7.11. Scanning and Remediating Configuration Compliance of Container Images and Containers Using atomic scan

7.11.1. Scanning for Configuration Compliance of Container Images and Containers Using atomic scan

Use this type of scanning to evaluate Red Hat Enterprise Linux-based container images and containers with the SCAP content provided by the SCAP Security Guide (SSG) bundled inside the OpenSCAP container image. This enables scanning against any profile provided by the SCAP Security Guide.

Note

For a detailed description of the usage of the atomic command and containers, see the Product Documentation for Red Hat Enterprise Linux Atomic Host. The Red Hat Customer Portal also provides a guide to the Atomic command-line interface (CLI).

Prerequisites

Procedure

  1. List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
    ~]# atomic help registry.access.redhat.com/rhel7/openscap
    Verify compliance of the latest Red Hat Enterprise Linux 7 container image with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) policy and generate an HTML report from the scan:
    ~]# atomic scan --scan_type configuration_compliance --scanner_args xccdf-id=scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml,profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report registry.access.redhat.com/rhel7:latest
    The output of the previous command contains the information about files associated with the scan at the end:
    ............
    
    Files associated with this scan are in /var/lib/atomic/openscap/2017-11-03-13-35-34-296606.
    
    ~]# tree /var/lib/atomic/openscap/2017-11-03-13-35-34-296606
    /var/lib/atomic/openscap/2017-11-03-13-35-34-296606
    ├── db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2
    │   ├── arf.xml
    │   ├── fix.sh
    │   ├── json
    │   └── report.html
    └── environment.json
    
    1 directory, 5 files
    The atomic scan generates a subdirectory with all the results and reports from a scan in the /var/lib/atomic/openscap/ directory. The arf.xml file with results is generated on every scanning for configuration compliance. To generate a human-readable HTML report file, add the report suboption to the --scanner_args option.
  2. Optional: To generate XCCDF results readable by DISA STIG Viewer, add the stig-viewer suboption to the --scanner_args option. The results are placed in stig.xml.

Note

When the xccdf-id suboption of the --scanner_args option is omitted, the scanner searches for a profile in the first XCCDF component of the selected data stream file. For more details about data stream files, see Section 7.3.1, “Configuration Compliance in RHEL 7”.

7.11.2. Remediating Configuration Compliance of Container Images and Containers Using atomic scan

You can run the configuration compliance scan against the original container image to check its compliance with the DISA STIG policy. Based on the scan results, a fix script containing bash remediations for the failed scan results is generated. The fix script is then applied to the original container image - this is called a remediation. The remediation results in a container image with an altered configuration, which is added as a new layer on top of the original container image.

Important

Note that the original container image remains unchanged and only a new layer is created on top of it. The remediation process builds a new container image that contains all the configuration improvements. The content of this layer is defined by the security policy of scanning - in the previous case, the DISA STIG policy. This also means that the remediated container image is no longer signed by Red Hat, which is expected, because it differs from the original container image by containing the remediated layer.

Prerequisites

Procedure

  1. List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
    ~]# atomic help registry.access.redhat.com/rhel7/openscap
  2. To remediate container images to the specified policy, add the --remediate option to the atomic scan command when scanning for configuration compliance. The following command builds a new remediated container image compliant with the DISA STIG policy from the Red Hat Enterprise Linux 7 container image:
    ~]# atomic scan --remediate --scan_type configuration_compliance --scanner_args profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report registry.access.redhat.com/rhel7:latest 
    
    registry.access.redhat.com/rhel7:latest (db7a70a0414e589)
    
    The following issues were found:
    ............
    	 Configure Time Service Maxpoll Interval
    	 Severity: Low
    		 XCCDF result: fail
    
    	 Configure LDAP Client to Use TLS For All Transactions
    	 Severity: Moderate
    		 XCCDF result: fail
    ............
    Remediating rule 43/44: 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll'
    Remediating rule 44/44: 'xccdf_org.ssgproject.content_rule_ldap_client_start_tls'
    
    Successfully built 9bbc7083760e
    Successfully built remediated image 9bbc7083760e from db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2.
    
    Files associated with this scan are in /var/lib/atomic/openscap/2017-11-06-13-01-42-785000.
    
  3. Optional: The output of the atomic scan command reports a remediated image ID. To make the image easier to remember, tag it with some name, for example:
    ~]# docker tag 9bbc7083760e rhel7_disa_stig