmarks.o_canonical_ubuntu_linux:obj:10390'] of keyref '{http://oval.mitre.org/XMLSchema/oval-definitions-5}objectKeyRef'. [../../../src/XCCDF/xccdf_session.c:453] Invalid OVAL Definition (5.11) content in ./CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml. [../../../src/source/oscap_source.c:268] Invalid XCCDF Checklist (1.2) content in CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0-oval.xml [../../../src/XCCDF/xccdf_session.c:772]

**ubuntu@ip-172-31-31-157:~/ubuntu-scap$ oscap -V OpenSCAP command line tool (oscap) 1.2.8 Copyright 2009--2017 Red Hat Inc., Durham, North Carolina.

==== Supported specifications ==== XCCDF Version: 1.2 OVAL Version: 5.11.1 CPE Version: 2.3 CVSS Version: 2.0 CVE Version: 2.0 Asset Identification Version: 1.1 Asset Reporting Format Version: 1.1

==== Capabilities added by auto-loaded plugins ====**

redhatrises commented 4 years ago

@themeswordpress shellcommand_test isn't supported by the official spec. Also, if you manually removed the shellcommand_test, you need to also remove the shellcommand_object and state if the exist as well.

themeswordpress commented 4 years ago

is there any workaround for it?

themeswordpress commented 4 years ago

please this is Urgent for me, is there any workaround, any idea will help me?

themeswordpress commented 4 years ago

@themeswordpress shellcommand_test isn't supported by the official spec. Also, if you manually removed the shellcommand_test, you need to also remove the shellcommand_object and state if the exist as well.

please this is Urgent for me, is there any workaround, any idea will help me?

jan-cerny commented 4 years ago

@themeswordpress You can manually remove all shellcommand_test, shellcommand_object and shellcommand_state elements from the XML file. You can also try adding --skip-valid option to the oscap command to skip the validation against XML schema. Unfortunately, the shellcomand test isn't part of the OVAL standard. We don't implement it at this moment.