Skip to content

rhel: fix openscap profile allowlists (HMS-9095) #1778

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
supakeen merged 1 commit into from
Aug 21, 2025
Merged

rhel: fix openscap profile allowlists (HMS-9095) #1778

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 42 additions & 6 deletions data/distrodefs/distros.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ distros:
- azure
# rhel & centos share the same list of allowed profiles so a
# single allow list can be used
oscap_profiles_allowlist: &oscap_profile_allowlist_rhel
oscap_profiles_allowlist: &oscap_profile_allowlist_rhel_10
- "xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_high"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary"
Expand All @@ -112,7 +112,6 @@ distros:
- "xccdf_org.ssgproject.content_profile_cis_server_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l2"
- "xccdf_org.ssgproject.content_profile_cui"
- "xccdf_org.ssgproject.content_profile_e8"
- "xccdf_org.ssgproject.content_profile_hipaa"
- "xccdf_org.ssgproject.content_profile_ism_o"
Expand Down Expand Up @@ -150,7 +149,7 @@ distros:
runner:
name: org.osbuild.centos10
build_packages: *rhel10_runner_build_packages
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel_10
bootstrap_containers:
# we need the toolbox container because stock centos has e.g. no
# mount util
Expand Down Expand Up @@ -210,7 +209,27 @@ distros:
- "platform-python" # osbuild
- "python3"
# rhel9 allow all
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel
oscap_profiles_allowlist: &oscap_profile_allowlist_rhel_9
- "xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_high"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_minimal"
- "xccdf_org.ssgproject.content_profile_ccn_advanced"
- "xccdf_org.ssgproject.content_profile_ccn_basic"
- "xccdf_org.ssgproject.content_profile_ccn_intermediate"
- "xccdf_org.ssgproject.content_profile_cis"
- "xccdf_org.ssgproject.content_profile_cis_server_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l2"
- "xccdf_org.ssgproject.content_profile_cui"
- "xccdf_org.ssgproject.content_profile_e8"
- "xccdf_org.ssgproject.content_profile_hipaa"
- "xccdf_org.ssgproject.content_profile_ism_o"
- "xccdf_org.ssgproject.content_profile_ospp"
- "xccdf_org.ssgproject.content_profile_pci-dss"
- "xccdf_org.ssgproject.content_profile_stig"
- "xccdf_org.ssgproject.content_profile_stig_gui"

bootstrap_containers:
x86_64: "registry.access.redhat.com/ubi{{.MajorVersion}}/ubi:latest"
aarch64: "registry.access.redhat.com/ubi{{.MajorVersion}}/ubi:latest"
Expand All @@ -231,6 +250,7 @@ distros:
runner:
name: org.osbuild.centos9
build_packages: *rhel9_runner_build_packages
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel_9
bootstrap_containers:
# we need the toolbox container because stock centos has e.g. no
# mount util
Expand Down Expand Up @@ -282,7 +302,23 @@ distros:
# https://github.com/osbuild/osbuild/blob/ea8261cad6c5c606c00c0f2824c3f483c01a0cc9/runners/org.osbuild.rhel82#L61
# Install python36 explicitly for RHEL 8.
- "python36"
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel
oscap_profiles_allowlist: &oscap_profile_allowlist_rhel_8
- "xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_high"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary"
- "xccdf_org.ssgproject.content_profile_anssi_bp28_minimal"
- "xccdf_org.ssgproject.content_profile_cis"
- "xccdf_org.ssgproject.content_profile_cis_server_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l1"
- "xccdf_org.ssgproject.content_profile_cis_workstation_l2"
- "xccdf_org.ssgproject.content_profile_cui"
- "xccdf_org.ssgproject.content_profile_e8"
- "xccdf_org.ssgproject.content_profile_hipaa"
- "xccdf_org.ssgproject.content_profile_ism_o"
- "xccdf_org.ssgproject.content_profile_ospp"
- "xccdf_org.ssgproject.content_profile_pci-dss"
- "xccdf_org.ssgproject.content_profile_stig"
- "xccdf_org.ssgproject.content_profile_stig_gui"
bootstrap_containers:
x86_64: "registry.access.redhat.com/ubi{{.MajorVersion}}/ubi:latest"
aarch64: "registry.access.redhat.com/ubi{{.MajorVersion}}/ubi:latest"
Expand All @@ -301,7 +337,7 @@ distros:
runner:
name: org.osbuild.centos8
build_packages: *rhel8_runner_build_packages
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel
oscap_profiles_allowlist: *oscap_profile_allowlist_rhel_8
bootstrap_containers:
# we need the toolbox container because stock centos has e.g. no
# mount util
Expand Down
Loading