--- name: "autotailor" section: "8" platform: "linux" package: "openscap" version: "1.4.5-2" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/autotailor" --- # autotailor(8) CLI tool for tailoring of SCAP data streams. ## NAME autotailor - CLI tool for tailoring of SCAP data streams. ## DESCRIPTION The autotailor tool produces tailoring files that SCAP-compliant scanners can use to complement SCAP data streams. A tailoring file adds a new profile, which is supposed to extend a profile that is already present in the data stream. Tailoring can add, remove or refine rules, and it also can redefine contents of XCCDF variables. The tool requires data stream location and ID of the base profile as inputs. By default, the tool parses the referenced data stream and validates provided IDs (profiles, rules, values, groups, and selectors) against it. Validation can be skipped using the **--no-validate** option, which significantly speeds up execution on large data streams at the cost of no longer catching invalid IDs. ## SYNOPSIS autotailor \[OPTION...\] DATASTREAM\_FILE \[BASE\_PROFILE\_ID\] ## OPTIONS - **--title TITLE** Title of the new profile. - **--id-namespace ID\_NAMESPACE** The reverse-DNS style string that is part of entities IDs in the corresponding data stream. If left out, the default value 'org.ssgproject.content' is used. - **-v VAR=VALUE, --var-value VAR=VALUE** Specify modification of the XCCDF value in form \=\. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf\_\\_value' prefix will be prepended internally. Specify the argument multiple times if needed. - **-v VAR=SELECTOR, --var-value VAR=SELECTOR** Specify refinement of the XCCDF value in form \=\. Name of the variable can be either its full name, or the suffix, in which case the 'xccdf\_\\_value' prefix will be prepended internally. Specify the argument multiple times if needed. - **-r RULE=ROLE, --rule-role RULE=ROLE** Specify refinement of the XCCDF rule role in form \=\. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf\_\\_rule\_' prefix will be prepended internally. The value of \ can be one of full, unscored, unchecked. Specify the argument multiple times if needed. - **-e RULE=SEVERITY, --rule-severity RULE=SEVERITY** Specify refinement of the XCCDF rule severity in form \=\. Name of the rule can be either its full name, or the suffix, in which case the 'xccdf\_\\_rule\_' prefix will be prepended internally. The value of \ can be one of unknown, info, low, medium, high. Specify the argument multiple times if needed. - **-s RULE\_ID, --select RULE\_ID** Specify the rule to select. The rule ID can be either full, or just the suffix, in which case the 'xccdf\_\\_rule' prefix will be prepended internally. Specify the argument multiple times if needed. - **-u RULE\_ID, --unselect RULE\_ID** Specify the rule to unselect. The argument works the same way as the --select argument. - **-p TAILORED\_PROFILE\_ID, --tailored-profile-id TAILORED\_PROFILE\_ID** Specify the ID of the tailored profile. The ID of the new profile can be either its full ID, or the suffix, in which case the 'xccdf\_\\_profile\_' prefix will be prepended internally. If left out, the new ID will be obtained by appending '\_customized' to the tailored profile ID. - **--new-profile-id NEW\_PROFILE\_ID** Synonym of --tailored-profile-id. - **--json-tailoring JSON\_TAILORING\_FILE** Import tailoring from a JSON file (https://github.com/ComplianceAsCode/schemas/tree/main/tailoring). This option makes BASE\_PROFILE\_ID positional argument optional. However, data passed in the command line options takes precedence over JSON contents, including the BASE\_PROFILE\_ID argument. JSON tailoring can be accompanied with additional command-line options to either override contents of an existing profile (along with --tailored-profile-id identifier) or to create an extra profile (BASE\_PROFILE\_ID is a mandatory argument in this case and --tailored-profile-id is optional) in the resulting XCCDF tailoring file. - **--local-path** Use local path for the benchmark href instead of absolute file:// URI. This option is useful for compatibility with layered products like Red Hat Satellite that cannot resolve local filesystem paths. When this option is specified, absolute paths are converted to basename only, while relative paths are preserved as provided. By default, the tool uses absolute file:// URIs for backward compatibility. - **--no-validate** Skip validation of IDs against the data stream. This significantly speeds up execution on large data streams but may produce invalid tailoring files if incorrect IDs are provided. Use with caution. ## USAGE ### Modify a variable value $ autotailor --var-value xccdf\_org.ssgproject.content\_value\_var\_screensaver\_lock\_delay=120 -o tailoring.xml ssg-rhel8-ds.xml xccdf\_org.ssgproject.content\_profile\_pci\_dss The utility allows you to specify the ID namespace using the --namespace-id option, so you don't have to repeat the xccdf\_org.ssgproject.content\_... prefix everywhere. The default namespace ID is actually org.ssgproject.content, so the following invocations are equivalent to the first one: $ autotailor --var-value var\_screensaver\_lock\_delay=120 --namespace-id org.ssgproject.content -o tailoring.xml ssg-rhel8-ds.xml pci\_dss $ autotailor --var-value var\_screensaver\_lock\_delay=120 -o tailoring.xml ssg-rhel8-ds.xml pci\_dss The tailoring tailoring\_file defines a new profile, xccdf\_org.ssgproject.content\_profile\_pci\_dss\_customized, which alters the screensaver lock delay. ### Perform more modifications $ autotailor --var-value var\_screensaver\_lock\_delay=120 --select gconf\_gnome\_screensaver\_idle\_delay --var-value inactivity\_timeout\_value=600 ssg-rhel8-ds.xml pci\_dss ### Import JSON tailoring $ autotailor ssg-rhel8-ds.xml --json-tailoring tailoring.json ## REPORTING BUGS ``` Please report bugs using https://github.com/OpenSCAP/openscap/issues ``` ## AUTHORS ``` Matěj Týč Jan Černý Evgenii Kolesnikov ```