openscap icon indicating copy to clipboard operation
openscap copied to clipboard

HTML Report should show each skipped rule

Open maage opened this issue 2 years ago • 0 comments

Description of Feature request:

HTML Report should show each skipped rule.

This is from workflow, where there is a initial policy with list of enabled and disabled rules. Enabled meaning we want this and disabled meaning we do not want this. And then when running oscap xccdf eval skip any rules where there is some regression, for example:

  • running rule takes too long and I have other / better methods to handle the same intent
  • rule implementation does not work right
  • rule is right but distribution packages have regressions and there is no possibility to fix them
  • rule is right but there is no safe way to mitigate for now and distribution package needs new features And for those I use --skip-rule feature.

It would be nice to see what rules I have skipped.

For any regression style situation it would be better to have category "unrated". The rule is evaluated, but it is not rated in results if failed.

OpenSCAP Version:

openscap-scanner-1.3.6-5.fc36.x86_64

Operating System & Version:

Fedora 36

Steps to Reproduce:

  1. Run oscap xccdf eval ... --results-arf ssg-results-arf.xml --skip-rule xccdf_org.ssgproject.content_rule_rpm_verify_hashes ...
  2. Run oscap xccdf generate report --output ssg-results.html ssg-results-arf.xml

Actual Results:

At ssg-results-arf.xml there is:

          <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes"
role="full" time="..." severity="high" weight="1.000000">
            <result>notselected</result>
          </rule-result>

But there is nothing in ssg-results.html about xccdf_org.ssgproject.content_rule_rpm_verify_hashes.

Expected Results:

In HTML report these rules should be possible to see by enabling "notselected" tickbox at "Rule Overview" section, default off.

maage avatar Jun 18 '22 07:06 maage