├── .github
    └── workflows
    │   ├── build.yml
    │   └── cron.yml
├── Makefile
├── README.md
├── rhel8-playbook-stig.yml
├── rhel8-script-stig.sh
├── srg-to-csv.xslt
├── ssg-rhel8-ds-1.2.xml
├── ssg-rhel8-ds.xml
├── ssg-rhel8-guide-stig.html
├── table-rhel8-srgmap-flat.csv
└── table-rhel8-srgmap-flat.html


/.github/workflows/build.yml:
--------------------------------------------------------------------------------
 1 | name: Build
 2 | on: [push]
 3 | jobs:
 4 |   build:
 5 |     name: build
 6 |     runs-on: ubuntu-latest
 7 |     steps:
 8 |       - uses: actions/checkout@v1
 9 |       - name: Install dependencies
10 |         uses: mstksg/get-package@master
11 |         with:
12 |                 apt-get: make expat libopenscap8 libxml2-utils ninja-build python3-jinja2 python3-yaml xsltproc
13 |       - name: Make
14 |         run: |
15 |           make clean all
16 |       - name: Create Pull Request
17 |         uses: peter-evans/create-pull-request@v3.14.0
18 |         with:
19 |           token: ${{ secrets.GITHUB_TOKEN }}
20 |           commit-message: Automated content rebuild
21 |           title: 'Automated build of ComplianceAsContent/content rhel8'
22 |           body: |
23 |             Automated content re-build.
24 |           committer: Github Actions Automation <isimluk@fedorapeople.org>
25 |           author: Github Actions Automation <isimluk@fedorapeople.org>
26 |           branch: update-rebuild
27 |           branch-suffix: short-commit-hash
28 |           reviewers: isimluk
29 |           base: master
30 |       - name: Check output environment variable
31 |         run: echo "Pull Request Number - $PULL_REQUEST_NUMBER"
32 | 


--------------------------------------------------------------------------------
/.github/workflows/cron.yml:
--------------------------------------------------------------------------------
 1 | name: Cron
 2 | on:
 3 |   schedule:
 4 |   - cron: "0 0 * * *"
 5 | jobs:
 6 |   build:
 7 |     name: cron
 8 |     runs-on: ubuntu-latest
 9 |     steps:
10 |       - uses: actions/checkout@v1
11 |       - name: Install dependencies
12 |         uses: mstksg/get-package@master
13 |         with:
14 |                 apt-get: make expat libopenscap8 libxml2-utils ninja-build python3-jinja2 python3-yaml xsltproc
15 |       - name: Make
16 |         run: |
17 |           make clean all
18 |       - name: Push to master
19 |         uses: mikeal/publish-to-github-action@master
20 |         env:
21 |            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
22 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | .PHONY: clean
 2 | all: content
 3 | 	(cd content; ./build_product rhel8)
 4 | 	/usr/bin/xsltproc --stringparam map-to-items content/build/rhel8/xccdf-linked-srg-overlay.xml  --stringparam ocil-document content/build/rhel8/ocil-linked.xml --output table-rhel8-srgmap-flat.csv srg-to-csv.xslt content/shared/references/disa-os-srg-v2r3.xml
 5 | 	cp ./content/build/guides/ssg-rhel8-guide-stig.html ./content/build/ssg-rhel8-ds.xml ./content/build/ssg-rhel8-ds-1.2.xml content/build/ansible/rhel8-playbook-stig.yml content/build/bash/rhel8-script-stig.sh content/build/tables/table-rhel8-srgmap-flat.html ./
 6 | 	rm -rf content/
 7 | 
 8 | clean:
 9 | 	rm -rf content/
10 | 
11 | content:
12 | 	git clone --depth 1 https://github.com/ComplianceAsCode/content
13 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Latest STIG for Red Hat Enterprise Linux 8
 2 | 
 3 | Periodic automated re-build of [ComplianceAsCode](https://github.com/ComplianceAsCode/content) project.
 4 | 
 5 | Preview 
 6 |  * [Implementation Guide](http://htmlpreview.github.io/?https://github.com/isimluk/rhel8-stig-latest/blob/master/ssg-rhel8-guide-stig.html)
 7 |  * SRG Mapping Table: [HTML](http://htmlpreview.github.io/?https://github.com/isimluk/rhel8-stig-latest/blob/master/table-rhel8-srgmap-flat.html), [CSV](https://raw.githubusercontent.com/isimluk/rhel8-stig-latest/master/table-rhel8-srgmap-flat.csv)
 8 | 
 9 | Or download:
10 |  * SCAP DataStream: [version 1.3](https://raw.githubusercontent.com/isimluk/rhel8-stig-latest/master/ssg-rhel8-ds.xml), [version 1.2](https://raw.githubusercontent.com/isimluk/rhel8-stig-latest/master/ssg-rhel8-ds-1.2.xml)
11 |  * [Ansible Playbook](https://raw.githubusercontent.com/isimluk/rhel8-stig-latest/master/rhel8-playbook-stig.yml)
12 |  * [Configuration shell script](https://github.com/isimluk/rhel8-stig-latest/blob/master/rhel8-script-stig.sh)
13 | 


--------------------------------------------------------------------------------
/srg-to-csv.xslt:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8" standalone="yes"?>
  2 | <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:ocil2="http://scap.nist.gov/schema/ocil/2.0" xmlns:csv="csv:csv">
  3 |   <xsl:output method="text" encoding="iso-8859-1"/>
  4 | 
  5 |   <xsl:variable name="selectedRules" select="document($map-to-items)//*[cdf:reference]" />
  6 |   <xsl:variable name="title" select="document($map-to-items)/cdf:Benchmark/cdf:title" />
  7 |   <xsl:param name="ocil-document" select="''"/>
  8 |   <xsl:variable name="ocil" select="document($ocil-document)/ocil2:ocil"/>
  9 | 
 10 |   <xsl:variable name="delimiter" select="','" />
 11 |   <xsl:variable name="newLine" select="'&#xa;'" />
 12 |   <xsl:variable name="disa-ossrguri">https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os</xsl:variable>
 13 |   <xsl:variable name="disa-srguri" select="$disa-ossrguri"/>
 14 | 
 15 | 
 16 |   <csv:columns>
 17 |     <column>CCI</column>
 18 |     <column>SRGID</column>
 19 |     <column>STIGID</column>
 20 |     <column>SRG Requirement</column>
 21 |     <column>Requirement</column>
 22 |     <column>SRG VulDiscussion</column>
 23 |     <column>VulDiscussion</column>
 24 |     <column>Status</column>
 25 |     <column>SRG Check</column>
 26 |     <column>Check</column>
 27 |     <column>SRG Fix</column>
 28 |     <column>Fix</column>
 29 |     <column>Severity</column>
 30 |     <column>Mitigation</column>
 31 |     <column>Artifact Description</column>
 32 |     <column>Status Justification</column>
 33 |   </csv:columns>
 34 | 
 35 | 	<xsl:template match="/">
 36 |     <!-- Output the CSV header -->
 37 |     <xsl:for-each select="document('')/*/csv:columns/*">
 38 |       <xsl:value-of select="."/>
 39 |       <xsl:if test="position() != last()">
 40 |         <xsl:value-of select="$delimiter"/>
 41 |       </xsl:if>
 42 |     </xsl:for-each>
 43 | 
 44 |     <xsl:value-of select="$newLine"/>
 45 |     <xsl:apply-templates select=".//cdf:Rule" />
 46 |   </xsl:template>
 47 | 
 48 |   <xsl:template match="cdf:Rule">
 49 |     <xsl:variable name="disaRule" select="."/>
 50 | 	  <xsl:variable name="currSrg" select="cdf:version"/>
 51 |     <xsl:variable name="relevantRules" select="$selectedRules[cdf:reference[@href=$disa-srguri and text()=$currSrg]]"/>
 52 | 
 53 |     <xsl:choose>
 54 |       <xsl:when test="$relevantRules">
 55 |         <xsl:for-each select="$relevantRules">
 56 |           <xsl:call-template name="dataRow">
 57 |             <xsl:with-param name="disaRule" select="$disaRule"/>
 58 |             <xsl:with-param name="ssgRule" select="."/>
 59 |           </xsl:call-template>
 60 |         </xsl:for-each>
 61 |       </xsl:when>
 62 |       <xsl:otherwise>
 63 | 	      <xsl:call-template name="dataRow">
 64 |           <xsl:with-param name="disaRule" select="$disaRule"/>
 65 |             <!-- when ssg Rule is missing, we just print out data from original DISA XCCDF -->
 66 |             <xsl:with-param name="ssgRule" select="$disaRule"/>
 67 |         </xsl:call-template>
 68 |       </xsl:otherwise>
 69 |     </xsl:choose>
 70 |   </xsl:template>
 71 | 
 72 |   <xsl:template name="dataRow">
 73 |     <xsl:param name="disaRule"/>
 74 |     <xsl:param name="ssgRule"/>
 75 | 
 76 |     <xsl:for-each select="document('')/*/csv:columns/*">
 77 |       <!-- Extract the column name and value -->
 78 |       <xsl:variable name="column" select="."/>
 79 |       <xsl:variable name="value">
 80 |          <xsl:choose>
 81 |             <xsl:when test="$column='CCI'">
 82 |               <xsl:value-of select="$disaRule/cdf:ident"/>
 83 |             </xsl:when>
 84 |             <xsl:when test="$column='SRGID'">
 85 |               <xsl:value-of select="$disaRule/cdf:version"/>
 86 |             </xsl:when>
 87 |             <xsl:when test="$column='STIGID'">
 88 |               <xsl:value-of select="'TBD - Assigned by DISA after STIG release'"/>
 89 |             </xsl:when>
 90 |             <xsl:when test="$column='SRG Requirement'">
 91 |               <xsl:value-of select="$disaRule/cdf:title"/>
 92 |             </xsl:when>
 93 |             <xsl:when test="$column='Requirement'">
 94 |               <xsl:if test="$ssgRule/cdf:ident"><xsl:value-of select="$ssgRule/cdf:ident"/>:</xsl:if>
 95 |               <xsl:value-of select="$ssgRule/cdf:title"/>
 96 |             </xsl:when>
 97 |             <xsl:when test="$column='SRG VulDiscussion'">
 98 |               <xsl:variable name="desc" select="$disaRule/cdf:description"/>
 99 |               <xsl:variable name="desc_info" select="substring-before($desc, '&lt;/VulnDiscussion&gt;')"/>
100 |               <xsl:value-of select="substring-after($desc_info, '&lt;VulnDiscussion&gt;')"/>
101 |             </xsl:when>
102 |             <xsl:when test="$column='VulDiscussion'">
103 |               <xsl:value-of select="$ssgRule/cdf:description"/>
104 |             </xsl:when>
105 |             <xsl:when test="$column='Status'">
106 |               <xsl:choose>
107 | 								<xsl:when test="contains($ssgRule/@id, 'met_inherently_')">
108 |                   Applicable - Inherently Meets
109 |                 </xsl:when>
110 |                 <xsl:when test="contains($ssgRule/@id, '-overlay-')">
111 |                   N/A
112 |                 </xsl:when>
113 |                 <xsl:otherwise>
114 |                   Applicable - Configurable
115 |                 </xsl:otherwise>
116 |               </xsl:choose>
117 |             </xsl:when>
118 |             <xsl:when test="$column='SRG Check'">
119 | 							<xsl:apply-templates select="$disaRule/cdf:check/cdf:check-content"/>
120 |             </xsl:when>
121 |             <xsl:when test="$column='Check'">
122 | 							<xsl:apply-templates select="$ssgRule/cdf:check[@system='http://scap.nist.gov/schema/ocil/2']"/>
123 |             </xsl:when>
124 |             <xsl:when test="$column='SRG Fix'">
125 | 							<xsl:apply-templates select="$disaRule/cdf:fixtext"/>
126 |             </xsl:when>
127 |             <xsl:when test="$column='Fix'">
128 |               <xsl:value-of select="$ssgRule/cdf:description"/>
129 |             </xsl:when>
130 |             <xsl:when test="$column='Severity'">
131 |               <xsl:value-of select="$ssgRule/cdf:severity"/>
132 |             </xsl:when>
133 |           </xsl:choose>
134 |       </xsl:variable>
135 | 
136 |       <!-- Quote the value if required -->
137 |       <xsl:choose>
138 |         <xsl:when test="contains($value, '&quot;')">
139 |           <xsl:variable name="x">
140 |             <xsl:call-template name="string-replace-all">
141 |               <xsl:with-param name="text" select="$value"/>
142 |               <xsl:with-param name="replace" select="'&quot;'"/>
143 |               <xsl:with-param name="by" select="'&quot;&quot;'"/>
144 |             </xsl:call-template>
145 |           </xsl:variable>
146 |           <xsl:value-of select="concat('&quot;', $x, '&quot;')"/>
147 |         </xsl:when>
148 |         <xsl:when test="contains($value, $newLine)">
149 |           <xsl:value-of select="concat('&quot;', $value, '&quot;')"/>
150 |         </xsl:when>
151 |         <xsl:when test="contains($value, $delimiter)">
152 |           <xsl:value-of select="concat('&quot;', $value, '&quot;')"/>
153 |         </xsl:when>
154 |         <xsl:otherwise>
155 |           <xsl:value-of select="$value"/>
156 |         </xsl:otherwise>
157 |       </xsl:choose>
158 | 
159 |       <!-- Add the delimiter unless we are the last expression -->
160 |       <xsl:if test="position() != last()">
161 |         <xsl:value-of select="$delimiter"/>
162 |       </xsl:if>
163 |     </xsl:for-each>
164 |     <xsl:value-of select="$newLine"/>
165 |   </xsl:template>
166 | 
167 | 	<xsl:template match="@*|node()">
168 | 		<xsl:copy>
169 | 			<xsl:apply-templates select="@*|node()"/>
170 | 		</xsl:copy>
171 | 	</xsl:template>
172 | 
173 | 	<xsl:template match="cdf:check-content">
174 | 		<xsl:apply-templates select="@*|node()" />
175 | 	</xsl:template>
176 | 
177 | 	<xsl:template match="cdf:check[@system='http://scap.nist.gov/schema/ocil/2']">
178 | 		<xsl:variable name="questionaireId" select="cdf:check-content-ref/@name"/>
179 | 		<xsl:variable name="questionaire" select="$ocil/ocil2:questionnaires/ocil2:questionnaire[@id=$questionaireId]"/>
180 | 		<xsl:variable name="testActionRef" select="$questionaire/ocil2:actions/ocil2:test_action_ref/text()"/>
181 | 		<xsl:variable name="questionRef" select="$ocil/ocil2:test_actions/*[@id=$testActionRef]/@question_ref"/>
182 | 		<xsl:value-of select="$ocil/ocil2:questions/ocil2:*[@id=$questionRef]/ocil2:question_text"/>
183 | 	</xsl:template>
184 | 
185 | 	<xsl:template name="extract-vulndiscussion">
186 | 		<xsl:param name="desc"/>
187 | 		<xsl:variable name="desc_info" select="substring-before($desc, '&lt;/VulnDiscussion&gt;')"/>
188 | 		<xsl:value-of select="substring-after($desc_info, '&lt;VulnDiscussion&gt;')"/>
189 | 	</xsl:template>
190 | 
191 |   <xsl:template name="string-replace-all">
192 |     <xsl:param name="text"/>
193 |     <xsl:param name="replace"/>
194 |     <xsl:param name="by"/>
195 |     <xsl:choose>
196 |       <xsl:when test="contains($text,$replace)">
197 |         <xsl:value-of select="substring-before($text,$replace)"/>
198 |         <xsl:value-of select="$by"/>
199 |         <xsl:call-template name="string-replace-all">
200 |           <xsl:with-param name="text" select="substring-after($text,$replace)"/>
201 |           <xsl:with-param name="replace" select="$replace"/>
202 |           <xsl:with-param name="by" select="$by"/>
203 |         </xsl:call-template>
204 |       </xsl:when>
205 |       <xsl:otherwise>
206 |         <xsl:value-of select="$text"/>
207 |       </xsl:otherwise>
208 |     </xsl:choose>
209 |   </xsl:template>
210 | </xsl:stylesheet>
211 | 


--------------------------------------------------------------------------------