How to generate tailoring file in oscap?

Environment

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Issue

How to generate tailoring file in oscap?
How to use the tailoring file for assessment?

Resolution

1) What is tailoring?

• The process of altering the profiles without changing the xccdf file itself.
• Another situation where tailoring is suitable is when you have a company-wide policy but one rule of it does not make sense for one particular machine, or perhaps you want to enforce stricter rules on public facing servers
• In general, one want to make slight temporary (reversible) tweaks to the profile is being used for whatever reason.
• Tailoring means selecting/deselecting specific rule from a specific section or not.

2) Usage of Tailoring file

1. During Scanning: Overriding rules defined xccdf document
2. During Remediation: If the scan is done using tailoring file and the result is generated as failed, then during remediation value is set (as per present in tailoring file).

3) Generating a Tailoring file using scap-workbench

scap-workbench is the GUI application to customize the existing profile, generate a tailoring file, and remediate the system to align with a specific profile.

Basic Steps are:

1. Install scap-workbench
2. Run scap-workbench
3. Select RHEL version (RHEL7 or anything else)
4. Select security profile
5. Click the Customize button, choose a new profile name, and click OK.
6. Search the rule to be modified, adjust the profile according to your needs, and click OK.
7. Save a customization file separately by using Save Customization Only in the File menu

Please refer to the following product documentation for details:

• RHEL6: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-customizing_security_profiles-scap_workbench
• RHEL7: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/scanning-the-system-with-a-customized-profile-using-scap-workbench_scanning-the-system-for-configuration-compliance-and-vulnerabilities#customizing-a-security-profile-with-scap-workbench_scanning-the-system-with-a-customized-profile-using-scap-workbench
• RHEL8: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/system_design_guide/scanning_the_system_for_security_compliance_and_vulnerabilities#customizing-a-security-profile-with-scap-workbench_scanning-the-system-with-a-customized-profile-using-scap-workbench
• RHEL9: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening#customizing-a-security-profile-with-scap-workbench_scanning-the-system-with-a-customized-profile-using-scap-workbench

4) Assessing configuration compliance with a specific security profile and a tailoring file by oscap

# oscap xccdf eval --report report.html --profile <custom-profile-name> --tailoring-file <tailor-file> <tailored-datastream-file>

• is the file generated by scap-workbench or manually.
• is the new profile name in the tailoring file, which may be the one selected in the scap-workbench GUI to generate a tailoring file.
• is the tailored datastream file like /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml.
• Example:

# oscap xccdf eval --report report.html --profile xccdf_org.ssgproject.content_profile_stig_customized --tailoring-file ssg-rhel8-ds-tailoring.xml /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Root Cause

When one wants to modify/run a specific rule then tailoring file is useful.

Diagnostic Steps

Created an tailoring file with rule smart_card_login=true

<xccdf:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="true"/>

Scanning system using tailoring file

# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard_customized --tailoring-file /root/ssg-rhel7-ds-tailoring-smart-card.xml --results test.xml --report ./report.html  /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
Title   Enable Smart Card Login
Rule    xccdf_org.ssgproject.content_rule_smartcard_auth
Ident   CCE-80207-4
Result  fail

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.