Install openscap-scanner Package
Ensures the openscap-scanner package (the oscap SCAP compliance/vulnerability tool) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
The openscap-scanner package provides the oscap command-line tool, a configuration and vulnerability scanner capable of performing compliance checking using SCAP content. Having it installed lets the host participate in automated, repeatable security baselines and vulnerability assessments. (Note: Pavois itself audits the effective configuration with CINC/InSpec and never uses oscap as an engine, this control simply ensures the tooling required by RHEL benchmarks is present.)
What Pavois checks
Pavois asks the package manager whether openscap-scanner is installed via the InSpec package resource (effectively rpm -q openscap-scanner). Querying installed-package state directly confirms the oscap binary is actually present, rather than assuming it from the existence of SCAP data streams on disk.
describe package('openscap-scanner') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q openscap-scanner. The expected output is a versioned package name such as openscap-scanner-1.3.x-.... The tool can then be confirmed with oscap --version.
Inspect & investigate
rpm -q openscap-scanner, confirms the package is installed.rpm -qi openscap-scanner, shows install date and source repository.oscap --version, proves the scanner binary runs.
Remediation
Pavois's harden plan declares a package resource for openscap-scanner with action install and applies it with pavois harden apply, which runs dnf install openscap-scanner under the hood. No service restart is required.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | openscap-scanner |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing openscap-scanner is non-disruptive: it only adds a scanning tool and changes no running service, so there is essentially no rollback risk. The only considerations are the disk footprint and pulling SCAP content (e.g. scap-security-guide) separately if you intend to run scans.