You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: CMakeLists.txt
+2-2
Original file line number
Diff line number
Diff line change
@@ -337,7 +337,7 @@ cmake_dependent_option(ENABLE_OSCAP_UTIL_AS_RPM "enable the scap-as-rpm utility,
337
337
cmake_dependent_option(ENABLE_OSCAP_UTIL_SSH "enables the oscap-ssh utility, this lets you scan remote machines over ssh"ON"NOT WIN32"OFF)
338
338
cmake_dependent_option(ENABLE_OSCAP_UTIL_VM "enables the oscap-vm utility, this lets you scan VMs and VM storage images"ON"NOT WIN32"OFF)
339
339
cmake_dependent_option(ENABLE_OSCAP_UTIL_PODMAN "enables the oscap-podman utility, this lets you scan Podman containers and container images"ON"NOT WIN32"OFF)
340
-
cmake_dependent_option(ENABLE_OSCAP_UTIL_BOOTC"enables the oscap-bootc utility, this lets you build hardened bootable container images"ON"NOT WIN32"OFF)
340
+
cmake_dependent_option(ENABLE_OSCAP_UTIL_IM"enables the oscap-im utility, this lets you build hardened bootable container images"ON"NOT WIN32"OFF)
341
341
cmake_dependent_option(ENABLE_OSCAP_UTIL_CHROOT "enables the oscap-chroot utility, this lets you scan entire chroots using offline scanning"ON"NOT WIN32"OFF)
342
342
option(ENABLE_OSCAP_UTIL_AUTOTAILOR "enables the autotailor utility that is able to perform command-line tailoring"TRUE)
343
343
option(ENABLE_OSCAP_REMEDIATE_SERVICE "enables the oscap-remediate service"FALSE)
Note that the `oscap-podman` command requires root privileges.
2136
2136
2137
-
=== Building hardened bootable container images using oscap-bootc
2137
+
=== Building hardened bootable container images using oscap-im
2138
2138
2139
-
The `oscap-bootc` tool is a convenience script that makes building hardened bootable container images easier.
2139
+
The `oscap-im` tool is a convenience script that makes building hardened bootable container images easier.
2140
2140
This tool is designed to be used during the build of the bootable container image.
2141
2141
2142
-
Include `oscap-bootc` in your `Containerfile` that will be used to build your bootable container image.
2143
-
The `Containerfile` first needs to install the `openscap-utils` package which ships the `oscap-bootc` tool.
2142
+
Include `oscap-im` in your `Containerfile` that will be used to build your bootable container image.
2143
+
The `Containerfile` first needs to install the `openscap-utils` package which ships the `oscap-im` tool.
2144
2144
2145
-
Also, SCAP content needs to be installed to the image before `oscap-bootc` will be run.
2145
+
Also, SCAP content needs to be installed to the image before `oscap-im` will be run.
2146
2146
Although any SCAP content can be consumed by the tool, the SCAP source data streams shipped in `scap-security-guide` are specially cared to be compatible with bootable containers.
2147
2147
2148
2148
Example `Containerfile`:
@@ -2152,7 +2152,7 @@ FROM quay.io/centos-bootc/centos-bootc:stream9
2152
2152
2153
2153
RUN dnf install -y openscap-utils scap-security-guide
2154
2154
2155
-
RUN oscap-bootc --profile stig /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml
2155
+
RUN oscap-im --profile stig /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml
2156
2156
----
2157
2157
2158
2158
Once you have your `Containerfile`, execute the image build:
@@ -2161,15 +2161,15 @@ Once you have your `Containerfile`, execute the image build:
2161
2161
podman build -t hardened_image .
2162
2162
----
2163
2163
2164
-
The `oscap-bootc` tool installs and removes all packages required by the selected profile to or from the image.
2164
+
The `oscap-im` tool installs and removes all packages required by the selected profile to or from the image.
2165
2165
Then, it runs a scan and remediation with the selected profile.
2166
2166
It doesn't use offline scanning.
2167
2167
The configuration files and other content in the image are modified by this process, depending on the used SCAP content.
2168
2168
2169
2169
The built bootable container image can be then deployed and booted.
2170
2170
After booting the image, the state of the resulting system will be in line with the selected security profile.
2171
2171
2172
-
The `oscap-bootc` tool can't be used anywhere else than in a `Containerfile`.
2172
+
The `oscap-im` tool can't be used anywhere else than in a `Containerfile`.
2173
2173
2174
2174
=== Scanning of Docker containers and images using oscap-docker
0 commit comments