Skip to content

Tailoring breaks validating SCAP Source Datastream #2260

@xl-sec

Description

@xl-sec

I'm trying to generate a fix based on a tailored arf results file, but it doesn't pass the validation.

Steps to reproduce:

$ oscap --version
OpenSCAP command line tool (oscap) 1.3.12
(..)

$ autotailor --unselect account_disable_post_pw_expiration --var-value var_time_service_set_maxpoll=14 --output stig_tailored.xml --new-profile-id stig_tailored /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml stig

$ oscap xccdf eval --profile stig_tailored --tailoring-file stig_tailored.xml --results-arf stig.xml --report stig.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml > stig.log
(...)

$ oscap xccdf --verbose DEVEL generate fix --fix-type ansible --output stig.yml --profile stig_tailored --tailoring-file stig_tailored.xml stig.xml
I: oscap: Using environment variables: [oscap(65560):oscap(7f858ce28940):debug.c:317:oscap_print_env_vars]
I: oscap: OSCAP_CHECK_ENGINE_PLUGIN_DIR='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_CONTAINER_VARS='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_EVALUATION_TARGET='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_FULL_VALIDATION='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_OVAL_COMMAND_OPTIONS='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PCRE_EXEC_RECURSION_LIMIT='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PROBE_ROOT='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: SEXP_VALIDATE_DISABLE='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: SOURCE_DATE_EPOCH='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PROBE_MEMORY_USAGE_RATIO='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PROBE_MAX_COLLECTED_ITEMS='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PROBE_IGNORE_PATHS='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: OSCAP_PREFERRED_ENGINE='' [oscap(65560):oscap(7f858ce28940):debug.c:320:oscap_print_env_vars]
I: oscap: Identified document type: asset-report-collection [oscap(65560):oscap(7f858ce28940):doc_type.c:96:oscap_determine_document_type_reader]
I: oscap: Identified document type: data-stream-collection [oscap(65560):oscap(7f858ce28940):doc_type.c:96:oscap_determine_document_type_reader]
I: oscap: Created a new XCCDF session from a SCAP Source Datastream '(null)/report-request.xml'. [oscap(65560):oscap(7f858ce28940):xccdf_session.c:180:xccdf_session_new_from_source]
D: oscap: Validating SCAP Source Datastream (1.3) document from (null)/report-request.xml. [oscap(65560):oscap(7f858ce28940):oscap_source.c:360:oscap_source_validate]
OpenSCAP Error: File '(null)/report-request.xml' line 0: Element '{http://scap.nist.gov/schema/scap/source/1.2}component': This element is not expected. Expected is one of ( {http://scap.nist.gov/schema/scap/source/1.2}extended-component, {http://www.w3.org/2000/09/xmldsig#}Signature ).
 [/builddir/build/BUILD/openscap-1.3.12/src/XCCDF/xccdf_session.c:761]
Invalid SCAP Source Datastream (1.3) content in (null)/report-request.xml. [/builddir/build/BUILD/openscap-1.3.12/src/source/oscap_source.c:363]
Invalid SCAP Source Datastream (1.3) content in (null)/report-request.xml [/builddir/build/BUILD/openscap-1.3.12/src/XCCDF/xccdf_session.c:874]

By changing the tag from component to extended-component and changing comp to ecomp in the ID, it seems to work (at least it passes the validation)

$ diff stig.xml stig-fixed.xml
427085c427085
< <ds:component id="scap_org.open-scap_comp_--tmp--oscap.uk0u3--tailoring.xml_tailoring" timestamp="2025-09-29T16:20:33"><ns0:Tailoring xmlns:ns0="http://checklists.nist.gov/xccdf/1.2" id="xccdf_auto_tailoring_default">
---
> <ds:extended-component id="scap_org.open-scap_ecomp_--tmp--oscap.uk0u3--tailoring.xml_tailoring" timestamp="2025-09-29T16:20:33"><ns0:Tailoring xmlns:ns0="http://checklists.nist.gov/xccdf/1.2" id="xccdf_auto_tailoring_default">
427093c427093
< </ns0:Tailoring></ds:component></ds:data-stream-collection>
---
> </ns0:Tailoring></ds:extended-component></ds:data-stream-collection>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions