Use oscap with pcs-hardening not remediation script and turn off bin/fail
2023-07-27T18:31:22
The remediation script:
/usr/share/scap-security-guide/bash/sle15-script-pcs-hardening.sh
blindly applies remediation even if it is not needed
using:
oscap xccdf eval --remediate --profile pcs-hardening /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
is better, since it will only attempt to apply remediation when needed.
Do not execute /bin/fail if the oscap command returns an error.
This allows builds to complete even if remediation returns
and error