8.11. Scanning and Remediating Configuration Compliance of Container Images and Containers Using atomic scan 8.11.1. Scanning for Configuration Compliance of Container Images and Containers Using atomic scan Use this type of scanning to evaluate Red Hat Enterprise Linux-based container images and containers with the SCAP content provided by the SCAP Security Guide (SSG) bundled inside the OpenSCAP container image. This enables scanning against any profile provided by the SCAP Security Guide. Warning The atomic scan functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker utility for security compliance scanning purposes. Note For a detailed description of the usage of the atomic command and containers, see the Product Documentation for Red Hat Enterprise Linux Atomic Host 7 . The Red Hat Customer Portal also provides a guide to the atomic command-line interface (CLI) . Prerequisites You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the atomic install rhel7/openscap command. Procedure List SCAP content provided by the OpenSCAP image for the configuration_compliance scan: Verify compliance of the latest Red Hat Enterprise Linux 7 container image with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) policy and generate an HTML report from the scan: The output of the command contains the information about files associated with the scan at the end: The atomic scan generates a subdirectory with all the results and reports from a scan in the /var/lib/atomic/openscap/ directory. The arf.xml file with results is generated on every scanning for configuration compliance. To generate a human-readable HTML report file, add the report suboption to the --scanner_args option. Optional: To generate XCCDF results readable by DISA STIG Viewer , add the stig-viewer suboption to the --scanner_args option. The results are placed in stig.xml . Note When the xccdf-id suboption of the --scanner_args option is omitted, the scanner searches for a profile in the first XCCDF component of the selected data stream file. For more details about data stream files, see Section 8.3.1, "Configuration Compliance in RHEL 7" . 8.11.2. Remediating Configuration Compliance of Container Images and Containers Using atomic scan You can run the configuration compliance scan against the original container image to check its compliance with the DISA STIG policy. Based on the scan results, a fix script containing bash remediations for the failed scan results is generated. The fix script is then applied to the original container image - this is called a remediation. The remediation results in a container image with an altered configuration, which is added as a new layer on top of the original container image. Important Note that the original container image remains unchanged and only a new layer is created on top of it. The remediation process builds a new container image that contains all the configuration improvements. The content of this layer is defined by the security policy of scanning - in the case, the DISA STIG policy. This also means that the remediated container image is no longer signed by Red Hat, which is expected, because it differs from the original container image by containing the remediated layer. Warning The atomic scan functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker utility for security compliance scanning purposes. Prerequisites You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the atomic install rhel7/openscap command. Procedure List SCAP content provided by the OpenSCAP image for the configuration_compliance scan: To remediate container images to the specified policy, add the --remediate option to the atomic scan command when scanning for configuration compliance. The following command builds a new remediated container image compliant with the DISA STIG policy from the Red Hat Enterprise Linux 7 container image: Optional: The output of the atomic scan command reports a remediated image ID. To make the image easier to remember, tag it with some name, for example:

Commands:
~]# atomic help registry.access.redhat.com/rhel7/openscap
~]# atomic scan --scan_type configuration_compliance --scanner_args xccdf-id= scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml , profile= xccdf_org.ssgproject.content_profile_stig-rhel7-disa , report registry.access.redhat.com/rhel7:latest
......... Files associated with this scan are in /var/lib/atomic/openscap/2017-11-03-13-35-34-296606. ~]# tree /var/lib/atomic/openscap/2017-11-03-13-35-34-296606 /var/lib/atomic/openscap/2017-11-03-13-35-34-296606 ├── db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2 │ ├── arf.xml │ ├── fix.sh │ ├── json │ └── report.html └── environment.json 1 directory, 5 files
~]# atomic help registry.access.redhat.com/rhel7/openscap
~]# atomic scan --remediate --scan_type configuration_compliance --scanner_args profile= xccdf_org.ssgproject.content_profile_stig-rhel7-disa , report registry.access.redhat.com/rhel7:latest registry.access.redhat.com/rhel7:latest (db7a70a0414e589) The following issues were found: ......... Configure Time Service Maxpoll Interval Severity: Low XCCDF result: fail Configure LDAP Client to Use TLS For All Transactions Severity: Moderate XCCDF result: fail ......... Remediating rule 43/44: 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll' Remediating rule 44/44: 'xccdf_org.ssgproject.content_rule_ldap_client_start_tls' Successfully built 9bbc7083760e Successfully built remediated image 9bbc7083760e from db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2. Files associated with this scan are in /var/lib/atomic/openscap/2017-11-06-13-01-42-785000.
~]# docker tag 9bbc7083760e rhel7_disa_stig