Why are so many OpenSCAP tests reporting "notapplicable" on Ubuntu 22?

[pfuntner]

My team is working on STIG hardening tools for Ubuntu 22 and we're using OpenSCAP to audit a system after hardening. We're seeing many tests result in notapplicable and don't understand why. Here's an example:

The remediation was performed on the AWS Ubuntu 22 target:

# grep -w action_mail_acct /etc/audit/auditd.conf
action_mail_acct = root
#

and I was expecting this test to result in a pass.

I ran with --verbose INFO and got this information:

Title^M Configure auditd mail_acct Action on Low Disk Space
Rule^M  xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
I: oscap: Evaluating definition 'oval:ssg-installed_OS_is_ubuntu2204:def:1': Ubuntu 22.04 LTS.
I: oscap: Definition 'oval:ssg-installed_OS_is_ubuntu2204:def:1' evaluated as true.
I: oscap: Evaluating definition 'oval:ssg-system_with_kernel:def:1': (null).
I: oscap: Definition 'oval:ssg-system_with_kernel:def:1' evaluated as false.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct' is not applicable.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs'.
I: oscap: Rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs' is not selected.
I: oscap: Evaluating XCCDF rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action'.
Result^M        notapplicable

I don't understand what's going on with the ssg-system_with_kernel definition. I tried to track it down in scap-security-guide-0.1.75/ssg-ubuntu2204-ds.xml and believe this is key:

        <linux:dpkginfo_object id="oval:ssg-obj_inventory_test_kernel_installed:obj:1" version="1">
          <linux:name>kernel</linux:name>
        </linux:dpkginfo_object>

So it's looking for an apt package named kernel? What is that??

I noticed this tag in ubuntu2204-ds.xml:

        <cpe-lang:platform id="system_with_kernel">
          <cpe-lang:logical-test operator="AND" negate="false">
            <cpe-lang:check-fact-ref system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-ubuntu2204-cpe-oval.xml" id-ref="oval:ssg-system_with_kernel:def:1"/>
          </cpe-lang:logical-test>
        </cpe-lang:platform>

when I change negate="false" to negate="true" and there are far fewer notapplicable tests.

How do I run these tests properly without changing the xccdf file?

[dodys]

is that environment a VM or a container?

[pfuntner]

VM: AWS EC2 cloud instance

[mpurg]

I'm unable to reproduce this on a clean installation of Ubuntu Desktop 22.04 in KVM.
The only notapplicable rules in my setup are:

• Set the UEFI Boot Loader Password (not using uefi)
• Configure SSSD to Expire Offline Credentials (sssd not installed)

Can you please provide more information about your setup and exact steps for reproducing?

[pfuntner]

It's an AWS EC2 cloud instance. I believe I used ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-20241120 to create the instance.

I built a new ssg-ubuntu2204-ds.xml and will try it out.

[mpurg]

Hi @pfuntner . I could reproduce the issue using the latest release 0.1.75.
The master branch already has the fix: #12585

[pfuntner]

Thanks for the information. I have built a new ssg-ubuntu2204-ds.xml and will try it out.

[pfuntner]

I went from 153 tests not applicable to only 8! 🎉