Centos8.3 Not detected

[ichasco]

Description of Problem:

Hi, with the update to Centos8.3, the scan doesn't detect the System. With Centos8.2 works

OpenSCAP Version:

openscap-1.3.4-1.el8.x86_64
openscap-utils-1.3.4-1.el8.x86_64
openscap-scanner-1.3.4-1.el8.x86_64
scap-security-guide-0.1.53-1.el8.noarch
scap-workbench-1.2.0-5.el8.x86_64
openscap-containers-1.3.4-1.el8.noarch

Operating System & Version:

CentOS Linux release 8.3.2011

Steps to Reproduce:

1. Install Openscap
2. Run:

   oscap xccdf eval \
         --profile xccdf_org.ssgproject.content_profile_standard \
         --results-arf /var/tmp/oscap-arf.xml \
         --report /var/tmp/oscap-report.html \
         --fetch-remote-resources \
         /usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml

Actual Results:

get notapplicable and ignore all rules

Expected Results:

apply the CPE

Thanks!! :)

[evgenyz]

Most likely it belongs to CaC, but I'll leave it here until we will be sure.

[jan-cerny]

Actually, it's a problem in both OpenSCAP and SSG. This particular use-case has to be fixed in SSG but the same problem is also in OpenSCAP embed CPE dict.

I have found that the applicability checks depends on centos-release package. On CentOS 8.3 centos-release has been replaced by centos-linux-release. The change seems to be related to the CentOS Stream initiative. The CentOS Stream features centos-stream-release instead.

[evgenyz]

Another argument for switching to /etc/os-release and textfilecontent58.

[jan-cerny]

@evgenyz Why? We always prefer to use rpm if possible

[evgenyz]

For starters, /etc/os-release is more or less standard and centos-release is definitely not. Then, what would you use for Arch Linux? Also, do you remember RHCOS problems with librpm?

[ichasco]

Is there any workaround to fix it for the moment?

Thanks :)

[ggbecker]

Is there any workaround to fix it for the moment?

Thanks :)

The quickest workaround would be to change in /usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml lines such as:

        <linux:rpminfo_object id="oval:ssg-obj_centos8:obj:1" version="1">
            <linux:name>centos-release</linux:name>

to

        <linux:rpminfo_object id="oval:ssg-obj_centos8:obj:1" version="1">
            <linux:name>centos-linux-release</linux:name>

[ichasco]

Is there any workaround to fix it for the moment? Thanks :)

The quickest workaround would be to change in /usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml lines such as:

        <linux:rpminfo_object id="oval:ssg-obj_centos8:obj:1" version="1">
            <linux:name>centos-release</linux:name>

to

        <linux:rpminfo_object id="oval:ssg-obj_centos8:obj:1" version="1">
            <linux:name>centos-linux-release</linux:name>

Perfect! It works. Thanks

[guillemlc]

I am finding the same issue with CentOS 8.4. The file is correctly already using /etc/os-release, but it still gives me a not-applicable for all tests

          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Check os-release VERSION_ID" id="oval:ssg-obj_version_centos8:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>```

For example:

```oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cui  --fetch-remote-resources --report ssg-centos8-CIS-xccdf.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 

Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml ... ok

Title   Install AIDE
Rule    xccdf_org.ssgproject.content_rule_package_aide_installed
Ident   CCE-80844-4
Result  notapplicable

Same for all the other checks.

My /etc/os-release:

# cat /etc/os-release 
NAME="CentOS Linux"
VERSION="8"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="CentOS Linux 8"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:8"
HOME_URL="https://centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"
CENTOS_MANTISBT_PROJECT="CentOS-8"
CENTOS_MANTISBT_PROJECT_VERSION="8"```

[MedDevSecGuru987]

guillemlc Did you manage to run the scan on CentOS 8.4? If so, would you please share what you did?