8.11. Scanning and Remediating Configuration Compliance of Container Images and Containers Using atomic scan
8.11.1. Scanning for Configuration Compliance of Container Images and Containers Using atomic scan
Use this type of scanning to evaluate Red Hat Enterprise Linux-based container images and containers with the SCAP content provided by the SCAP Security Guide (SSG) bundled inside the OpenSCAP container image. This enables scanning against any profile provided by the SCAP Security Guide.
Warning
The
atomic scan functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker utility for security compliance scanning purposes.
Note
For a detailed description of the usage of the
atomic command and containers, see the Product Documentation for Red Hat Enterprise Linux Atomic Host 7. The Red Hat Customer Portal also provides a guide to the atomic command-line interface (CLI).
Prerequisites
- You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the
atomic install rhel7/openscapcommand.
Procedure
- List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
~]#atomic help registry.access.redhat.com/rhel7/openscapVerify compliance of the latest Red Hat Enterprise Linux 7 container image with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) policy and generate an HTML report from the scan:~]#atomic scan--scan_typeconfiguration_compliance--scanner_argsxccdf-id=scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml,profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,reportregistry.access.redhat.com/rhel7:latestThe output of the previous command contains the information about files associated with the scan at the end:............ Files associated with this scan are in /var/lib/atomic/openscap/2017-11-03-13-35-34-296606.
~]#tree/var/lib/atomic/openscap/2017-11-03-13-35-34-296606 /var/lib/atomic/openscap/2017-11-03-13-35-34-296606 ├── db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2 │ ├── arf.xml │ ├── fix.sh │ ├── json │ └── report.html └── environment.json 1 directory, 5 filesTheatomic scangenerates a subdirectory with all the results and reports from a scan in the /var/lib/atomic/openscap/ directory. The arf.xml file with results is generated on every scanning for configuration compliance. To generate a human-readable HTML report file, add thereportsuboption to the--scanner_argsoption. - Optional: To generate XCCDF results readable by DISA STIG Viewer, add the
stig-viewersuboption to the--scanner_argsoption. The results are placed in stig.xml.
Note
When the
xccdf-id suboption of the --scanner_args option is omitted, the scanner searches for a profile in the first XCCDF component of the selected data stream file. For more details about data stream files, see Section 8.3.1, “Configuration Compliance in RHEL 7”.
8.11.2. Remediating Configuration Compliance of Container Images and Containers Using atomic scan
You can run the configuration compliance scan against the original container image to check its compliance with the DISA STIG policy. Based on the scan results, a fix script containing bash remediations for the failed scan results is generated. The fix script is then applied to the original container image - this is called a remediation. The remediation results in a container image with an altered configuration, which is added as a new layer on top of the original container image.
Important
Note that the original container image remains unchanged and only a new layer is created on top of it. The remediation process builds a new container image that contains all the configuration improvements. The content of this layer is defined by the security policy of scanning - in the previous case, the DISA STIG policy. This also means that the remediated container image is no longer signed by Red Hat, which is expected, because it differs from the original container image by containing the remediated layer.
Warning
The
atomic scan functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker utility for security compliance scanning purposes.
Prerequisites
- You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the
atomic install rhel7/openscapcommand.
Procedure
- List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
~]#atomic help registry.access.redhat.com/rhel7/openscap - To remediate container images to the specified policy, add the
--remediateoption to theatomic scancommand when scanning for configuration compliance. The following command builds a new remediated container image compliant with the DISA STIG policy from the Red Hat Enterprise Linux 7 container image:~]#atomic scan--remediate--scan_typeconfiguration_compliance--scanner_argsprofile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,reportregistry.access.redhat.com/rhel7:latest registry.access.redhat.com/rhel7:latest (db7a70a0414e589) The following issues were found: ............ Configure Time Service Maxpoll Interval Severity: Low XCCDF result: fail Configure LDAP Client to Use TLS For All Transactions Severity: Moderate XCCDF result: fail ............ Remediating rule 43/44: 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll' Remediating rule 44/44: 'xccdf_org.ssgproject.content_rule_ldap_client_start_tls' Successfully built 9bbc7083760e Successfully built remediated image 9bbc7083760e from db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2. Files associated with this scan are in /var/lib/atomic/openscap/2017-11-06-13-01-42-785000. - Optional: The output of the
atomic scancommand reports a remediated image ID. To make the image easier to remember, tag it with some name, for example:~]#dockertag9bbc7083760e rhel7_disa_stig
