sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

agent: query chrony over loopback UDP command socket (unix socket unusable under sandbox)

Browse Source 
Root cause of the blank chrony fields (found on comet-beacon-54): chrony 4.x
(RHEL 9) defaults its command interface to the UNIX socket only
(/run/chrony/chronyd.sock), usable by root or the chrony group with a writable
/run/chrony. The fleet-agent unit is hardened — DynamicUser (group tss, not
chrony) + ProtectSystem=strict (/run read-only) — so it cannot open the unix
socket nor create chronyc's reply socket. Bench proof: normal-user 'chronyc
tracking' -> 506 Cannot talk to daemon; only sudo worked; 'chronyc -h 127.0.0.1'
failed and ss showed no UDP :323. So the probe always failed and every chrony_*
field stayed empty. SELinux permissive did NOT help — it was never (only) an
SELinux problem; the nnp_transition module (prev commit) is still needed for the
enforcing exec transition.

Fix: bind chronyd's command socket on 127.0.0.1 (bindcmdaddress in chrony.conf,
idempotent in the 2c provisioner) and point the probe at it (chronyc -n -h
127.0.0.1 tracking). UDP needs no fs write or group and rides the unit's
already-allowed AF_INET. Loopback + monitoring-only (state changes still need the
root unix socket), so exposure is minimal. Rejected the unix-socket route (chrony
group + ReadWritePaths=/run/chrony) because /run/chrony is 0750 (group has no
write). Documented in docs/stig-deviations.md #17; .te bench note updated for the
enforcing UDP path. Needs a workstation image rebuild + reboot.
This commit is contained in:
Audiobuzz
2026-07-10 09:02:05 +00:00
parent e6fd4a2dde
commit 394ad10824
4 changed files with 71 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/fleet-agent-chronyc.te
+10 -4
View File
@@ -23,10 +23,16 @@ module fleet_agent_chronyc 1.0.0;
# This single allow lets the transition proceed to the MORE-confined chronyc_t
# domain (the safe direction NNP's nnp_transition permission exists to gate), with
# no loosening of the agent's own sandbox. Minimal + auditable; justified in
# docs/stig-deviations.md. BENCH-VERIFY: after this, the manager's Monitor chrony
# row populates (offset/source/stratum). If a FOLLOW-ON chronyc_t AVC appears on
# the bench (e.g. reaching chronyd's socket under the agent's mount namespace),
# extend here.
# docs/stig-deviations.md #16.
#
# NB this is necessary but NOT sufficient: the agent reaches chronyd over the
# LOOPBACK UDP command socket (`chronyc -h 127.0.0.1 tracking`; the image binds it
# via `bindcmdaddress 127.0.0.1`, see stig-deviations #17) because the unix socket
# is unusable under the agent's sandbox. Under enforcing, once chronyc runs in
# chronyc_t it must also be allowed to reach chronyd_t on UDP 323 — the base chrony
# policy is expected to cover chronyc_t's command traffic, but BENCH-VERIFY on the
# first enforcing boot and, if a FOLLOW-ON chronyc_t AVC appears (e.g. a corenet
# udp_socket/name_connect denial to chronyd), extend here.
########################################
require {