Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1476

blueprint generated with oscap polish

    • openscap-1.3.10-1.el9_4
    • None
    • Moderate
    • sst_security_compliance
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      Oscap fix generate blueprint generates blueprint with `[customizations.openscap]` section. The linked test case is IB test, manually (currently, there's waiver for such cases, do not check only pass/fail result!) check that it correctly generated blueprint, creates images and installs it.

      Show
      Oscap fix generate blueprint generates blueprint with ` [customizations.openscap] ` section. The linked test case is IB test, manually (currently, there's waiver for such cases, do not check only pass/fail result!) check that it correctly generated blueprint, creates images and installs it.
    • Pass
    • None
    • None

      Description of problem:
      When blueprint is generated, I see two places for improvement.

      First one is mostly just confusing - the comment when blueprint is generated states among other:

      ``

      1. This Blueprint is generated from an OpenSCAP profile without preliminary evaluation.
      2. It attempts to fix every selected rule, even if the system is already compliant.
        ``
        while technically correct,I don't thing there's any point in generating blueprints that is based on evaluation. Not having the comment there might actually be better.

      Second one is practical and impactful - Image Builder supports following directive to execute "post install" hardening.

      ``
      [customizations.openscap]
      datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml"
      profile_id = "xccdf_org.ssgproject.content_profile_cis"
      ``

      This is NOT part of the generated blueprint, which requires user to actually know about it and add it later. This is a bug in usability.

      Version-Release number of selected component (if applicable):
      openscap-1.3.7-1.el9.x86_64

      How reproducible:
      reliable

      Steps to Reproduce:
      1. oscap xccdf generate fix --fix-type blueprint --profile cis /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
      2. read the output
      3.

      Actual results:
      Comment from the description is present. Directive [customization.openscap] from description is NOT present.

      Expected results:
      Comment is not there. Directive is there. Ideally in a way that the output is directly usable without alteration in the image builder.

      Additional info:

            ekolesni Evgeny Kolesnikov
            mhaicman@redhat.com Marek Haicman
            Jan Cerny Jan Cerny
            Milan Lysonek Milan Lysonek
            Votes:
            0 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated:
              Resolved: