CIS RHEL 9 — Rego Policies for OPA

21 open-source Rego policies encoding CIS Benchmark for Red Hat Enterprise Linux 9. Apache 2.0, Rego v1, ready to load into OPA or Enterprise OPA.

What this is

21 Rego policy files encoding CIS Benchmark for Red Hat Enterprise Linux 9, part of the Rego Policy Libraries — a standalone, dependency-free collection of Open Policy Agent policies for published security and compliance standards. No orchestrator, no agent, no vendor runtime.

Load and query it

git clone https://github.com/ynotbhatc/rego_policy_libraries.git
opa eval -d rego_policy_libraries/benchmarks/cis/rhel_9 -f pretty 'data'

Or load into a running OPA:

for f in rego_policy_libraries/benchmarks/cis/rhel_9/*.rego; do
  curl -X PUT --data-binary @"$f" "$OPA/v1/policies/$(basename $f .rego)"
done

Two ways to use these policies

Gating a change of state — evaluate a proposed action before it proceeds, and refuse it if it violates the standard. Measuring state — evaluate collected facts about an environment against the standard to produce compliance evidence. The same policy content serves both; only the integration differs.

Policy modules

Contributing

Test coverage is published in COVERAGE.md, and uncovered policies are the best first contribution — each is small, self-contained, and either passes opa test or does not. See CONTRIBUTING.md.

Links