Created
September 18, 2021 19:33
-
-
Save inntran/249dea7a8ea097bc76605e2e29667aa6 to your computer and use it in GitHub Desktop.
Enable OpenSCAP security profiles for CentOS Stream 8 installer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# I'm facing similar issue like [1] and [2], | |
# as of today (2021-09-18) CentOS Stream 8 installer does not list any OpenSCAP backed "Security Profile". | |
# By reading source code at [3] and [4], I figured out a way to make CentOS Stream 8 to read and use CentOS 8 and RHEL 8 security profiles. | |
#################################################### WARNING ########################################################## | |
# CentOS 8 or CentOS Stream 8 are not certified with RHEL 8 profiles, you may not get them through compliance audits. # | |
# Use this at your own risk. # | |
####################################################################################################################### | |
# Step 1, at the language selection page, don't click next, but switch to a virtual console, type the 2 commands below | |
cd /usr/share/xml/scap/ssg/content/ | |
ln -s ssg-rhel8-ds.xml ssg-cs8-ds.xml | |
# Step 2, switch back to GUI installer, choose a language then continue, you may choose a security profiles from the list | |
# Step 3, watch the installer, right after it completes installation of all packages, type the following 2 commands | |
# Use this command to watch for content: `watch ls /mnt/sysroot/usr/share/xml/scap/ssg/content` | |
cd /mnt/sysroot/usr/share/xml/scap/ssg/content/ | |
ln -s ssg-rhel8-ds.xml ssg-cs8-ds.xml | |
# Step 4, wait for the installer to finish. | |
# References | |
# [1] https://github.com/OpenSCAP/oscap-anaconda-addon/issues/105 | |
# [2] https://forums.centos.org/viewtopic.php?f=57&t=77643 | |
# [3] https://github.com/OpenSCAP/oscap-anaconda-addon/blob/rhel8-branch/org_fedora_oscap/gui/spokes/oscap.py#L322 | |
# [4] https://github.com/OpenSCAP/oscap-anaconda-addon/blob/rhel8-branch/org_fedora_oscap/common.py#L69 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment