Install the scap-security-guide Package
Ensures the scap-security-guide package (SCAP hardening content) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
The scap-security-guide package ships SCAP-format hardening content (datastreams, profiles and remediation scripts) that maps generic policy requirements to concrete RHEL configuration, with references to government baselines where applicable. Having it installed lets administrators evaluate and remediate the system against recognised profiles using oscap or SCAP Workbench. Note: Pavois itself never runs oscap (it is blind to Includes and effective config); this rule simply ensures the reference content is available on the host for operators who rely on it.
What Pavois checks
Pavois queries the RPM database with describe package('scap-security-guide') and asserts it should be_installed. Reading the actual package state is exact, whereas looking for datastream files by path could be fooled by manually copied content.
describe package('scap-security-guide') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q scap-security-guide. Expected output: a versioned package name such as scap-security-guide-0.1.x-…. The content lives under /usr/share/xml/scap/ssg/content/.
Inspect & investigate
Installation is recorded by DNF/RPM: review dnf history or /var/log/dnf.rpm.log (filter with grep scap-security-guide). Confirm presence with rpm -q scap-security-guide.
Remediation
Pavois's harden plan installs the scap-security-guide package (resource package, action install). Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | scap-security-guide |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing reference content is low-risk: it adds documentation and SCAP datastreams but changes no running configuration. It does pull in dependencies and consumes some disk space. Installing the package does not by itself harden the system, an operator must still run a scan/remediation with the content.