agent: read chrony status from tracking.log instead of the command socket
Bench on comet-beacon-54 proved every command-socket route is blocked for the hardened agent: chronyd's unix socket is owner-write-only (0755, so even a chrony-group member can't connect), and STIG closes the UDP command port (cmdport 0). Rather than re-open a port or expose chrony's privileged socket, enable chronyd's tracking log and have the agent READ it — no port, no socket, no group, no SELinux domain transition, full hardening intact. - chrony.conf: enable 'log tracking' (idempotent) so chronyd appends source/stratum/offset to /var/log/chrony/tracking.log. Write volume is a ~130B line per clock update (backing off to ~maxpoll when stable) and capped by the chrony RPM's logrotate — negligible on the RAM overlay. cmdport 0 stays, so no STIG deviation. - agent: chronyTracking() now reads the last data line of tracking.log via parseTrackingLog() (source f[2], stratum f[3], offset f[6], leap/sync f[7]); replaces the chronyc exec + parseChrony. Unit test swapped accordingly. - revert the two abandoned approaches: drop the bindcmdaddress line (394ad10) and the fleet_agent_chronyc SELinux nnp_transition module + provisioner block (e6fd4a2, .te deleted) — no chronyc exec means no transition to allow. Removed stig-deviations #16 and #17 (both waivers no longer needed). Needs a workstation image rebuild + reboot. BENCH-VERIFY: tracking.log is world-readable so the DynamicUser agent can read it; under enforcing unconfined_service_t can read chronyd_var_log_t (add a minimal file-read allow if denied); and the offset sign matches chronyc on a synced host.
This commit is contained in:
Audiobuzz
+50
-50
@@ -295,7 +295,7 @@ func selinuxState() string {
|
||||
return "permissive"
|
||||
}
|
||||
|
||||
// chrony holds the parsed `chronyc tracking` fields relative to the NTP source.
|
||||
// chrony holds the parsed chrony tracking fields relative to the NTP source.
|
||||
type chrony struct {
|
||||
state string // synced|unsynced|"" (unavailable)
|
||||
offset float64 // system time offset from NTP, seconds (signed: fast=+, slow=-)
|
||||
@@ -303,65 +303,65 @@ type chrony struct {
|
||||
stratum int32 // hops from a reference clock
|
||||
}
|
||||
|
||||
// chronyTracking runs `chronyc tracking` once and parses it. Best-effort: a zero
|
||||
// chrony{} (state "") if chronyc is unavailable — never fails the snapshot.
|
||||
// chronyLogPath is chrony's tracking log — enabled by `log tracking` in
|
||||
// chrony.conf; chronyd appends one line per clock update.
|
||||
const chronyLogPath = "/var/log/chrony/tracking.log"
|
||||
|
||||
// chronyTracking reads the LAST line of chrony's tracking.log and parses the
|
||||
// source/stratum/offset. Best-effort: a zero chrony{} if the log is
|
||||
// absent/unreadable/empty — never fails the snapshot.
|
||||
//
|
||||
// -h 127.0.0.1 forces the LOOPBACK UDP command socket instead of chronyd's unix
|
||||
// socket. Under the agent's hardened unit (DynamicUser — not in the chrony group;
|
||||
// ProtectSystem=strict — /run read-only) the unix socket at /run/chrony is
|
||||
// unreachable (can't open it, nor create chronyc's reply socket there). UDP needs
|
||||
// no fs write or group and rides the unit's already-allowed AF_INET. The image
|
||||
// binds this socket via `bindcmdaddress 127.0.0.1` in chrony.conf.
|
||||
// We read a FILE rather than query chronyd's command socket by design: that unix
|
||||
// socket is owner-write-only (0755) so the hardened non-root agent (DynamicUser,
|
||||
// not the chrony user) can't connect, and STIG closes the UDP command port
|
||||
// (cmdport 0). `log tracking` writes the same fields to a world-readable log the
|
||||
// agent can read under ProtectSystem=strict — no port, no socket, no group, no
|
||||
// SELinux domain transition. Tradeoff: the offset is as fresh as chrony's last
|
||||
// update (up to ~maxpoll old), which is fine for a slow-moving health metric.
|
||||
func chronyTracking() chrony {
|
||||
out, err := runShort("chronyc", "-n", "-h", "127.0.0.1", "tracking")
|
||||
b, err := os.ReadFile(chronyLogPath)
|
||||
if err != nil {
|
||||
return chrony{}
|
||||
}
|
||||
return parseChrony(out)
|
||||
return parseTrackingLog(b)
|
||||
}
|
||||
|
||||
// parseChrony extracts the source/offset/stratum/leap fields from `chronyc
|
||||
// tracking` key:value output. Pure (unit-testable).
|
||||
func parseChrony(out string) chrony {
|
||||
c := chrony{state: "unsynced"}
|
||||
for line := range strings.SplitSeq(out, "\n") {
|
||||
key, val, ok := strings.Cut(line, ":")
|
||||
if !ok {
|
||||
continue
|
||||
// parseTrackingLog extracts source/stratum/offset/sync-state from the LAST data
|
||||
// line of chrony's tracking.log. Pure (unit-testable).
|
||||
//
|
||||
// Column layout (chrony `log tracking`; header written by logbanner):
|
||||
//
|
||||
// Date Time IP-Address St Freq Skew Offset L Co Offset-sd Rem-corr Root-delay Root-disp
|
||||
// f[0] f[1] f[2] f[3] f[4] f[5] f[6] f[7] ...
|
||||
//
|
||||
// Offset (f[6]) carries chrony's sign convention (ahead/fast = +), matching our
|
||||
// chrony_offset_seconds field. L (f[7]) is the leap/sync flag: N/+/- = synchronised,
|
||||
// '?' = not synchronised. Header/banner lines (first field not a digit) are skipped;
|
||||
// an unsynchronised reference logs 0.0.0.0, reported as an empty source.
|
||||
// BENCH-VERIFY the offset sign against `chronyc tracking` on a synced host.
|
||||
func parseTrackingLog(data []byte) chrony {
|
||||
lines := strings.Split(string(data), "\n")
|
||||
for i := len(lines) - 1; i >= 0; i-- {
|
||||
f := strings.Fields(lines[i])
|
||||
if len(f) < 8 || f[0] == "" || f[0][0] < '0' || f[0][0] > '9' {
|
||||
continue // blank, header ("Date ..."), or banner ("=====")
|
||||
}
|
||||
key = strings.TrimSpace(key)
|
||||
val = strings.TrimSpace(val)
|
||||
switch key {
|
||||
case "Leap status":
|
||||
if strings.Contains(val, "Normal") {
|
||||
c.state = "synced"
|
||||
}
|
||||
case "Stratum":
|
||||
if n, err := strconv.Atoi(strings.Fields(val)[0]); err == nil {
|
||||
c.stratum = int32(n)
|
||||
}
|
||||
case "Reference ID":
|
||||
// "C0A8320A (192.168.50.10)" — prefer the parenthesised name/IP.
|
||||
c.source = val
|
||||
if i := strings.IndexByte(val, '('); i >= 0 {
|
||||
if j := strings.IndexByte(val[i:], ')'); j > 1 {
|
||||
c.source = val[i+1 : i+j]
|
||||
}
|
||||
}
|
||||
case "System time":
|
||||
// "0.000012345 seconds slow of NTP time" — magnitude + direction.
|
||||
fields := strings.Fields(val)
|
||||
if len(fields) >= 3 {
|
||||
if v, err := strconv.ParseFloat(fields[0], 64); err == nil {
|
||||
if fields[2] == "slow" { // system behind NTP -> negative
|
||||
v = -v
|
||||
}
|
||||
c.offset = v
|
||||
}
|
||||
}
|
||||
c := chrony{state: "unsynced"}
|
||||
if f[7] != "?" {
|
||||
c.state = "synced"
|
||||
}
|
||||
if f[2] != "0.0.0.0" {
|
||||
c.source = f[2]
|
||||
}
|
||||
if n, err := strconv.Atoi(f[3]); err == nil {
|
||||
c.stratum = int32(n)
|
||||
}
|
||||
if v, err := strconv.ParseFloat(f[6], 64); err == nil {
|
||||
c.offset = v
|
||||
}
|
||||
return c
|
||||
}
|
||||
return c
|
||||
return chrony{}
|
||||
}
|
||||
|
||||
// unitActive reports whether a systemd unit is active (best-effort).
|
||||
|
||||
@@ -68,16 +68,16 @@ func TestParseUptime(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseChrony(t *testing.T) {
|
||||
out := `Reference ID : C0A8320A (192.168.50.10)
|
||||
Stratum : 3
|
||||
Ref time (UTC) : Fri Jul 10 06:00:00 2026
|
||||
System time : 0.000012345 seconds slow of NTP time
|
||||
Last offset : +0.000001234 seconds
|
||||
Frequency : 12.345 ppm slow
|
||||
Leap status : Normal
|
||||
func TestParseTrackingLog(t *testing.T) {
|
||||
// A realistic tracking.log: banner + header + two data lines. parseTrackingLog
|
||||
// must take the LAST data line, skip banner/header, and read source/stratum/offset.
|
||||
log := `====================================================================
|
||||
Date (UTC) Time IP Address St Freq ppm Skew ppm Offset L Co Offset sd
|
||||
====================================================================
|
||||
2026-07-10 05:59:00 192.168.50.10 3 -1.234 0.100 +0.000002000 N 4 1.0e-07
|
||||
2026-07-10 06:00:00 192.168.50.10 3 -1.250 0.090 -0.000012345 N 4 1.0e-07
|
||||
`
|
||||
c := parseChrony(out)
|
||||
c := parseTrackingLog([]byte(log))
|
||||
if c.state != "synced" {
|
||||
t.Errorf("state = %q, want synced", c.state)
|
||||
}
|
||||
@@ -87,17 +87,18 @@ Leap status : Normal
|
||||
if c.stratum != 3 {
|
||||
t.Errorf("stratum = %d, want 3", c.stratum)
|
||||
}
|
||||
// "slow of NTP time" -> negative offset (sign-sensitive check).
|
||||
// last line's Offset is -0.000012345 (sign-sensitive: must not read the +2e-6 above).
|
||||
if c.offset >= 0 || math.Abs(c.offset+0.000012345) > 1e-9 {
|
||||
t.Errorf("offset = %v, want -0.000012345", c.offset)
|
||||
}
|
||||
// unsynced when Leap status isn't Normal.
|
||||
if c := parseChrony("Leap status : Not synchronised\n"); c.state != "unsynced" {
|
||||
t.Errorf("state = %q, want unsynced", c.state)
|
||||
// unsynchronised reference: L='?' and 0.0.0.0 source.
|
||||
uns := "2026-07-10 06:01:00 0.0.0.0 0 0.000 0.000 +0.000000000 ? 0 0.0e+00\n"
|
||||
if c := parseTrackingLog([]byte(uns)); c.state != "unsynced" || c.source != "" {
|
||||
t.Errorf("unsynced parse = %+v, want state=unsynced source=''", c)
|
||||
}
|
||||
// empty / unavailable.
|
||||
if c := parseChrony(""); c.state != "unsynced" || c.source != "" {
|
||||
t.Errorf("empty parse = %+v", c)
|
||||
// empty / header-only -> zero chrony{}.
|
||||
if c := parseTrackingLog([]byte(" Date (UTC) Time IP Address\n")); c.state != "" {
|
||||
t.Errorf("header-only parse = %+v, want zero", c)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,44 +0,0 @@
|
||||
# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
|
||||
# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
|
||||
# Makefile and checkmodule rejects it. See chrony-dhcp-dispatcher.te for the why.
|
||||
module fleet_agent_chronyc 1.0.0;
|
||||
|
||||
########################################
|
||||
# Let the fleet-agent's chrony probe transition to chronyc_t under NoNewPrivileges.
|
||||
#
|
||||
# fleet-agent (telemetry) shells out to `chronyc -n tracking` to report the host's
|
||||
# clock offset / NTP source / stratum. The agent runs as unconfined_service_t, and
|
||||
# the shipped chrony policy has a type_transition so executing chronyc moves the
|
||||
# child into the confined chronyc_t domain. BUT the fleet-agent unit is hardened
|
||||
# with NoNewPrivileges (set explicitly AND forced by DynamicUser + SystemCallFilter
|
||||
# + MemoryDenyWriteExecute), and SELinux forbids an NNP process from transitioning
|
||||
# domains unless process2:nnp_transition is granted for that source->target pair.
|
||||
# The shipped policy has no such grant, so under enforcing the exec is DENIED:
|
||||
# avc: denied { nnp_transition } comm="fleet-agent"
|
||||
# scontext=...:unconfined_service_t tcontext=...:chronyc_t tclass=process2
|
||||
# chronyc never runs, chronyTracking() returns empty, and every chrony_* health
|
||||
# field stays unset (the UI shows chrony as "—"). uptime/cpu/mem are unaffected —
|
||||
# they read /proc directly and need no domain transition.
|
||||
#
|
||||
# This single allow lets the transition proceed to the MORE-confined chronyc_t
|
||||
# domain (the safe direction NNP's nnp_transition permission exists to gate), with
|
||||
# no loosening of the agent's own sandbox. Minimal + auditable; justified in
|
||||
# docs/stig-deviations.md #16.
|
||||
#
|
||||
# NB this is necessary but NOT sufficient: the agent reaches chronyd over the
|
||||
# LOOPBACK UDP command socket (`chronyc -h 127.0.0.1 tracking`; the image binds it
|
||||
# via `bindcmdaddress 127.0.0.1`, see stig-deviations #17) because the unix socket
|
||||
# is unusable under the agent's sandbox. Under enforcing, once chronyc runs in
|
||||
# chronyc_t it must also be allowed to reach chronyd_t on UDP 323 — the base chrony
|
||||
# policy is expected to cover chronyc_t's command traffic, but BENCH-VERIFY on the
|
||||
# first enforcing boot and, if a FOLLOW-ON chronyc_t AVC appears (e.g. a corenet
|
||||
# udp_socket/name_connect denial to chronyd), extend here.
|
||||
########################################
|
||||
|
||||
require {
|
||||
type unconfined_service_t;
|
||||
type chronyc_t;
|
||||
class process2 nnp_transition;
|
||||
}
|
||||
|
||||
allow unconfined_service_t chronyc_t:process2 nnp_transition;
|
||||
Reference in New Issue
Block a user