Creating and persisting a custom XCCDF Profile from scratch via libopenscap's C API

[Yesser-Belhajali]

Hello everyone,

I'm working with libopenscap's C API directly (not the autotailor/oscap CLI tools) to let users build a custom profile programmatically in my application.

I already wrote my own function to traverse a Benchmark and collect all its Rule items, since I couldn't find a built-in getter that returns the full rule list directly — happy to know if I missed one.

What I'm trying to figure out is the correct API-level workflow to:

1. Build a brand-new xccdf_profile from scratch (i.e. without extends, not derived from an existing profile like CIS or DISA STIG)
2. Attach xccdf_select entries for an arbitrary list of rule IDs chosen by the user (not limited to rules already belonging to a specific pre-existing profile)
3. Serialize this new Profile back to XML via the API (either as a standalone Profile or wrapped in a Tailoring document), so it can be persisted and later reloaded, still referencing the same Benchmark/DataStream it came from — this matters for auditing purposes

So my questions are:

• Does libopenscap's API expose functions to construct an xccdf_profile in memory from scratch and attach selects to it (something like xccdf_profile_new() / xccdf_select_new(), or an equivalent)? If so, could someone point me to the relevant header/functions?
• What's the correct way to export/serialize a Profile (or a Tailoring document wrapping it) built this way back to XML via the API, rather than going through the CLI tools?
• Is there a public getter for enumerating all Rules of a Benchmark that I missed, or is writing a custom traversal function (like I did) the expected/standard approach when using the API directly?

For context: I'm using the SCAP Security Guide content as my SCAP source, and my end goal is to let users pick freely from all rules of a benchmark (not just those already in one specific named profile), then save the resulting custom profile for reuse and auditing.

Thanks in advance!

[yudin-s]

Yes, the C API has the pieces for this. The workflow I would use is to persist a Tailoring document, not to write only a detached <Profile> fragment. That keeps the custom profile auditable while still referencing the original Benchmark/DataStream.

The relevant public API names are in src/XCCDF/public/xccdf_benchmark.h:

• xccdf_profile_new() / xccdf_profile_set_id() to create the profile
• xccdf_select_new() / xccdf_select_set_item() / xccdf_select_set_selected() to create each rule selection
• xccdf_profile_add_select() to attach selections to the profile
• xccdf_tailoring_new() / xccdf_tailoring_set_id() / xccdf_tailoring_set_benchmark_ref() / xccdf_tailoring_add_profile()
• xccdf_tailoring_export() to write the tailoring XML

A minimal shape is roughly:

struct xccdf_tailoring *tailoring = xccdf_tailoring_new();
xccdf_tailoring_set_id(tailoring, "xccdf_org.example_tailoring_custom");
xccdf_tailoring_set_benchmark_ref(tailoring, benchmark_href_or_id);

struct xccdf_profile *profile = xccdf_profile_new();
xccdf_profile_set_id(profile, "xccdf_org.example_profile_custom");
xccdf_profile_set_tailoring(profile, true);

for (each selected_rule_id) {
    struct xccdf_select *sel = xccdf_select_new();
    xccdf_select_set_item(sel, selected_rule_id);
    xccdf_select_set_selected(sel, true);
    xccdf_profile_add_select(profile, sel);
}

xccdf_tailoring_add_profile(tailoring, profile);
xccdf_tailoring_export(
    tailoring,
    "custom-tailoring.xml",
    xccdf_benchmark_get_schema_version(benchmark)
);

You do not need the custom profile to extends an existing CIS/STIG profile if your intent is a standalone selection set. In that case, just omit xccdf_profile_set_extends(). The profile selects arbitrary rule IDs from the referenced benchmark; it does not have to be limited to rules that were selected by some existing profile.

For rule enumeration, I do not think there is a single "return all rules recursively" getter. The public API exposes tree traversal primitives: start with xccdf_benchmark_get_content(), recurse into group content via xccdf_item_get_content() / xccdf_group_get_content(), and filter items whose type is XCCDF_RULE or cast with xccdf_item_to_rule(). If you already wrote recursive traversal, that is the expected API-level approach. If you only need to validate one chosen ID, xccdf_benchmark_get_item(benchmark, id) is useful.

For persistence/reload, keep the tailoring file next to the original content and evaluate with the original benchmark plus the tailoring file/profile. That matches OpenSCAP’s own tailoring tests: the tailoring XML carries the customized profile, while the rule definitions remain in the benchmark/data stream.

If this matches your use case, please mark it as answered so other libopenscap users can find the profile/select/tailoring API path.

[Yesser-Belhajali]

@yudin-s Thank you very much,your explanation helped a lot and clarified lots of ambiguities you are truely a life saver