Bug 1351751

Summary: Include upstream kickstart files and HTML tables into scap-security-guide RPM shipped with Red Hat Enterprise Linux 7 (RHEL 7)
Product: Red Hat Enterprise Linux 7 Reporter: Jan Lieskovsky <jlieskov>
Component: scap-security-guideAssignee: Jan Lieskovsky <jlieskov>
Status: CLOSED ERRATA QA Contact: Marek Haicman <mhaicman>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.2CC: ksrot, mhaicman, mpreisle, openscap-maint, pvrabec, swells
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: scap-security-guide-0.1.30-2.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-04 07:32:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2016-06-30 17:57:38 UTC 
Description of problem:
In upstream git repository of the scap-security-guide project there are example kickstart files available for Red Hat Enterprise Linux 7 system:
* https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/7/kickstart/ssg-rhel7-ospp-ks.cfg
* https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/7/kickstart/ssg-rhel7-pci-dss-server-with-gui-oaa-ks.cfg

These kickstarts allow to install RHEL 7 system that will be compliant with USGCB or PCI DSS profile requirements right after the installation is complete.

Similar kickstart files exist for Red Hat Enterprise Linux 6:
* https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/kickstart/ssg-rhel6-pci-dss-with-gui-ks.cfg
* https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/kickstart/ssg-rhel6-stig-ks.cfg
* https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/kickstart/ssg-rhel6-usgcb-server-with-gui-ks.cfg

These kickstart files are not currently included in the scap-security-guide RPM package as shipped with Red Hat Enterprise Linux 7. Since they can simplify the deployment of compliant RHEL 7 systems, they should be included.

Moreover, during the SCAP Security Guide build process there are produced multiple HTML files (tables providing identifiers mappings between various security standards, like CCI, SRG etc).

The list of these files is as follows:
$ pwd
... scap-security-guide/RHEL/7
$ ls output/table-*.html
output/table-rhel5-stig.html         output/table-rhel7-cisrefs.html          output/table-rhel7-pcidss.html       output/table-stig-rhel7-testinfo.html
output/table-rhel5-stig-manual.html  output/table-rhel7-nistrefs-common.html  output/table-rhel7-srgmap-flat.html
output/table-rhel7-cces.html         output/table-rhel7-nistrefs.html         output/table-rhel7-srgmap.html
output/table-rhel7-cisrefs-c2s.html  output/table-rhel7-nistrefs-ospp.html    output/table-rhel7-stig.html
$ ls output/table-*.xhtml
output/table-rhel7-srgmap-flat.xhtml

Since these files provide additional information to scap-security-guide users (allow them to map present SSG requirements against different security standards), they should also be included in the scap-security-guide RPM package.
Comment 2 Jan Lieskovsky 2016-06-30 17:59:54 UTC 
Upstream patch:
https://github.com/OpenSCAP/scap-security-guide/pull/1315
Comment 8 Martin Preisler 2016-09-21 19:54:19 UTC 
Both look like bugs to me.
Comment 9 Marek Haicman 2016-09-22 19:50:35 UTC 
Filed two bugs with findings.

Bug 1378581 - ospp kickstart example too strict
Bug 1378583 - html tables deficiencies

Rest of the additions is present and in useful shape.
No regressions found - switching to verified.
Comment 11 errata-xmlrpc 2016-11-04 07:32:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2483.html