oscap

package: openscap-scanner

title: oscap(8)

summary: OpenSCAP command line tool

text:
# oscap(8)

## NAME
oscap - OpenSCAP command line tool

## SYNOPSIS
oscap [general-options] module operation [operation-options-and-arguments]

## DESCRIPTION
oscap is Security Content Automation Protocol (SCAP) toolkit based on OpenSCAP library. It provides various functions for different SCAP specifications (modules).

OpenSCAP tool claims to provide capabilities of Authenticated Configuration Scanner and Authenticated Vulnerability Scanner as defined by The National Institute of Standards and Technology.

## GENERAL OPTIONS
-V, --version

Print supported SCAP specifications, location of schema files, schematron files, CPE files, probes and supported OVAL objects. Displays a list of inbuilt CPE names.

-h, --help

Help screen.

## MODULES
info

Determine type and print information about a file.

xccdf

The eXtensible Configuration Checklist Description Format.

oval

Open Vulnerability and Assessment Language.

ds

SCAP Data Stream

cpe

Common Platform Enumeration.

## COMMON OPTIONS FOR ALL MODULES
--verbose VERBOSITY_LEVEL

Turn on verbose mode at specified verbosity level. VERBOSITY_LEVEL is one of: DEVEL, INFO, WARNING, ERROR.

--verbose-log-file FILE

Set filename to write additional information.

## INFO OPERATIONS
[options] any-scap-file.xml

This module prints information about SCAP content in a file specified on a command line. It determines SCAP content type, specification version, date of creation, date of import and so on. Info module doesn't require any additional operation switch. For XCCDF or SCAP source data stream files, the info module prints out IDs of incorporated profiles, components, and data streams. These IDs can be used to specify the target for evaluation. Use options --profile, --xccdf-id (or --oval-id), and --datastream-id respectively.

--fetch-remote-resources

Allow download of remote components referenced from data stream.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. This option works only with SCAP 1.3 source data streams. It can't be used with SCAP 1.2 source data streams.

--profile PROFILE

Show info of the profile with the given ID.

--profiles

Show profiles from the input file in the <id>:<title> format, one line per profile.

--references

Show list of references available in each benchmark.

## XCCDF OPERATIONS
eval [options] INPUT_FILE [oval-definitions-files]

Perform evaluation of XCCDF document file given as INPUT_FILE. Print result of each rule to standard output, including rule title, rule id and security identifier(CCE). Optionally you can give an SCAP source data stream as the INPUT_FILE instead of an XCCDF file (see --datastream-id). oscap returns 0 if all rules pass. If there is an error during evaluation, the return code is 1. If there is at least one rule with either fail or unknown result, oscap finishes with return code 2.

Unless --skip-validation is used, the INPUT_FILE is validated using XSD schemas (depending on document type of INPUT_FILE) and rejected if invalid.

You may specify OVAL Definition files as the last parameter, XCCDF evaluation will then proceed only with those specified files. Otherwise, when oval-definitions-files parameter is missing, oscap tool will try to load all OVAL Definition files referenced from XCCDF automatically (search in the same path as XCCDF).

--profile PROFILE

Select a particular profile from XCCDF document. If "(all)" is given a virtual profile that selects all groups and rules will be used.

--rule RULE

Select a particular rule from XCCDF document. Only this rule will be evaluated. Any other rules required by this rule won't be evaluated. Rule will use values according to the selected profile. If no profile is selected, default values are used. This option can be used multiple times to specify multiple rules at once.

--skip-rule RULE

Skip a particular rule from XCCDF document. This option can be used multiple times to skip multiple rules at once.

--reference NAME:IDENTIFIER

Evaluate rules matching the given reference. This option can be used to check for evaluating compliance with a particular policy requirement. Rules that match the reference will be evaluated, other rules will be skipped and a result of notselected will be returned. The argument needs to be provided in the form NAME:IDENTIFIER (colon is a separator), where NAME is the reference name used as a text of xccdf:reference elements that are child of xccdf:Benchmark element and IDENTIFIER is a text of xccdf:reference element that is child of a particular xccdf:Rule element which has the same @href value as the xccdf:reference element of the NAME value. This feature requires SCAP content to be formed in the aforementioned way. For example: --reference "cis:4.1.3.19", --reference "anssi:BP28(R29)" List of references available in the given benchmark can be obtained by running the oscap info --references command.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks. (Some CPE names are provided by openscap, see oscap --version for inbuilt CPE names)

--results FILE

Write XCCDF results into FILE.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format. It is recommended to use this option instead of --results when dealing with data streams.

--stig-viewer FILE

Writes XCCDF results into FILE. The rule result IDs in FILE are modified according to STIG references in evaluated content. The FILE can be simply imported into DISA STIG Viewer. See https://public.cyber.mil/stigs/srg-stig-tools/ for information about DISA STIG Viewer.

--thin-results

Thin Results provides only minimal amount of information in OVAL/ARF results. The option --without-syschar is automatically enabled when you use Thin Results.

--without-syschar

Don't provide system characteristics in OVAL/ARF result files.

--report FILE

Write HTML report into FILE.

--oval-results

Generate OVAL Result file for each OVAL session used for evaluation. File with name 'original-oval-definitions-filename.result.xml' will be generated for each referenced OVAL file in current working directory. To change the directory where OVAL files are generated change the CWD using the `cd` command.

--check-engine-results

After evaluation is finished, each loaded check engine plugin is asked to export its results. The export itself is plugin specific, please refer to documentation of the plugin for more details.

--export-variables

Generate OVAL Variables documents which contain external variables' values that were provided to the OVAL checking engine during evaluation. The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give source data stream in place of an XCCDF file.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly. Please note that this is not the recommended way of selecting a component-ref. You are advised to use --xccdf-id AND/OR --datastream-id for more precision. --benchmark-id is only used when both --xccdf-id and --datastream-id are not present on the command line!

--skip-validation

Do not validate input/output files.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. This option works only with SCAP 1.3 source data streams. It can't be used with SCAP 1.2 source data streams.

--remediate

Execute XCCDF remediation in the process of XCCDF evaluation. This option automatically executes content of XCCDF fix elements for failed rules, and thus this shall be avoided unless for trusted content. Use of this option is always at your own risk.

--show-rule-details

Show rule description and rationale when reporting results.

remediate [options] INPUT_FILE [oval-definitions-files]

This module provides post-scan remediation. It assumes that the INPUT_FILE is result of `oscap xccdf eval` operation. The input file must contain TestResult element. This module executes XCCDF fix elements for failed rule-result contained in the given TestResult. Use of this option is always at your own risk and it shall be avoided unless for trusted content. --result-id ID

ID of the XCCDF TestResult element which shall be remedied. If this option is missing the last TestResult (in top-down processing) will be remedied.

--skip-validation

Do not validate input/output files.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. This option works only with SCAP 1.3 source data streams. It can't be used with SCAP 1.2 source data streams.

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks.

--results FILE

Write XCCDF results into FILE.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format. It is recommended to use this option instead of --results when dealing with data streams.

--stig-viewer FILE

Writes XCCDF results into FILE. The rule result IDs in FILE are modified according to STIG references in evaluated content. The FILE can be simply imported into DISA STIG Viewer. See https://public.cyber.mil/stigs/srg-stig-tools/ for information about DISA STIG Viewer.

--report FILE

Write HTML report into FILE.

--oval-results

Generate OVAL Result file for each OVAL session used for evaluation. File with name 'original-oval-definitions-filename.result.xml' will be generated for each referenced OVAL file.

--check-engine-results

After evaluation is finished, each loaded check engine plugin is asked to export its results. The export itself is plugin specific, please refer to documentation of the plugin for more details.

--export-variables

Generate OVAL Variables documents which contain external variables' values that were provided to the OVAL checking engine during evaluation. The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'.

--progress

Switch to sparse output suitable for progress reporting. Format of the output is "$rule_id:$result\n".

--progress-full

Switch to sparse but a bit more saturated output also suitable for progress reporting. Format of the output is "$rule_id|$rule_title|$result\n".

resolve -o output-file xccdf-file

Resolve an XCCDF file as described in the XCCDF specification. It will flatten inheritance hierarchy of XCCDF profiles, groups, rules, and values. Result is another XCCDF document, which will be written to output-file. --force

Force resolving XCCDF document even if it is already marked as resolved.

validate [options] xccdf-file

Validate given XCCDF file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the XCCDF document is not valid. --skip-schematron

Turn off Schematron-based validation. It is able to find more errors and inconsistencies but is much slower. Schematron is available only for XCCDF version 1.2.

export-oval-variables [options] xccdf-file [oval-definitions-files]

Collect all the XCCDF values that would be used by OVAL during evaluation of a certain profile and export them as OVAL external-variables document(s). The filename format is 'original-oval-definitions-filename-session-index.variables-variables-index.xml'. --profile PROFILE

Select a particular profile from XCCDF document.

--fetch-remote-resources

Allow download of remote OVAL content referenced from XCCDF by check-content-ref/@href.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. This option works only with SCAP 1.3 source data streams. It can't be used with SCAP 1.2 source data streams.

--skip-validation

Do not validate input/output files.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give an SCAP source data stream in place of an XCCDF file.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are 2 XCCDFs in one data stream.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly. Please note that this is not the recommended way of selecting a component-ref. You are advised to use --xccdf-id AND/OR --datastream-id for more precision. --benchmark-id is only used when both --xccdf-id and --datastream-id are not present on the command line!

--cpe CPE_FILE

Use given CPE dictionary or language (auto-detected) for applicability checks. The variables documents are created only for xccdf:Rules which are applicable.

generate [options] <submodule> [submodule-specific-options]

Generate another document from an XCCDF file such as security guide or result report. --profile ID

Apply profile with given ID to the Benchmark before further processing takes place.

Available submodules:

guide [options] xccdf-file

Generate a HTML document containing a security guide from an XCCDF Benchmark. Unless the --output option is specified it will be written to the standard output. Without profile being set only groups (not rules) will be included in the output. --output FILE

Write the guide to this file instead of standard output.

--hide-profile-info

This option has no effect and is kept only for backward compatibility purposes.

--benchmark-id ID

Selects a component ref from any datastream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

report [options] xccdf-file

Generate a HTML document containing results of an XCCDF Benchmark execution. Unless the --output option is specified it will be written to the standard output. --output FILE

Write the report to this file instead of standard output.

--result-id ID

ID of the XCCDF TestResult from which the report will be generated.

fix [options] xccdf-file

Generate a script that shall bring the system to a state of compliance with given XCCDF Benchmark. There are 2 possibilities when generating fixes: Result-oriented fixes (--result-id) or Profile-oriented fixes (--profile). Result-oriented takes precedences over Profile-oriented, if result-id is given, oscap will ignore any profile provided. Result-oriented fixes are generated using result-id provided to select only the failing rules from results in xccdf-file, it skips all other rules.

It isn't possible to generate result-oriented fixes for the kickstart and bootc fix type.

Profile-oriented fixes are generated using all rules within the provided profile. If no result-id/profile are provided, (default) profile will be used to generate fixes.

--fix-type TYPE

Specify fix type. There are multiple programming languages in which the fix script can be generated. TYPE should be one of: bash, ansible, puppet, anaconda, ignition, kubernetes, blueprint, kickstart, bootc. Default is bash.

--output FILE

Write the report to this file instead of standard output.

--result-id ID

Fixes will be generated for failed rule-results of the specified TestResult.

--xccdf-id ID

Takes component ref with given ID from checklists. This allows one to select a particular XCCDF component even in cases where there are multiple XCCDFs in a single data stream. If none is given, the first component from the checklists element is used.

--benchmark-id ID

Selects a component ref from any data stream that references a component with XCCDF Benchmark such that its @id attribute matches given string exactly.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--skip-signature-validation

Do not validate digital signatures in digitally signed SCAP source data streams.

--enforce-signature

Process only digitally signed SCAP source data streams. Data streams without a signature would be rejected if this switch is used.

custom --stylesheet xslt-file [options] xccdf-file

Generate a custom output (depending on given XSLT file) from an XCCDF file. --stylesheet FILE

Specify an absolute path to a custom stylesheet to format the output.

--output FILE

Write the document into file.

## OVAL OPERATIONS
eval [options] INPUT_FILE

Probe the system and evaluate all definitions from OVAL Definition file. Print result of each definition to standard output. The return code is 0 after a successful evaluation. On error, value 1 is returned. INPUT_FILE can be either OVAL Definition File or SCAP source data stream, it depends on used options.

Unless --skip-validation is used, the INPUT_FILE is validated using XSD schemas (depending on document type of INPUT_FILE) and rejected if invalid.

--id DEFINITION-ID

Evaluate ONLY specified OVAL Definition from OVAL Definition File.

--variables FILE

Provide external variables expected by OVAL Definition File.

--directives FILE

Use OVAL Directives content to specify desired results content.

--without-syschar

Don't provide system characteristics in result file.

--results FILE

Write OVAL Results into file.

--report FILE

Create human readable (HTML) report from OVAL Results.

--datastream-id ID

Uses a data stream with that particular ID from the given data stream collection. If not given the first data stream is used. Only applies if you give source data stream in place of an OVAL file.

--oval-id ID

Takes component ref with given ID from checks. This allows one to select a particular OVAL component even in cases where there are multiple OVALs in a single data stream.

--skip-validation

Do not validate input/output files.

--fetch-remote-resources

Allow download of remote components referenced from data stream.

--local-files DIRECTORY

Instead of downloading remote data stream components from the network, use data stream components stored locally as files in the given directory. In place of the remote data stream component OpenSCAP will attempt to use a file whose file name is equal to @name attribute of the uri element within the catalog element within the component-ref element in the data stream if such file exists. This option works only with SCAP 1.3 source data streams. It can't be used with SCAP 1.2 source data streams.

collect [options] definitions-file

Probe the system and gather system characteristics for all objects in OVAL Definition file. --id OBJECT-ID

Collect system characteristics ONLY for specified OVAL Object.

--variables FILE

Provide external variables expected by OVAL Definitions.

--syschar FILE

Write OVAL System Characteristic into file.

--skip-validation

Do not validate input/output files.

analyse [options] --results FILE definitions-file syschar-file

In this mode, the oscap tool does not perform data collection on the local system, but relies upon the input file, which may have been generated on another system. The output (OVAL Results) is printed to file specified by --results parameter. --variables FILE

Provide external variables expected by OVAL Definitions.

--directives FILE

Use OVAL Directives content to specify desired results content.

--skip-validation

Do not validate input/output files.

validate [options] oval-file

Validate given OVAL file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the OVAL document is not valid. --definitions, --variables, --syschar, --results --directives

Type of the OVAL document is automatically detected by default. If you want enforce certain document type, you can use one of these options.

--skip-schematron

Turn off Schematron-based validation. It is able to find more errors and inconsistencies but is much slower.

generate <submodule> [submodule-specific-options]

Generate another document from an OVAL file. Available submodules:

report [options] oval-results-file

Generate a formatted HTML page containing visualisation of an OVAL results file. Unless the --output option is specified it will be written to the standard output. --output FILE

Write the report to this file instead of standard output.

## CPE OPERATIONS
check name

Check whether name is in correct CPE format.

match name dictionary.xml

Find an exact match of CPE name in the dictionary.

validate cpe-dict-file

Validate given CPE dictionary file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the XCCDF document is not valid.

## DS OPERATIONS
sds-validate SOURCE_DS

Validate given source data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the source data stream is not valid.

rds-validate SOURCE_RDS

Validate given result data stream file against a XML schema. Every found error is printed to the standard error. Return code is 0 if validation succeeds, 1 if validation could not be performed due to some error, 2 if the result data stream is not valid.

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
Make sure you include the full output of `oscap --v` in the bug report.
```

## AUTHORS

```
Peter Vrabec <pvrabec@redhat.com>
Šimon Lukašík
Martin Preisler <mpreisle@redhat.com>
```


autotailor

package: openscap-utils

title: autotailor(8)

text:
# autotailor(8)

## NAME
autotailor - CLI tool for tailoring of SCAP data streams.

## DESCRIPTION
The autotailor tool produces tailoring files that SCAP-compliant scanners can use to complement SCAP data streams. A tailoring file adds a new profile, which is supposed to extend a profile that is already present in the data stream.

Tailoring can add, remove or refine rules, and it also can redefine contents of XCCDF variables.

The tool requires data stream location and ID of the base profile as inputs. Note however, that the referenced data stream is not opened, and the validity of tailoring is not checked against it. The tool doesn't prevent you from extending non-existent profiles, selecting non-existent rules, and so on.

## SYNOPSIS
autotailor [OPTION...] DATASTREAM_FILE [BASE_PROFILE_ID]

## OPTIONS
--title TITLE

Title of the new profile.

--id-namespace ID_NAMESPACE

The reverse-DNS style string that is part of entities IDs in the corresponding data stream. If left out, the default value 'org.ssgproject.content' is used.

-v VAR=VALUE, --var-value VAR=VALUE

Specify modification of the XCCDF value in form <varname>=<value>. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_value' prefix will be prepended internally. Specify the argument multiple times if needed.

-v VAR=SELECTOR, --var-value VAR=SELECTOR

Specify refinement of the XCCDF value in form <varname>=<selector>. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_value' prefix will be prepended internally. Specify the argument multiple times if needed.

-r RULE=ROLE, --rule-role RULE=ROLE

Specify refinement of the XCCDF rule role in form <rule_id>=<role>. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_rule_' prefix will be prepended internally. The value of <role> can be one of full, unscored, unchecked. Specify the argument multiple times if needed.

-e RULE=SEVERITY, --rule-severity RULE=SEVERITY

Specify refinement of the XCCDF rule severity in form <rule_id>=<severity>. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf_<id-namespace>_rule_' prefix will be prepended internally. The value of <severity> can be one of unknown, info, low, medium, high. Specify the argument multiple times if needed.

-s RULE_ID, --select RULE_ID

Specify the rule to select. The rule ID can be either full, or just the suffix, in which case the 'xccdf_<id-namespace>_rule' prefix will be prepended internally. Specify the argument multiple times if needed.

-u RULE_ID, --unselect RULE_ID

Specify the rule to unselect. The argument works the same way as the --select argument.

-p TAILORED_PROFILE_ID, --tailored-profile-id TAILORED_PROFILE_ID

Specify the ID of the tailored profile. The ID of the new profile can be either its full ID, or the suffix, in which case the 'xccdf_<id-namespace>_profile_' prefix will be prepended internally. If left out, the new ID will be obtained by appending '_customized' to the tailored profile ID.

--new-profile-id NEW_PROFILE_ID

Synonym of --tailored-profile-id.

--json-tailoring JSON_TAILORING_FILE

Import tailoring from a JSON file (https://github.com/ComplianceAsCode/schemas/tree/main/tailoring). This option makes BASE_PROFILE_ID positional argument optional. However, data passed in the command line options takes precedence over JSON contents, including the BASE_PROFILE_ID argument. JSON tailoring can be accompanied with additional command-line options to either override contents of an existing profile (along with --tailored-profile-id identifier) or to create an extra profile (BASE_PROFILE_ID is a mandatory argument in this case and --tailored-profile-id is optional) in the resulting XCCDF tailoring file.

## USAGE

### Modify a variable value
$ autotailor --var-value xccdf_org.ssgproject.content_value_var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml xccdf_org.ssgproject.content_profile_pci_dss

The utility allows you to specify the ID namespace using the --namespace-id option, so you don't have to repeat the xccdf_org.ssgproject.content_... prefix everywhere. The default namespace ID is actually org.ssgproject.content, so the following invocations are equivalent to the first one:

$ autotailor --var-value var_screensaver_lock_delay=120 --namespace-id org.ssgproject.content -o tailoring.xml ssg-rhel8-ds.xml pci_dss

$ autotailor --var-value var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml pci_dss

The tailoring tailoring_file defines a new profile, xccdf_org.ssgproject.content_profile_pci_dss_customized, which alters the screensaver lock delay.

### Perform more modifications
$ autotailor --var-value var_screensaver_lock_delay=120 --select gconf_gnome_screensaver_idle_delay --var-value inactivity_timeout_value=600 ssg-rhel8-ds.xml pci_dss

### Import JSON tailoring
$ autotailor ssg-rhel8-ds.xml --json-tailoring tailoring.json

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Matěj Týč <matyc@redhat.com>
Jan Černý <jcerny@redhat.com>
Evgenii Kolesnikov <ekolesni@redhat.com>
```

branch: sisyphus


oscap-chroot

title: oscap-chroot(8)

text:
# oscap-chroot(8)

## NAME
oscap-chroot - Tool for offline SCAP evaluation of filesystems mounted at arbitrary paths.

## DESCRIPTION
oscap-chroot runs oscap tool on it in a filesystem mounted at given path.

Usage of the tool mimics usage and options of oscap(8) tool.

## USAGE

### Evaluation of XCCDF content
$ oscap-chroot CHROOT_PATH xccdf eval [options] INPUT_CONTENT

supported oscap xccdf eval options are:

--profile

--tailoring-file

--tailoring-id

--cpe (external OVAL dependencies are not supported yet!)

--oval-results

--check-engine-results

--results

--results-arf

--report

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id

--xccdf-id

--benchmark-id

### Evaluation of OVAL content
$ oscap-chroot image CHROOT_PATH oval eval [options] INPUT_CONTENT

supported oscap oval eval options are:

--id

--variables

--directives

--results

--report

--skip-validation

--datastream-id

--oval-id

### Collection of OVAL System Characteristic
$ oscap-chroot CHROOT_PATH oval collect [options] INPUT_CONTENT

supported oscap oval collect options are:

--id

--syschar

--variables

--skip-validation

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
```


oscap-im

title: oscap-im(8)

text:
# oscap-im(8)

## NAME
oscap-im - Tool for building hardened bootable container images

## DESCRIPTION
The oscap-im tool is a convenience script that makes building hardened bootable container images easier. This tool is designed to be used during the build of the bootable container image. Include oscap-im in your Containerfile that will be used to build your bootable container image. The oscap-im runs oscap tool on a given container image.

The oscap-im tool can't be used anywhere else than in a Containerfile.

## USAGE
oscap-im [OPTION...] DATASTREAM_FILE

Usage of the tool mimics usage and options of oscap(8) tool.

## OPTIONS
--profile PROFILE_ID

ID of the profile to be evaluated.

--tailoring-file TAILORING_FILE

Use given file for XCCDF tailoring. Select profile from tailoring file to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--tailoring-id COMPONENT_REF_ID

Use tailoring component in input source data stream for XCCDF tailoring. The tailoring component must be specified by its Ref-ID (value of component-ref/@id attribute in input source data stream). Select profile from tailoring component to apply using --profile. If both --tailoring-file and --tailoring-id are specified, --tailoring-file takes priority.

--results-arf FILE

Writes results to a given FILE in Asset Reporting Format.

--report FILE

Write HTML report into FILE.

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Jan Černý <jcerny@redhat.com>
```


oscap-podman

title: oscap-podman(8)

text:
# oscap-podman(8)

## NAME
oscap-podman - Tool for offline SCAP evaluation of Podman container images and Podman containers

## DESCRIPTION
oscap-podman runs oscap tool on a given container image or container.

This script cannot run in rootless mode.

## USAGE
Usage of the tool mimics usage and options of oscap(8) tool.

### Compliance scan of Podman container image:
oscap-podman [--oscap=<OSCAP_BINARY>] IMAGE_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

### Compliance scan of Podman container:
oscap-podman [--oscap=<OSCAP_BINARY>] CONTAINER_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

Refer to oscap(8) to learn about OSCAP_ARGUMENT options.

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Jan Černý <jcerny@redhat.com>
```


oscap-ssh

title: oscap-ssh(8)

text:
# oscap-ssh(8)

## NAME
oscap-ssh - Tool for running oscap over SSH and collecting results.

## DESCRIPTION
oscap-ssh runs oscap tool on a remote system through SSH connection. The input files are transferred to the target system and after the scan finishes result files are transferred back. No temporary data remains on the remote machine.

The tool requires bash, ssh, scp and mktemp to perform OVAL and XCCDF evaluation of remote machines. The remote machine also has to have oscap installed and in $PATH. This can be accomplished by installing openscap-scanner.

Usage of the tool mimics usage and options of oscap(8) tool.

## USAGE

### Evaluation of XCCDF content
$ oscap-ssh user@host 22 xccdf eval [options] INPUT_CONTENT

Only source data streams are supported as INPUT_CONTENT!

Supported options are:

--profile

--tailoring-file

--tailoring-id

--cpe

--results

--results-arf

--report

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id

--xccdf-id

--benchmark-id

--remediate

### Evaluation of OVAL content
$ oscap-ssh user@host 22 oval eval [options] INPUT_CONTENT

Supported options are:

--id

--variables

--directives

--results

--report

--skip-validation

--datastream-id

--oval-id

### Collection of OVAL System Characteristic
$ oscap-ssh user@host 22 oval collect [options] INPUT_CONTENT

Supported options are:

--id

--syschar

--variables

--skip-validation

Specific option for oscap-ssh (must be first argument):

--sudo

### Environment variables
oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable, and pastes its contents into the command-line of ssh to the location where options are expected. Supply the variable in form of a string that corresponds to a section of the ssh command-line and that consists of options you want to pass.

### Using --local-files option
The oscap-ssh command supports the --local-files option, but it isn't possible to pass './' and '../' as an argument. Use a full directory path instead.

## EXAMPLE USAGE

### Simple XCCDF evaluation
The following command evaluates a remote Fedora machine as root. HTML report is written out as report.html on the local machine. Can be executed from any machine that has ssh, scp and bash. The local machine does not need to have openscap installed. It also uses the SSH_ADDITIONAL_OPTIONS variable to configure ssh in such way that contents of the known_hosts file are ignored.

$ export SSH_ADDITIONAL_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" $ oscap-ssh root@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

### XCCDF Evaluation with tailoring file
The following command uses a tailoring file and also copies back ARF and XCCDF results. The tailoring file is automatically copied from local machine to remote.

$ oscap-ssh --sudo oscap-user@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html --results results.xml --results-arf arf.xml --tailoring-file ssg-fedora-ds-tailoring.xml /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

### Running remotely as root
Note that the openscap scanner is best run by the 'root' user as in the first example above. To do this, the "PermitRootLogin" directive must be enabled in /etc/ssh/sshd_config, which is itself a security violation. A safer approach is to enable a non-privileged user ('oscap-user' in the second example above) to run only the oscap binary as root (with the '--sudo' flag) by updating the remote machine's 'sudoers' file or adding a file like /etc/sudoers.d/99-oscap-user:

\# allow oscap-user to run openscap scanner

Defaults!/usr/bin/oscap !requiretty

oscap-user ALL=(root) NOPASSWD: /usr/bin/oscap

## REPORTING BUGS

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
Šimon Lukašík <slukasik@redhat.com>
```


oscap-vm

title: oscap-vm(8)

text:
# oscap-vm(8)

## NAME
oscap-vm - Tool for offline SCAP evaluation of virtual machines.

## SYNOPSIS
oscap-vm [--oscap=<oscap_binary>] domain VM_DOMAIN [OSCAP_OPTIONS] INPUT_CONTENT

oscap-vm [--oscap=<oscap_binary>] image VM_STORAGE_IMAGE [OSCAP_OPTIONS] INPUT_CONTENT

## DESCRIPTION
oscap-vm performs SCAP evaluation of virtual machine domains or virtual machine images.

The tool mounts the filesystem of given virtual machine and runs oscap(8) to asses the mounted filesystem. The virtual machine is mounted read only, which prevents damaging of the virtual machine during the scan. The evaluation is performed offline which means that it is performed from the host and no additional software is installed in the virtual machine.

oscap-vm is a convenience wrapper on the top of the oscap(8) utility. Most of the SCAP capabilities provided by oscap(8) are available in oscap-vm as well.

## NOTICE
To mount the virtual machine filesystem, oscap-vm uses libguestfs to access the filestystem and FUSE (the "filesystem in userspace") to make it a mountable device.

The tool requires bash, guestmount, mktemp and umount to work properly. If guestmount(1) command is not present on your system, the tool will try to use older fusermount(1) utility instead.

## USAGE
Usage of the tool mimics usage and options of oscap(8) tool.

The type of scan target (either domain or image) has to be specified first. Then identify the target by the domain name (name of a named libvirt domain) or the image path, respectively. Domain UUIDs can be used instead of names. Any domains including the running domains can be scanned.

Optionally, as the very first argument, different oscap(8) binary could be chosen to perform the scan, like --oscap=<path/to/oscap>.

The rest of the options are passed directly to oscap(8) utility. For the detailed description of its options please refer to oscap(8) manual page. However some of its options are not supported in oscap-vm because offline evaluation is used.

Last argument is SCAP content input file.

Supported common options are:

--verbose <verbosity_level>

--verbose-log-file <file>

### Evaluation of XCCDF content
xccdf eval module evaluates XCCDF files or SCAP source data streams. Result of each rule is printed to standard output, including rule title, rule id and security identifier (CVE, CCE).

```
oscap-vm image VM_STORAGE_IMAGE xccdf eval [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN xccdf eval [options] INPUT_CONTENT
```

```

```

Supported oscap xccdf eval options are:

--profile <name>

--rule <name>

--tailoring-file <file>

--tailoring-id <component-id>

--cpe <name> (external OVAL dependencies are not supported yet!)

--oval-results

--check-engine-results

--results <file>

--results-arf <file>

--thin-results

--without-syschar

--report <file>

--skip-validation

--fetch-remote-resources

--local-files

--progress

--datastream-id <id>

--xccdf-id <id>

--benchmark-id <id>

Remediation of virtual machines is not supported.

### Evaluation of OVAL content
oval eval module scans the system and evaluate definitions from given OVAL Definitions file.

```
oscap-vm image VM_STORAGE_IMAGE oval eval [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN oval eval [options] INPUT_CONTENT
```

```

```

Supported oscap oval eval options are:

--id <definition-id>

--variables <file>

--directives <file>

--without-syschar

--results <file>

--report <file>

--skip-validation

--datastream-id <id>

--oval-id <id>

### Collection of OVAL System Characteristic
oval collect module scans the system and collects items according to given OVAL Definitions file.

```
oscap-vm image VM_STORAGE_IMAGE oval collect [options] INPUT_CONTENT
oscap-vm domain VM_DOMAIN oval collect [options] INPUT_CONTENT
```

```

```

Supported oscap oval collect options are:

--id <object>

--syschar <file>

--variables <file>

--skip-validation

## EXAMPLES
Evaluate a Red Hat Enterprise Linux 7 virtual domain for compliance with the DISA STIG for Red Hat Enterprise Linux and generate a report.

```
oscap-vm domain rhel7 xccdf eval \
--report report.html --results results.xml \
--profile stig-rhel7-disa \
/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
```

```

```

Evaluate a Red Hat Enterprise Linux 6 virtual machine image for software vulnerabilities using OVAL definitions and generate a report.

```
oscap-vm image /var/lib/libvirt/images/rhel6.qcow2 oval eval \
--report report.html --results results.xml \
com.redhat.rhsa-RHEL6.xml
```

```

```

## EXIT STATUS
Normally, the exit status is 0 when operation finished successfully and 1 otherwise. In cases when oscap-vm performs evaluation of the system it may return 2 indicating success of the operation but incompliance of the assessed system.

## REPORTING BUGS
Please report bugs using https://github.com/OpenSCAP/openscap/issues

## SEE ALSO
oscap(8), scap-security-guide(8)

For detailed information please visit OpenSCAP website: https://www.open-scap.org

## AUTHORS

```
Martin Preisler <mpreisle@redhat.com>
Jan Černý <jcerny@redhat.com>
```


scap-as-rpm

title: scap-as-rpm(8)

text:
# scap-as-rpm(8)

## NAME
scap-as-rpm - takes given SCAP input(s) and packs them in an RPM package

## DESCRIPTION
usage: scap-as-rpm [-h] [--pkg-name PKG_NAME] [--pkg-version PKG_VERSION]

[--pkg-release PKG_RELEASE] [--pkg-summary PKG_SUMMARY] [--pkg-license PKG_LICENSE] [--pkg-scap-location PKG_SCAP_LOCATION] [--rpm-destination RPM_DESTINATION] [--srpm-destination SRPM_DESTINATION] FILE [FILE ...]

Takes given SCAP input(s) and makes an RPM package that contains them. The result RPM can be installed using # yum install ./package-name-1-1.rpm which will put the contents into /usr/share/xml/scap. No dependency on OpenSCAP is enforced in the output package, so you can use any SCAP-capable scanner to evaluate the content.

### positional arguments:
FILE

List of files that should be put into the result package. These should be SCAP XML files but such requirement is not enforced.

### optional arguments:
-h, --help

Show this help message and exit.

--pkg-name PKG_NAME

Name of the RPM package, if none is provided, the basename of the first SCAP input is used. Ex.: xyzsecurity-guide

--pkg-version PKG_VERSION

--pkg-release PKG_RELEASE

--pkg-summary PKG_SUMMARY

Optional short description of the package.

--pkg-license PKG_LICENSE

Short name of the license that you want to publish the package under. Ex.: GPLv2+, BSD, ...

--pkg-scap-location PKG_SCAP_LOCATION

Folder where SCAP files are supposed to be installed. Each package will have its own folder inside this folder. RPM variables can be used and will be expanded as usual. It is recommended to keep the default settings.

--rpm-destination RPM_DESTINATION

The folder (absolute or relative to CWD) where the result RPM shall be saved.

--srpm-destination SRPM_DESTINATION

The folder (absolute or relative to CWD) where the result SRPM shall be saved.