From 4a8143d0bcad473e0f7147c0463bbfb44d35e3ca Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Fri, 3 Jul 2026 01:22:20 +0000
Subject: [PATCH] build: remove + mask firewalld (kickstart excludes it;
 weak-dep reinstall caused AVC flood)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

http/ks.cfg excludes firewalld (-firewalld) and sets firewall --disabled — the
fleet's security boundary is the network (802.1X/MACsec + switch); the host
firewall is a documented OFF item (stig-deviations #4). But a provisioner dnf
pulled firewalld back as a weak dep (Recommends) and it starts by default. Its
Python then tries to rewrite site-package .pyc bytecode, which the reproducible
erofs -T 0 mtime reset makes look stale, so firewalld_t gets write/unlink AVCs
on lib_t that flood the SIEM.

Remove firewalld in 2d hygiene (weak dep, nothing hard-needs it) and mask it as
a backstop against future weak-dep reinstalls. No firewalld => no daemon, no
AVC, matches the kickstart intent.
---
 diskless.pkr.hcl | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 4e5fc87..a0855ad 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -867,6 +867,17 @@ build {
       # already downloaded to the host) — slims the erofs + cuts attack surface.
       # Keep auditd (it's part of the hardened runtime). Best-effort.
       "dnf remove -y openscap-scanner scap-security-guide openscap-utils 2>/dev/null || true",
+      # firewalld: the kickstart EXCLUDES it (-firewalld, firewall --disabled) —
+      # this fleet uses network-layer security (802.1X/MACsec + switch); the host
+      # firewall is a documented OFF item (docs/stig-deviations.md #4). But a
+      # provisioner dnf pulled it back as a WEAK dep (Recommends) and, once
+      # installed, it starts by default. Its Python then tries to rewrite
+      # site-package .pyc bytecode — which the reproducible erofs `-T 0` mtime
+      # reset makes look stale — so firewalld_t gets write/unlink AVCs on lib_t
+      # that flood the SIEM (seen 2026-07-03). Remove it (weak dep, nothing
+      # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
+      "dnf remove -y firewalld 2>/dev/null || true",
+      "systemctl mask firewalld.service 2>/dev/null || true",
       # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
       # the VM on the CI runner and file-provisioned in as static binaries.)
       # The build-time STIG reports must not ship inside the read-only rootfs.