27 Building Updated SUSE Linux Micro Images with Kiwi #

#======================================
# Apply OpenSCAP Hardening with Tailoring
#======================================
if [ -f /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml ]; then
    echo "** Preparing OpenSCAP Hardening..."

    DATASTREAM="/usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml"
    BASE_PROFILE="xccdf_org.ssgproject.content_profile_general"
    PROFILE_ID="${BASE_PROFILE}"
    TAILORING_FLAGS=""
    TAILORING_ARG=""

    # Check if tailoring configurations exist (copied in from host's micro-sdk/defs/root/etc/)
    if [ -f /etc/scap-tailoring.txt ]; then
        echo "** Tailoring configuration found at /etc/scap-tailoring.txt"

        # Read the lines, ignore comments and empty lines
        TAILORING_FLAGS=$(grep -v '^#' /etc/scap-tailoring.txt | grep -v '^$' | tr '\n' ' ')

        if [ -n "${TAILORING_FLAGS}" ]; then
            echo "** Generating tailored profile using autotailor..."
            PROFILE_ID="xccdf_org.ssgproject.content_profile_general_tailored"

            # We temporarily disable exit-on-error for autotailor / xmllint
            set +e

            # Run autotailor to generate tailoring XML
            autotailor ${TAILORING_FLAGS} \
                --output /tmp/ssg-slmicro6-tailored-ds.xml \
                --new-profile-id "${PROFILE_ID}" \
                "${DATASTREAM}" "${BASE_PROFILE}"

            # Format and check tailoring XML (workaround for older OpenSCAP versions)
            if [ -f /tmp/ssg-slmicro6-tailored-ds.xml ]; then
                xmllint --format /tmp/ssg-slmicro6-tailored-ds.xml > /tmp/ssg-slmicro6-tailored-ds-formatted.xml
                TAILORING_ARG="--tailoring-file /tmp/ssg-slmicro6-tailored-ds-formatted.xml"
            else
                echo "WARNING: autotailor failed to generate tailoring file. Falling back to base profile."
                PROFILE_ID="${BASE_PROFILE}"
                TAILORING_ARG=""
            fi

            set -e
        fi
    fi

    echo "** Applying OpenSCAP Hardening Profile: ${PROFILE_ID}..."
    set +e
    if [ -n "${TAILORING_ARG}" ]; then
        oscap xccdf eval --remediate \
            --profile "${PROFILE_ID}" \
            ${TAILORING_ARG} \
            "${DATASTREAM}"
    else
        # Fallback to standard command skipping the dangerous authorized local users rule
        oscap xccdf eval --remediate \
            --profile "${PROFILE_ID}" \
            --skip-rule xccdf_org.ssgproject.content_rule_accounts_authorized_local_users \
            "${DATASTREAM}"
    fi
    set -e
    echo "** OpenSCAP Hardening completed."

    # Clean up temporary tailoring files
    rm -f /tmp/ssg-slmicro6-tailored-ds.xml /tmp/ssg-slmicro6-tailored-ds-formatted.xml
    rm -f /etc/scap-tailoring.txt
fi