Chapter 7. Creating pre-hardened images with RHEL image builder OpenSCAP integration

For the traditional image creation using a Kickstart file, you have to choose which packages you must install and ensure that the system is not affected by a vulnerability. With the RHEL image builder OpenSCAP integration, you can build security hardened images. During the image build process an OSBuild oscap.remediation stage runs the OpenSCAP tool in the chroot, on the filesystem tree. The OpenSCAP tool runs the standard evaluation for the profile you choose and applies the remediations to the image. With this, you can build an image that would be configured according to the security profile requirements even before it boots for the first time.

Install the OpenSCAP tool to have access to SCAP tools to help you to create standard security checklists for your systems.

With the OpenSCAP support for blueprint customization, you can generate blueprints from scap-security-guide content for specific security profiles and then use them to build your own pre-hardened images. To create a customized pre-hardened image you can modify the mount points and configure the file system layout according to your specific requirements. After you select the OpenSCAP profile, the OpenSCAP blueprint configures the image to trigger the remediation during the image build in accordance with the selected profile. During the image build, OpenSCAP applies a pre-first-boot remediation.

To use the OpenSCAP blueprint customization in your image blueprints, you need to provide the following information:

For your convenience the OpenSCAP tool can generate the hardening blueprint for any profile available in scap-security-guide data streams.

For example, the command

# oscap xccdf generate fix --profile=cis --fix-type=blueprint /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

will generate a blueprint for CIS profile similar to

# Blueprint for CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
#
# Profile Description:
# This profile defines a baseline that aligns to the "Level 2 - Server"
# configuration from the Center for Internet Security® Red Hat Enterprise
# Linux 9 Benchmark™, v3.0.0, released 2023-10-30.
# This profile includes Center for Internet Security®
# Red Hat Enterprise Linux 9 CIS Benchmarks™ content.
#
# Profile ID:  xccdf_org.ssgproject.content_profile_cis
# Benchmark ID:  xccdf_org.ssgproject.content_benchmark_RHEL-9
# Benchmark Version:  0.1.74
# XCCDF Version:  1.2

name = "hardened_xccdf_org.ssgproject.content_profile_cis"
description = "CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server"
version = "0.1.74"

[customizations.openscap]
profile_id = "xccdf_org.ssgproject.content_profile_cis"
# If your hardening data stream is not part of the 'scap-security-guide' package
# provide the absolute path to it (from the root of the image filesystem).
# datastream = "/usr/share/xml/scap/ssg/content/ssg-xxxxx-ds.xml"

[[customizations.filesystem]]
mountpoint = "/home"
size = 1073741824

[[customizations.filesystem]]
mountpoint = "/tmp"
size = 1073741824

[[customizations.filesystem]]
mountpoint = "/var"
size = 3221225472

[[customizations.filesystem]]
mountpoint = "/var/tmp"
size = 1073741824

[[packages]]
name = "aide"
version = "*"

[[packages]]
name = "libselinux"
version = "*"

[[packages]]
name = "audit"
version = "*"

[customizations.kernel]
append = "audit_backlog_limit=8192 audit=1"

[customizations.services]
enabled = ["auditd","crond","firewalld","systemd-journald","rsyslog"]
disabled = []
masked = ["nfs-server","rpcbind","autofs","bluetooth","nftables"]

Now you can customize the blueprint or use it as it is to build an image.

RHEL image builder generates the necessary configurations for the osbuild stage based on your blueprint customization. Additionally, RHEL image builder adds two packages to the image:

With the OpenSCAP and RHEL image builder integration, you can create pre-hardened images that you can deploy in a VM.

With the OpenSCAP and RHEL image builder integration, you can add customized tailoring options for a profile to the blueprint customizations by using the following options:

With the default org.ssgproject.content rule namespace, you can omit the prefix for rules under this namespace. For example, org.ssgproject.content_grub2_password and grub2_password are functionally equivalent.

When you build an image from that blueprint, it creates a tailoring file with a new tailoring profile ID and saves it to the image as /usr/share/xml/osbuild-oscap-tailoring/tailoring.xml. The new profile ID will have _osbuild_tailoring appended as a suffix to the base profile. For example, if you use the CIS (cis) base profile, the profile ID will be xccdf_org.ssgproject.content_profile_cis_osbuild_tailoring.