Hello,
I had brought this up on the mailing list sometime ago. This is a report of my observations with some more experiments.
For calculating the compliance score, oscap calls "xccdf_policy_get_score" in the function "xccdf_session_evaluate".
When running "oscap xccdf evaluate" with the "--remediate" option, the report file mentions all fixed rules as passed but the compliance score is from before running remediation, i.e. based on the initial evaluation. So even if the number of rules that pass increases, compliance score does not change. When an evaluation is run again, the number of rules that passes remains the same as with the previous report but compliance score is now updated.
This behavior is the same when running "oscap xccdf remediate". The report of this operation still the mentions the same score from evaluation result passed as input to it.
From what I understand, the problem is that oscap doesn't update the score in "xccdf_session_remediate".
The functions which calculates score like xccdf_item_get_default_score() are capable for reporting the score even for "fixed" rules:
if ((xccdf_rule_result_get_result(rule_result) == XCCDF_RESULT_PASS) || (xccdf_rule_result_get_result(rule_result) == XCCDF_RESULT_FIXED)) {
Its just that it doesn't get invoked after remediation.
I notice that there is a convenient function called "xccdf_result_recalculate_scores" which currently doesn't seem to be used anywhere. By invoking this function after the remediation, I am able to get the correct compliance score in the reports. I have tested this with both "oscap xccdf eval --remediate" and "oscap xccdf remediate".
I am not sure if this was one of the intended uses of "xccdf_result_recalculate_scores" but it appears to be doing the job. If this seems acceptable, I can submit a patch for review.
Thank you!
-Gautam.
Hello,
I had brought this up on the mailing list sometime ago. This is a report of my observations with some more experiments.
For calculating the compliance score, oscap calls "xccdf_policy_get_score" in the function "xccdf_session_evaluate".
When running "oscap xccdf evaluate" with the "--remediate" option, the report file mentions all fixed rules as passed but the compliance score is from before running remediation, i.e. based on the initial evaluation. So even if the number of rules that pass increases, compliance score does not change. When an evaluation is run again, the number of rules that passes remains the same as with the previous report but compliance score is now updated.
This behavior is the same when running "oscap xccdf remediate". The report of this operation still the mentions the same score from evaluation result passed as input to it.
From what I understand, the problem is that oscap doesn't update the score in "xccdf_session_remediate".
The functions which calculates score like xccdf_item_get_default_score() are capable for reporting the score even for "fixed" rules:
if ((xccdf_rule_result_get_result(rule_result) == XCCDF_RESULT_PASS) || (xccdf_rule_result_get_result(rule_result) == XCCDF_RESULT_FIXED)) {Its just that it doesn't get invoked after remediation.
I notice that there is a convenient function called "xccdf_result_recalculate_scores" which currently doesn't seem to be used anywhere. By invoking this function after the remediation, I am able to get the correct compliance score in the reports. I have tested this with both "oscap xccdf eval --remediate" and "oscap xccdf remediate".
I am not sure if this was one of the intended uses of "xccdf_result_recalculate_scores" but it appears to be doing the job. If this seems acceptable, I can submit a patch for review.
Thank you!
-Gautam.