sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

Browse Source 
The per-user rule elevated fine at runtime (bench-verified staff_u->sysadm_r on
comet-beacon-54) but scanned fail: the OVAL patterns are ^\s*%\w+.*TYPE=/ROLE=,
so only a %group rule can pass. Write the drop-in as %wheel (the admin is a
wheel member; same file 2c wrote, so no unconfined per-user rule survives).
This commit is contained in:
Audiobuzz
2026-07-12 06:43:00 +00:00
parent 9ce493ef6f
commit 4e9ab45d34
3 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+8 -3
View File
@@ -933,8 +933,13 @@ build {
# SELinux context. SSG ships no auto-fix. Decision (2026-06-20):
# REMEDIATE WITH CONFINEMENT. Two parts:
# 1. Rewrite the admin sudoers rule to add the role/type transition
# (KEEP NOPASSWD — the admin is key-only; #8). This is what the
# OVAL check looks for, so it makes the rule pass.
# (KEEP NOPASSWD — the admin is key-only; #8). The rule MUST be a
# **%group rule** (%wheel — the admin is a wheel member): the SSG
# OVAL patterns are `^\s*%\w+.*TYPE=(\w+)` / `...ROLE=(\w+)`, so a
# per-USER rule never matches and the scan fails even though the
# runtime transition works (confirmed on scan poam-hardening-5bc6d27:
# bench host elevated staff_u->sysadm_r fine, rule still `fail`).
# This replaces the per-user rule 2c wrote (same file, overwritten).
# 2. Map the admin to the confined **staff_u** SELinux user so the
# staff_r->sysadm_r sudo transition is actually authorized at
# runtime (unconfined_u cannot reach sysadm_r). staff_u (NOT
@@ -949,7 +954,7 @@ build {
"if [ -n \"$ADMIN_USER\" ] && id \"$ADMIN_USER\" >/dev/null 2>&1; then",
" echo \"==> supplemental: sudo SELinux elevation — confining $ADMIN_USER to staff_u + sudoers role/type\"",
" command -v semanage >/dev/null 2>&1 || dnf install -y policycoreutils-python-utils",
" printf '%s ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL\\n' \"$ADMIN_USER\" > \"/etc/sudoers.d/$ADMIN_USER\"",
" printf '%%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL\\n' > \"/etc/sudoers.d/$ADMIN_USER\"",
" chmod 0440 \"/etc/sudoers.d/$ADMIN_USER\"",
" visudo -cf \"/etc/sudoers.d/$ADMIN_USER\"",
" restorecon \"/etc/sudoers.d/$ADMIN_USER\"",