ComplianceAsCode / ComplianceAsCode/content

Ubuntu 24.04 - Fail to produce a valid STIG Viewer XCCDF (.xml) report.

Open
#15,119 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
When evaluating an Ubuntu 24.04 LTS Docker container image using the Ubuntu 24.04 STIG V1R5 profile, the normal XCCDF results are generated correctly, but the OpenSCAP --stig-viewer output contains zero rule results.

The same evaluation produces 648 elements when using --results, while the file generated using --stig-viewer contains zero elements.

As a result, the generated STIG Viewer XML cannot be used successfully with DISA STIG Viewer 3.8.

I am reporting this to ComplianceAsCode to determine whether the generated Ubuntu 24.04 STIG V1R5 content contains the STIG reference/mapping metadata required by OpenSCAP's --stig-viewer transformation.

#### SCAP Security Guide Version:
SCAP Security Guide (SSG) 0.1.82

Profile:
Title: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R5 Id: xccdf_org.ssgproject.content_profile_stig

OpenSCAP version: 1.4.4

STIG Viewer version: 3.8

#### Operating System Version:
Ubuntu 24.04 LTS Docker container image

#### Steps to Reproduce:

1. Verify the Ubuntu 24.04 STIG profile:
oscap info /usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml
The profile is reported as:
Title: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R5
Id: xccdf_org.ssgproject.content_profile_stig

2. Evaluate an Ubuntu 24.04 Docker image and generate both normal XCCDF and STIG Viewer results from the same evaluation:oscap-docker image xccdf eval \
--profile xccdf_org.ssgproject.content_profile_stig \
--results normal-results.xml \
--stig-viewer stig-viewer-results.xml \
/usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml

3. Count the XCCDF results:
echo "Normal XCCDF results:"
grep -c '' normal-results.xml

echo "STIG Viewer results:"
grep -c '' stig-viewer-results.xml

echo "Normal rule-results:"
grep -c '

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported evaluation with the Ubuntu 24.04 data stream at /usr/share/xml/scap/ssg/ssg-ubuntu2404-ds.xml, using both --results and --stig-viewer outputs. Compare the outputs and inspect whether the data stream contains the STIG reference or mapping metadata expected by the transformation; the issue notes that an equivalent Ubuntu 22.04 scan works. Done means the STIG Viewer XML contains rule results and imports successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
ubuntu
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.