Plugins » OpenSCAP

Proposed title of this feature request

[RFE] Integrate OpenSCAP into the provisioning process

Why does the user need this?

To get a baseline Compliance report for a system at build time. When a system is newly built, you want to verify immediately following the build that it meets your criteria. Especially if the normal compliance check schedule is monthly or quarterly (or more), you don't want to wait for weeks or months to find out your system is out of compliance.

How would the user like to achieve this? (List the functional requirements here)

One possible way to do this would be to extend foreman_scap_client to actually use its own yaml file and have a CLI option to "run all profiles." For example:

/usr/bin/foreman_scap_client --run-all

For each functional requirement listed, specify how the user can test to confirm the requirement is successfully implemented.

By provision a client with OpenScap configured and check if we get OpenScap report on the Foreman once the machine is built.