9.2. Customizing hardened bootable images

Prerequisites

• The container-tools meta-package is installed.
• You have a customization file for your profile. For more information, see Customizing a security profile with autotailor.

• Injects the tailoring file to your image.
• Installs the openscap-utils package that provides the oscap-im tool and the scap-security-guide package that provides the data streams with the Security Content Automation Protocol (SCAP) content.
• Adds a user with sudoer privileges for profiles that prevent SSH root logins.

• Scans and remediates the image for compliance with the selected profile.

  1. Build the image by using the Containerfile in the current directory:

     $ podman build -t quay.io/<namespace>/<image>:<tag> .

Verification

• List all images:

  $ podman images
  REPOSITORY                                  TAG      IMAGE ID       CREATED              SIZE
  quay.io/<namespace>/<image>                 <tag>   b28cd00741b3   About a minute ago   2.1 GB

Next steps

• You can deploy hardened bootable images by using any of the normal bootable image deployment methods. For more information, see Deploying the RHEL bootc images.

  The deployment method, however, can affect the compliance state of the target system.

  注意

  Some customizations performed during the deployment, in blueprint for bootc-image-builder or in Kickstart for Anaconda, can interfere with the configuration present in the container image. Do not use customizations that conflict with the security policy requirements.

• You can verify the compliance of a running system in Image Mode RHEL by using the oscap tool with the same syntax and usage as in package mode RHEL. For more information, see Configuration compliance scanning.