Merge in main

files/stig/fapolicyd-tmpfs.te

@@ -0,0 +1,31 @@
+# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
+# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
+# Makefile and checkmodule rejects it. See chrony-dhcp-dispatcher.te for the why.
+module fapolicyd_tmpfs 1.0.0;
+
+########################################
+# Let fapolicyd statfs (getattr) tmpfs filesystems.
+#
+# fapolicyd is the app-allowlisting EXEC GUARD for the writable RAM overlay:
+# dm-verity covers only the read-only erofs lower, so an executable dropped into
+# the tmpfs overlay upper is exactly what fapolicyd must catch. fapolicyd statfs's
+# mounts to decide which to watch, and tmpfs is in its default watch_fs. This
+# host's root is `systemd.volatile=overlay`, so statfs("/") returns the overlay
+# UPPER — a tmpfs (the audit shows dev=tmpfs ino=1, name="/") — and the shipped
+# policy has no `fapolicyd_t tmpfs_t:filesystem getattr` rule (no normal host has
+# its root on tmpfs). Result under enforcing: the getattr is DENIED, fapolicyd
+# cannot fully mark the tmpfs mounts (/, /tmp, /dev/shm), and its guard over the
+# writable overlay is incomplete — a real exec-guard gap, not just SIEM noise.
+# This single allow closes it. Minimal + auditable; justified in
+# docs/stig-deviations.md. BENCH-VERIFY: after this, fapolicyd blocks a non-RPM
+# executable dropped in /tmp (the overlay). If a follow-on fapolicyd AVC on the
+# overlay appears on the bench, extend here.
+########################################
+
+require {
+    type fapolicyd_t;
+    type tmpfs_t;
+    class filesystem getattr;
+}
+
+allow fapolicyd_t tmpfs_t:filesystem getattr;