Name: cockpit-scap Version: 3.5 Release: 1%{?dist} Summary: Cockpit module for SCAP compliance scanning and tailoring on RHEL License: GPL-2.0-or-later URL: https://github.com/pbuchan-rh/cockpit-scap Source0: https://github.com/pbuchan-rh/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz BuildArch: noarch Requires: cockpit >= 344 Requires(post): policycoreutils-python-utils Recommends: openscap-scanner Recommends: scap-security-guide Recommends: openscap-utils %description cockpit-scap is a native Cockpit module that brings OpenSCAP compliance scanning, profile tailoring, and selective remediation directly into the browser console RHEL administrators already use. - Host and container image scanning on demand; configurable history retention per scan type; regression and improvement detection; CSV export - Selective Remediation Builder: filter and cherry-pick failing rules; download bash or Ansible scripts; or Apply Now directly on the host with two-gate confirmation and full audit trail - Profile tailoring editor: rule tree with enable/disable, variable adjustment, and saved XCCDF tailoring files; upload and download - Activity log with systemd journal integration; admin-gated privileged operations; full SELinux enforcing mode support %prep %autosetup %build # nothing to build — vanilla JS module %check # No automated build-time tests for a vanilla JS Cockpit module. # Runtime integration tests require a live Cockpit + RHEL environment. %install # Module files → /usr/share/cockpit/cockpit-scap/ install -d -m 755 %{buildroot}%{_datadir}/cockpit/%{name} install -m 644 src/index.html src/index.js src/container-scan.js src/dashboard.js src/style.css src/manifest.json src/viewer.html \ %{buildroot}%{_datadir}/cockpit/%{name}/ # SELinux file context definitions (shipped as a formal deliverable) install -d -m 755 %{buildroot}%{_datadir}/%{name}/selinux install -m 644 selinux/cockpit-scap.fc \ %{buildroot}%{_datadir}/%{name}/selinux/ # Runtime directories — created here so %%post restorecon has paths to label install -d -m 755 %{buildroot}/var/lib/%{name} install -d -m 755 %{buildroot}/var/lib/%{name}/results install -d -m 755 %{buildroot}/var/lib/%{name}/tailoring install -d -m 755 %{buildroot}/var/lib/%{name}/content install -d -m 755 %{buildroot}/var/lib/%{name}/remediation-logs %post # Set SELinux file context for /var/lib/cockpit-scap/ and apply it if semanage fcontext -a -t cockpit_var_lib_t '/var/lib/cockpit-scap(/.*)?' 2>/dev/null || \ semanage fcontext -m -t cockpit_var_lib_t '/var/lib/cockpit-scap(/.*)?'; then restorecon -Rv /var/lib/cockpit-scap || true else echo "WARNING: Failed to configure SELinux context for /var/lib/cockpit-scap/" >&2 echo "WARNING: Run manually: semanage fcontext -a -t cockpit_var_lib_t '/var/lib/cockpit-scap(/.*)?'" >&2 echo "WARNING: Then run: restorecon -Rv /var/lib/cockpit-scap" >&2 fi %postun # Remove the fcontext entry only on full uninstall, not on upgrade if [ $1 -eq 0 ]; then semanage fcontext -d '/var/lib/cockpit-scap(/.*)?' 2>/dev/null || true fi %files %license LICENSE %doc README.md %{_datadir}/cockpit/%{name}/ %{_datadir}/%{name}/ %dir /var/lib/%{name} %dir /var/lib/%{name}/results %dir /var/lib/%{name}/tailoring %dir /var/lib/%{name}/content %dir /var/lib/%{name}/remediation-logs %changelog * Mon Jun 01 2026 Peter Buchan - 3.5-1 - Apply Now: two-gate danger confirmation, live streaming bash output, admin-gated with full remediation audit log (structured log file, systemd journal entry, Activity tab View Log link) - Settings tab: scan result retention per type, tab visibility toggle, admin-gated and activity-logged - Activity log user field: all entries record the authenticated user - Selective Remediation Builder: search/filter by title or rule ID; inline rule description and rationale expansion - Container scan limited access: history visible and View Scan works without admin elevation - Remediate from history loads scan results first (host scan parity) - Large file downloads: max_read_size bypass for files over 15 MB - Stale cache fixes: tailoring/content cross-notify after save/delete - Admin gate audit: all privileged UI actions gated and tooltip-annotated - Security hardening: remediation log path validation - Dashboard hero card: weighted risk score, severity breakdown, async HIGH severity failure names - Platform: broadened support references to CentOS Stream 10 * Sun May 31 2026 Peter Buchan - 3.4-1 - Compliance Dashboard: per-profile cards with score sparkline (trend over time), Quick Scan one-click re-run, View Last Scan navigation, Needs Attention banner (regressions + stale profiles), staleness badges - SDS file upload: browser file picker writes directly to content library; overwrite confirmation shows existing file size and date; confirmed working up to 26 MB through Cockpit bridge - Admin gate: upload and delete operations disabled for non-admin sessions via cockpit.permission; clear tooltip feedback; Container Scan tab shows actionable guidance in limited access mode - Failing rules summary: collapsible HIGH/MEDIUM/LOW groups; CCE identifiers; Automated/Manual remediation annotation; inline description and rationale expansion via
/ - Regression and improvement detection: banner fires automatically comparing same profile; "See what changed" diffs two results.xml files showing Fixed/Regressed/New rule groups - Compliance score visualization with pass/fail/error counts and timestamp - View Scan from history loads full results card; Run Again on results card - Unified single-card scan configuration layout on all three scan tabs - Content Library: Size and Modified columns on uploaded content table - Code review and security audit: path traversal hardening, timestamp re-validation on rm paths, dead code removal, CSS consistency fixes * Sun May 31 2026 Peter Buchan - 3.3-1 - Selective Remediation Builder: after any scan, choose individual failing rules before downloading bash or Ansible remediation scripts; rules grouped HIGH/MEDIUM/LOW with per-group and global select/deselect; available for both host scans and container image scans - Results XML download: "Download Results XML" button on scan results and history rows for both host and container scans - Compliance Dashboard (preview): hostname, score delta vs previous scan, cached load with manual Refresh button, per-image container cards - Activity log: semantic badge colors (red=delete/error, orange=remediation, blue=scan, teal=tailoring, yellow=validate); tailor download logging - Tailoring Update-in-place: "Update" overwrites existing file; "Save as New" creates timestamped copy - Tailoring inline name field: pencil icon and editable name in editor header - Container scan: eager parallel prereq checks at module init for instant tab - Host scan history table: full-width layout fix * Sat May 30 2026 Peter Buchan - 3.2-1 - Activity tab: real-time log of all oscap actions (scans, guide generation, content validation, tailoring operations); auto-refresh every 3 seconds; filter by action type; clear log; log capped at 1000 entries - src/ restructure: module source files moved to src/ subdirectory * Sat May 30 2026 Peter Buchan - 3.1-1 - Run Again action on host and container scan history rows; pre-fills content, profile, and tailoring file from scan manifest - View Guide button on Host Scan, Container Scan, and Tailoring tabs; generates oscap security guide directly from profile selection - Export CSV for host and container scan history; includes all manifest fields including image info for container scans - Content validation: per-file Validate button on uploaded content using oscap ds sds-validate with inline pass/fail and error detail modal - Community files: CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue templates - History rewrite: clean author identity throughout, private docs removed * Sat May 30 2026 Peter Buchan - 3.0-1 - Container image scanning via oscap-podman: image enumeration from root Podman store, version mismatch detection, per-image scan history - Per-type scan history pruning: host and container scans each retain up to 10 entries independently - Server-side XML parsing for results (fixes large file WebSocket limit) - Code review hardening: stale tailoring selector fix, remediation path fix, pruneHistoryByType, manifest tools key fix for nav highlight * Fri May 29 2026 Peter Buchan - 2.1-1 - Dark mode: full prefers-color-scheme and Cockpit theme toggle support, all colors matched to PatternFly 6 dark token chain - Results footer: cleaned up Apply Remediation stub, New Scan separated - UI polish: native Cockpit layout alignment, single-panel design * Fri May 29 2026 Peter Buchan - 2.0-1 - Initial package release - v2.0: content tab, multi-version SDS support, CPE compatibility detection, satellite content staging, uploaded-content security warnings