Tailoring files

[Yesser-Belhajali]

Hello everyone.

I have a question concerning tailoring in the openscap environment.

I have been reading about tailoring and figured out that a tailoring file is just an XML file that references an existing XCCDF/DS file to get the implementation of the real rules, and it has profiles that can extend (or not) an existing profile. To do so I need to work with the xccdf_tailoring structure, but my questions are:

1. Is it possible for a tailoring profile to extend another tailoring profile? For example, let's suppose I have a tailoring file in which I created Profile A that extends CIS_Level_1_Server. Is it possible for me to create, inside that same tailoring file, Profile B that extends Profile A, so we would have a chain like CIS_Level_1_Server -> Profile A -> Profile B? Or does extends only work with profiles that exist natively inside the benchmark?

2. In the case it can handle that inheritance chain,How can/should I handle resolving that? ,does the xccdf_session structure handle resolving it automatically, or should I try to solve it on my own through lower-level structures like oscap_source / ds_sds_session?

Thanks in advance for any clarification.

[Mab879]

OpenSCAP usually follows the SCAP standard for things like this.

1. Based on Table 29 (PDF page 53) in XCCDF 1.2 spec [1], might be possible
2. I would try with xccdf_session session first.

[1] https://csrc.nist.gov/files/pubs/ir/7275/r4/upd1/final/docs/nistir-7275r4_updated-march-2012_clean.pdf