Add openscap lockdown #121
Conversation
lib/linux_admin/scap.rb
Outdated
There was a problem hiding this comment.
All of these lines could potentially raise an OpenSCAPError. Is it better to let the caller of lockdown handle that or should we do something different?
|
Looks like the tests are failing because openscap isn't installed on the travis machine. Just requiring the openscap gem needs the package to be installed. @Fryguy How can we fix that? Both "openscap" and "scap-security-guide" would need to be installed for the actual feature to work. |
This class will run any specified SCAP rules and run remediation for any failed tests by altering the xml files which are provided by the package scap-security-guide.
carbonin
force-pushed
the
add_openscap_lockdown
branch
from
91a1462 to
525fa7a
Compare
|
Checked commits carbonin@4efd3bb .. carbonin@3732531 with rubocop 0.32.1 and haml-lint 0.13.0 |
There was a problem hiding this comment.
Is this cleaning things up properly?
Seems odd we are using Tempfile (cool) but copying the oval_file into tempdir. Could we use tempfile for this too?
4 participants
Added the Scap class which, given a list of openscap rule ids and values, will run an evaluation using a temporary profile and fix any failures.