sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

Browse Source 
The per-user rule elevated fine at runtime (bench-verified staff_u->sysadm_r on
comet-beacon-54) but scanned fail: the OVAL patterns are ^\s*%\w+.*TYPE=/ROLE=,
so only a %group rule can pass. Write the drop-in as %wheel (the admin is a
wheel member; same file 2c wrote, so no unconfined per-user rule survives).
This commit is contained in:
Audiobuzz
2026-07-12 06:43:00 +00:00
parent 9ce493ef6f
commit 4e9ab45d34
3 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+18 -12
View File
@@ -207,15 +207,19 @@ pass / N/A.
mouse on real hardware — the build-VM-generated policy + default block target
would otherwise lock out console input).
- **`selinux_context_elevation_for_sudo` — REMEDIATED WITH CONFINEMENT
(decision 2026-06-20).** 2c-STIG now rewrites the admin sudoers to
`TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL` and maps the admin to **`staff_u`**
(`semanage login`) so the sudo role transition is authorized. ⚠ **TWO BENCH
GATES:** (a) admin SSH login + sudo + privileged ops must work under `staff_u`
confinement (if it locks out, waive the offending rule in the tailoring as a
justified deviation — `enable_stig=false` is no longer available, STIG is
enforced-true); (b) **reproducibility** — `semanage` rebuilds the policy store;
confirm the verity hash is stable across two builds (normalize in 2d if it
drifts). Needs `policycoreutils-python-utils` (installed in 2c-STIG if absent).
(decision 2026-06-20; scan-fix 2026-07-12).** 2c-STIG rewrites the admin
sudoers drop-in to `%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL`
and maps the admin to **`staff_u`** (`semanage login`) so the sudo role
transition is authorized. **Must be a %group rule:** the first cut used a
per-user rule — runtime elevation worked (bench-verified 2026-07-12,
`comet-beacon-54`) but the SSG OVAL (`^\s*%\w+.*TYPE=`) only matches %group
rules, so the scan stayed `fail` (the 1 REVIEW row on `poam-hardening-5bc6d27`).
⚠ **BENCH GATES:** (a) admin SSH login + sudo under `staff_u` confinement —
VERIFIED 2026-07-12 (re-confirm after the %wheel change; same account via its
group, behaviour should be identical); (b) **reproducibility** — `semanage`
rebuilds the policy store; confirm the verity hash is stable across two builds
(normalize in 2d if it drifts). Needs `policycoreutils-python-utils`
(installed in 2c-STIG if absent).
**Expected next-build report: 0–1 REVIEW** (0 if both postfix→N/A and
usbguard→pass land and sudo confinement holds; the triage was validated by
@@ -1000,10 +1004,12 @@ smoke test.
record **drained losslessly** after the real cert was restored (original
timestamp preserved); STIG scan of record: all three
`rsyslog_encrypt_offload_*` rules **pass**, 401 pass / 1 fail, 0 new
REVIEW rows (the 1 remaining REVIEW is the pre-existing
REVIEW rows (the 1 remaining REVIEW was the pre-existing
`selinux_context_elevation_for_sudo` — runtime behaviour verified working
on the same host, likely an OVAL word-order artifact: the check may want
`ROLE=... TYPE=...` where 2c-STIG writes `TYPE=... ROLE=...` — follow-up).
on the same host; ROOT CAUSE found in the ARF and FIXED 2026-07-12: the SSG
OVAL only matches **%group** sudoers rules (`^\s*%\w+.*TYPE=`), and 2c-STIG
wrote a per-user rule — now writes `%wheel ...`; next scan should be 0
REVIEW).
Bench gotcha worth keeping: the smallstep password file location varies by
image version (`$STEPPATH/password` vs `$STEPPATH/secrets/password`) —
issue-cert.sh probes both (fixed 2026-07-12 after hitting it live).