autotailor(8)

🎀 autotailor 🎀

okay bestie, welcome to autotailor(8) — that's the manual name, she's a System Administration Utilities girlie and she's about to make your SCAP life SO much easier. pull up a chair, grab a strawberry 🍓, and let's go.

---

✨ NAME ✨

autotailor — a CLI tool for tailoring of SCAP data streams. slay.

---

💅 DESCRIPTION 💅

So the whole vibe is this: autotailor produces tailoring files that SCAP-compliant scanners can use to complement SCAP data streams. A tailoring file adds a new profile, and that new profile is supposed to extend a profile that's already present in the data stream. it's giving "remix of a remix" 💖

Tailoring can add, remove or refine rules, and it can also redefine contents of XCCDF variables. literally so much power.

The tool requires two things as inputs: the data stream location and the ID of the base profile. By default, the tool parses the referenced data stream and validates the IDs you gave it — profiles, rules, values, groups, and selectors — against that data stream. 🦋

!!! You can skip that validation with --no-validate. It significantly speeds up execution on large data streams, but the tradeoff is that it will no longer catch invalid IDs. iykyk.

---

🌸 SYNOPSIS 🌸

autotailor [OPTION...] DATASTREAM_FILE [BASE_PROFILE_ID]

---

👑 OPTIONS 👑

• --title TITLE — the title of the new profile. name her something cute.
• --id-namespace ID_NAMESPACE — the reverse-DNS style string that's part of entity IDs in the corresponding data stream. if you leave it out, the default value org.ssgproject.content is used. easy peasy.
• -v VAR=VALUE, --var-value VAR=VALUE — specify a modification of the XCCDF value, in the form <varname>=<value>. the name of the variable can be either its full name or just the suffix — and if you go the suffix route, the xccdf_<id-namespace>_value prefix gets prepended internally, no cap. specify the argument multiple times if you need to. 💜
• -v VAR=SELECTOR, --var-value VAR=SELECTOR — specify a refinement of the XCCDF value, in the form <varname>=<selector>. same deal as above: name of the variable can be either its full name or the suffix, and in the suffix case the xccdf_<id-namespace>_value prefix gets prepended internally. specify the argument multiple times if needed. ✨
• -r RULE=ROLE, --rule-role RULE=ROLE — specify a refinement of the XCCDF rule role, in the form <rule_id>=<role>. the rule name can be either its full name or the suffix, and with the suffix the xccdf_<id-namespace>_rule_ prefix gets prepended internally. <role> can be one of full, unscored, unchecked. specify it multiple times if needed.
• -e RULE=SEVERITY, --rule-severity RULE=SEVERITY — specify a refinement of the XCCDF rule severity, in the form <rule_id>=<severity>. rule name can be full or just the suffix, and for the suffix the xccdf_<id-namespace>_rule_ prefix gets prepended internally. <severity> can be one of unknown, info, low, medium, high. specify it multiple times if needed. 🔥
• -s RULE_ID, --select RULE_ID — specify the rule to select. the rule ID can be full, or just the suffix — in which case the xccdf_<id-namespace>_rule prefix gets prepended internally. specify it multiple times if needed.
• -u RULE_ID, --unselect RULE_ID — specify the rule to unselect. this argument works exactly the same way as the --select argument. bye felicia 👋
• -p TAILORED_PROFILE_ID, --tailored-profile-id TAILORED_PROFILE_ID — specify the ID of the tailored profile. the new profile's ID can be either its full ID or just the suffix, and with the suffix the xccdf_<id-namespace>_profile_ prefix gets prepended internally. if you leave it out, the new ID is obtained by appending _customized to the tailored profile ID. 💅
• --new-profile-id NEW_PROFILE_ID — a synonym of --tailored-profile-id. same energy, different name.
• --json-tailoring JSON_TAILORING_FILE — import tailoring from a JSON file (https://github.com/ComplianceAsCode/schemas/tree/main/tailoring). this option makes the BASE_PROFILE_ID positional argument optional. BUT — data passed in the command line options takes precedence over JSON contents, including the BASE_PROFILE_ID argument. JSON tailoring can be accompanied with additional command-line options to either override contents of an existing profile (along with the --tailored-profile-id identifier) or to create an extra profile — and in that case BASE_PROFILE_ID is a mandatory argument while --tailored-profile-id is optional — in the resulting XCCDF tailoring file. 🙈
• --local-path — use a local path for the benchmark href instead of an absolute file:// URI. this one is useful for compatibility with layered products like Red Hat Satellite that cannot resolve local filesystem paths. when this option is specified, absolute paths are converted to basename only, while relative paths are preserved as provided. by default, the tool uses absolute file:// URIs for backward compatibility.
• --no-validate — skip validation of IDs against the data stream. this significantly speeds up execution on large data streams but may produce invalid tailoring files if incorrect IDs are provided.

⚠️ real talk bestie: that last one says use with caution for a reason. don't come crying to me when your IDs are made up. 💀

---

🌈 USAGE 🌈

🦋 Modify a variable value 🦋

$ autotailor --var-value xccdf_org.ssgproject.content_value_var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml xccdf_org.ssgproject.content_profile_pci_dss

The utility allows you to specify the ID namespace using the --namespace-id option, so you don't have to repeat the xccdf_org.ssgproject.content_... prefix everywhere. the default namespace ID is actually org.ssgproject.content, so the following invocations are equivalent to the first one:

$ autotailor --var-value var_screensaver_lock_delay=120 --namespace-id org.ssgproject.content -o tailoring.xml ssg-rhel8-ds.xml pci_dss

$ autotailor --var-value var_screensaver_lock_delay=120 -o tailoring.xml ssg-rhel8-ds.xml pci_dss

The tailoring tailoring_file defines a new profile, xccdf_org.ssgproject.content_profile_pci_dss_customized, which alters the screensaver lock delay. she's customized and she knows it. ✨

💖 Perform more modifications 💖

$ autotailor --var-value var_screensaver_lock_delay=120 --select gconf_gnome_screensaver_idle_delay --var-value inactivity_timeout_value=600 ssg-rhel8-ds.xml pci_dss

🧚 Import JSON tailoring 🧚

$ autotailor ssg-rhel8-ds.xml --json-tailoring tailoring.json

---

🫶 REPORTING BUGS 🫶

Please report bugs using https://github.com/OpenSCAP/openscap/issues — the maintainers are genuinely lovely, just be nice and bring receipts. 🌸

---

⭐ AUTHORS ⭐

• Matěj Týč <matyc@redhat.com>
• Jan Černý <jcerny@redhat.com>
• Evgenii Kolesnikov <ekolesni@redhat.com>

put some respect on their names, they built this. 👑

---

and that's the whole page, bestie!! this one came to you courtesy of Red Hat, Inc., with a version date of January 2024, and the manual name is autotailor(8) in case you forgot already (you didn't, you're doing amazing). go tailor something iconic. 💅💖✨