8.3. Customizing a pre-hardened image with RHEL image builder

Procedure

1. Create a hardening blueprint in the TOML format from a selected profile. For example:

   # oscap xccdf generate fix --profile=<profileID> --fix-type=blueprint /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml > <profileID>tailored.toml

2. Append the tailoring section with the customized rule set to the blueprint. Note that the tailoring customization will only affect the default selected or unselected state of the rules in the profile on which the customization is based, by selecting or deselecting a rule, without changing the state of other rules.

   # Blueprint for CIS Red Hat Enterprise Linux 10.0 Benchmark for Level 2 - Server
   # ...
   [customizations.openscap.tailoring]
   selected = [ "xccdf_org.ssgproject.content_bind_crypto_policy" ]
   unselected = [ "grub2_password" ]

3. Start the build of a hardened image:

   # *image-builder build <image_type> --blueprint <blueprintProfileID> *

   Replace <image_type> with any image type, for example, qcow2.

   After the image build is ready, use your pre-hardened image on your deployments.