On Dec 12, 2013 3:37 AM, "Shawn Wells" <<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>> wrote: > > On 12/11/13, 4:34 PM, WARREN wrote: >> >> Hi, >> >> One of the useful facilities in openscap is to generate a "security guide" >> >> When I run: >> # oscap xccdf generate --profile Baseline guide --output \ >> BaselineGuide.html solaris-xccdf.xml >> >> the guide produced includes everything from the XCCDF file and not >> just for the "--profile" specified. I see a table at the end telling >> me what would be selected (or not) for the profile selected, but it >> seems to me that having everything in the guide is confusing, as the >> different profiles call different checks (obviously) and having them >> all there whether they are used or not seems like not the best idea. >> >> Is there some way to turn off this "feature"? perhaps by manipulating >> a style sheet? or should I call it a bug? > > > +1 > > It'd be incredibly useful to generate a true guide, versus a checklist, per profile. I don't think that is possible without changing the XCCDF schema. The content of a guide is provided by Group tags whereas the checks are Rule tags. Profiles are used to toggle Rules, not Groups, so openscap cannot know which Groups to include and which don't. At least, that is my feeble impression on the XCCDF standard. Might be wrong though. Wkr, Sven