Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1476

blueprint generated with oscap polish

Details

    • Bug
    • Resolution: Unresolved
    • Normal
    • None
    • rhel-9.2.0
    • openscap
    • Assignee, Qa Contact, Doc Contact, Pool Team, Watchers, Developer
    • Normal
    • ssg_security
    • False
    • Hide

      None

      Show
      None
    • Unspecified
    • No Doc Update
    • Unspecified

    Description

      Description of problem:
      When blueprint is generated, I see two places for improvement.

      First one is mostly just confusing - the comment when blueprint is generated states among other:

      ``

      1. This Blueprint is generated from an OpenSCAP profile without preliminary evaluation.
      2. It attempts to fix every selected rule, even if the system is already compliant.
        ``
        while technically correct,I don't thing there's any point in generating blueprints that is based on evaluation. Not having the comment there might actually be better.

      Second one is practical and impactful - Image Builder supports following directive to execute "post install" hardening.

      ``
      [customizations.openscap]
      datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml"
      profile_id = "xccdf_org.ssgproject.content_profile_cis"
      ``

      This is NOT part of the generated blueprint, which requires user to actually know about it and add it later. This is a bug in usability.

      Version-Release number of selected component (if applicable):
      openscap-1.3.7-1.el9.x86_64

      How reproducible:
      reliable

      Steps to Reproduce:
      1. oscap xccdf generate fix --fix-type blueprint --profile cis /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
      2. read the output
      3.

      Actual results:
      Comment from the description is present. Directive [customization.openscap] from description is NOT present.

      Expected results:
      Comment is not there. Directive is there. Ideally in a way that the output is directly usable without alteration in the image builder.

      Additional info:

      Attachments

        Issue Links

          Activity

            People

              jcerny@redhat.com Jan Cerny
              mhaicman@redhat.com Marek Haicman
              Jan Cerny Jan Cerny
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated: