[Open-scap] Different results between oval and xccdf evaluation

[Raymond Mercier]

Hi all,

I have an xccdf file (I tried to simplify it to its maximum). See attached
file rm.xml.

When I execute the command "oscap xccdf eval --profile
xccdf_rabbitmq_profile_standard  rm.xml", I get a failed result.
[root]# oscap xccdf eval  --profile xccdf_rabbitmq_profile_standard  rm.xml
Title   1.3-s: TLS secure communication configuration
Rule    xccdf_rabbitmq_rule_13
Result  fail

When I execute the command " oscap oval eval   rm.xml", I get a success
result.
[root]# oscap oval eval   rm.xml
Definition oval:rabbit:def:13: true
Evaluation done.

The file "/etc/rabbitmq/rabbitmq.conf" used by the test contains 3 lines :
toto
tutu
tata

So, result should be "success". It seems result returned by oval is correct
but result returned by xccdf is wrong.

What is wrong ?

Thanks a lot for any help

Raymond Mercier
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/open-scap-list/attachments/20180528/7a9821c1/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rm.xml
Type: text/xml
Size: 6591 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/open-scap-list/attachments/20180528/7a9821c1/attachment.xml>