Skip to content

Instantly share code, notes, and snippets.

@inntran
Created September 18, 2021 19:33
Show Gist options
  • Save inntran/249dea7a8ea097bc76605e2e29667aa6 to your computer and use it in GitHub Desktop.
Save inntran/249dea7a8ea097bc76605e2e29667aa6 to your computer and use it in GitHub Desktop.
Enable OpenSCAP security profiles for CentOS Stream 8 installer
# I'm facing similar issue like [1] and [2],
# as of today (2021-09-18) CentOS Stream 8 installer does not list any OpenSCAP backed "Security Profile".
# By reading source code at [3] and [4], I figured out a way to make CentOS Stream 8 to read and use CentOS 8 and RHEL 8 security profiles.
#################################################### WARNING ##########################################################
# CentOS 8 or CentOS Stream 8 are not certified with RHEL 8 profiles, you may not get them through compliance audits. #
# Use this at your own risk. #
#######################################################################################################################
# Step 1, at the language selection page, don't click next, but switch to a virtual console, type the 2 commands below
cd /usr/share/xml/scap/ssg/content/
ln -s ssg-rhel8-ds.xml ssg-cs8-ds.xml
# Step 2, switch back to GUI installer, choose a language then continue, you may choose a security profiles from the list
# Step 3, watch the installer, right after it completes installation of all packages, type the following 2 commands
# Use this command to watch for content: `watch ls /mnt/sysroot/usr/share/xml/scap/ssg/content`
cd /mnt/sysroot/usr/share/xml/scap/ssg/content/
ln -s ssg-rhel8-ds.xml ssg-cs8-ds.xml
# Step 4, wait for the installer to finish.
# References
# [1] https://github.com/OpenSCAP/oscap-anaconda-addon/issues/105
# [2] https://forums.centos.org/viewtopic.php?f=57&t=77643
# [3] https://github.com/OpenSCAP/oscap-anaconda-addon/blob/rhel8-branch/org_fedora_oscap/gui/spokes/oscap.py#L322
# [4] https://github.com/OpenSCAP/oscap-anaconda-addon/blob/rhel8-branch/org_fedora_oscap/common.py#L69
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment