image: SELinux allow fleet-agent to read chrony tracking.log under enforcing

The tracking.log approach (4ca0b6d) works in permissive but is blocked under enforcing: chrony's log is labeled chronyd_var_log_t, confined by the shipped policy to chronyd_t despite the 0644 mode. Verified on comet-beacon-54 — a non-root read succeeds permissive, but under enforcing even a STIG-confined admin (staff_t) gets Permission denied (ls -Z on the file is itself blocked). The agent runs unconfined_service_t (confirmed via ps -eZ) and is denied the same way. Ship a minimal read-only allow module (files/stig/fleet-agent-chronylog.te): allow unconfined_service_t chronyd_var_log_t:file { open read getattr } + dir search to reach it. No write, no other chrony access, and no domain transition (the agent reads a file; it does not exec chronyc) — narrower than the abandoned nnp-transition module. Built + semodule -i'd in 2c-STIG alongside the existing chrony_dhcp_dispatcher / fapolicyd_tmpfs modules. docs/stig-deviations #16. Needs a workstation image rebuild + reboot; same policy-store-rebuild reproducibility re-check as #14/#15.
2026-07-10 09:57:34 +00:00
parent 8eb28c0a6b
commit 02a6621a19
3 changed files with 81 additions and 0 deletions
@@ -0,0 +1,35 @@
+# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
+# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
+# Makefile and checkmodule rejects it. See chrony-dhcp-dispatcher.te for the why.
+module fleet_agent_chronylog 1.0.0;
+
+########################################
+# Let the fleet-agent READ chrony's tracking log under enforcing SELinux.
+#
+# fleet-agent (telemetry) reports clock health (source/stratum/offset) by reading
+# /var/log/chrony/tracking.log (chronyd appends a line per clock update; enabled
+# via `log tracking`). The agent runs as unconfined_service_t. chrony's log dir +
+# files are labeled chronyd_var_log_t, and the shipped policy confines that type
+# to chronyd_t + log-admin roles — so although the file is mode 0644, under
+# enforcing the read is DENIED by type enforcement (DAC allows, TE does not).
+# Verified 2026-07-10 on comet-beacon-54: with SELinux enforcing even a
+# STIG-confined admin login (staff_t) gets "Permission denied" reading it, though
+# a permissive-mode read succeeds — the tell-tale of a type-enforcement block.
+#
+# This grants ONLY read (open/read/getattr) on the chrony log type plus dir search
+# to reach the file — no write, no other chrony access, and NO domain transition
+# (the agent reads a file; it does not exec chronyc). Minimal + auditable;
+# justified in docs/stig-deviations.md #16. BENCH-VERIFY: the manager's Monitor
+# chrony row populates on an enforcing boot; extend here only if a related chrony
+# log AVC appears. Same policy-store-rebuild reproducibility caveat as #14/#15.
+########################################
+
+require {
+    type unconfined_service_t;
+    type chronyd_var_log_t;
+    class dir { search getattr open };
+    class file { open read getattr };
+}
+
+allow unconfined_service_t chronyd_var_log_t:dir { search getattr open };
+allow unconfined_service_t chronyd_var_log_t:file { open read getattr };