openscap
openscap copied to clipboard
OpenSCAP
oscap xccdf validate - flood of warnings in validation of "oscap xccdf eval" results
Description of Problem:
When XCCDF results from oscap xccdf eval are being validated, a lot of warnings is printed out.
OpenSCAP Version:
openscap-1.3.5-2.el8
Operating System & Version:
RHEL 8
Steps to Reproduce:
-
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --report xccdf_org.ssgproject.content_profile_stig.html --results-arf xccdf_org.ssgproject.content_profile_stig-xccdf-arf-results.xml --results xccdf_org.ssgproject.content_profile_stig-xccdf-results.xml --oval-results /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml -
oscap xccdf validate xccdf_org.ssgproject.content_profile_stig-xccdf-results.xml
Actual Results:
<?xml version="1.0"?>
Warning: The 'cpe:/' prefix (CPE URI binding) is allowed within an @idref attribute, but the CPE Formatted String binding is preferred. See the XCCDF 1.2.1 specification, Section 6.2.5.
Warning: The 'cpe:/' prefix (CPE URI binding) is allowed within an @idref attribute, but the CPE Formatted String binding is preferred. See the XCCDF 1.2.1 specification, Section 6.2.5.
....
Warning: All 'value' or 'complex-value' elements have non-empty @selector attribute values. The default selection will be the first of these elements. To explicitly designate a default, remove the selector of the default element. See the XCCDF 1.2.1 specification, Section 6.4.5.5.
Warning: A 'rule-result' element should have exactly one child 'check' or 'complex-check' element. This is the conventional way of linking to the checking-system results for this Rule.
...
Expected Results:
No warnings.
This is related to the fact that we have started to perform the schematron validation by default. It looks like that the produced XCCDF results are not valid according to the schematron.
Actually, there are only 4 distinct messages but they repeat many times.
- Warning: All 'value' or 'complex-value' elements have non-empty @selector attribute values. The default selection will be the first of these elements. To explicitly designate a default, remove the selector of the default element. See the XCCDF 1.2.1 specification, Section 6.4.5.5.
- Warning: A 'rule-result' element should have exactly one child 'check' or 'complex-check' element. This is the conventional way of linking to the checking-system results for this Rule.
- Warning: The 'cpe:/' prefix (CPE URI binding) is allowed within an @idref attribute, but the CPE Formatted String binding is preferred. See the XCCDF 1.2.1 specification, Section 6.2.5.
- Warning: The @idref attribute in a 'conflicts' element should match the @id attribute of a different 'Rule' or 'Group' element. See the XCCDF 1.2.1 specification, Section 6.4.1.
