Repository navigation
Add openscap plugin for CIS benchmark reporting - #863
Draft
ianpittwood wants to merge 2 commits into
Draft
ianpittwood wants to merge 2 commits into
ianpittwood wants to merge 2 commits into
Conversation
Adds `bakery openscap scan|fetch|profiles`. Scans run oscap in a locally built scanner container with the target image mounted read-only (docker image mount, or an exported volume on older engines), using pinned and sha512-verified ComplianceAsCode content selected from the image's /etc/os-release. A built-in container tailoring drops host/kernel-only rules; each scan is validated against the target OS before results are trusted. Outputs a table plus JSON/markdown summaries with per-rule CIS refs and bash remediation. Also adds setup-openscap, Renovate pins, docs and the design spec.
Address review findings: - error (not skip) when the image is missing or os-release can't be read - validation fails when ARF, installed-OS result or canary rule is absent - check docker export exit status; partial rootfs is an error - name scanner containers and force-remove them on timeout/interrupt; reclaim root-owned output before temp-dir cleanup - publish cached content only after checksum/extraction completes - resolve bakery.yaml datastream/tailoring paths against the context - pin scanner base digest and openscap-scanner version - record image ref/ID, scanner, oscap version and tailoring in summary.json
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #88
Adds an
openscapplugin to Bakery that reports CIS benchmark compliance for Bakery-managed images. It only reports and never modifies images, so humans or agents can turn the findings into Containerfile changes. The design and the spike evidence behind it are inposit-bakery/docs/openscap-plugin-spec.md.What's included
bakery openscap scan,bakery openscap fetch(warms the content cache) andbakery openscap profiles <product>....oscapruns as root in a pinned scanner container that Bakery builds locally. The target image is mounted read-only, using--mount type=imageon Docker 28+ or an exported temporary volume on older engines. Only Docker is needed on the host./etc/os-release, so the mapping works beyond Ubuntu.ERROR, never a pass.summary.jsonandsummary.mdper image inresults/openscap/<image>/. Each failing rule lists its CIS section, rationale and a bash fix, and the summary records the image ID, scanner andoscapversions, content and tailoring used. The HTML report, raw XCCDF/ARF results and the fix script are available on request.bakery.yamloptions:profile,contentVersion,datastream,tailoring,skipRules,failOn(defaultnone) andformats. Each has a matching CLI flag.setup-openscapaction (caches and fetches content), Renovate pins for the content version, and updated docs.Results
OKOKOKSKIPPED: no CIS profile upstream yetSKIPPED: unsupported OSThe Ubuntu 24.04 row is with the default gate. The same scan with
--fail-on mediumreportedBREACH. The Debian row was scanned before the stricter validation commit and has not been re-run since.Testing
test_integration.pyis opt-in withBAKERY_TEST_OPENSCAP=1because it downloads about 180 MB of CIS-titled content, which we keep out of public CI. It builds a weakened image (telnet installed,chmod 777 /etc/passwd) and checks that exactly those rules flip to fail, under both scan strategies.Follow-ups / open items
HOST_ONLY_RULE_PATTERNincontent.py).root_path_all_dirsandroot_path_no_dotlikely fail falsely when scanning offline. Candidates forskipRules.extractVersionstrips thevfrom the ComplianceAsCode tag.