sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

Browse Source 
The per-user rule elevated fine at runtime (bench-verified staff_u->sysadm_r on
comet-beacon-54) but scanned fail: the OVAL patterns are ^\s*%\w+.*TYPE=/ROLE=,
so only a %group rule can pass. Write the drop-in as %wheel (the admin is a
wheel member; same file 2c wrote, so no unconfined per-user rule survives).
This commit is contained in:
Audiobuzz
2026-07-12 06:43:00 +00:00
parent 9ce493ef6f
commit 4e9ab45d34
3 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/stig-deviations.md
+16 -12
View File
@@ -103,18 +103,22 @@ private keys stored on the host; host keys regenerate per boot).
SSG ships no automated fix; the STIG manual remediation
(`... TYPE=sysadm_t ROLE=sysadm_r ...`) requires the admin to reach the
`sysadm_r` role, which `unconfined_u` cannot. So the provisioner (2c-STIG) now
(1) rewrites the admin sudoers rule to `<admin> ALL=(ALL) TYPE=sysadm_t
ROLE=sysadm_r NOPASSWD:ALL` (keeps NOPASSWD — the admin is key-only, #8 — and is
what the OVAL check matches), and (2) maps the admin to the confined **`staff_u`**
SELinux user (`semanage login`) so the `staff_r`→`sysadm_r` sudo transition is
authorized at runtime. `staff_u` (not `sysadm_u`) is used so SSH login isn't gated
by the `ssh_sysadm_login` boolean. **⚠ Two bench gates before trusting:** (a)
admin SSH login + `sudo` + every privileged op must work under `staff_u`
confinement — if it locks out, waive the offending rule in the tailoring as a
justified deviation (STIG is now enforced-true — there is no `enable_stig=false`
escape hatch, POA&M P-03); (b) reproducibility — `semanage` rebuilds the
SELinux policy store, so confirm the verity hash is stable across two builds (and
normalize in 2d hygiene if it drifts).
(1) rewrites the admin sudoers drop-in to `%wheel ALL=(ALL) TYPE=sysadm_t
ROLE=sysadm_r NOPASSWD:ALL` (keeps NOPASSWD — the admin is key-only, #8), and
(2) maps the admin to the confined **`staff_u`** SELinux user (`semanage login`)
so the `staff_r`→`sysadm_r` sudo transition is authorized at runtime. `staff_u`
(not `sysadm_u`) is used so SSH login isn't gated by the `ssh_sysadm_login`
boolean. **Scan-vs-runtime finding (2026-07-12, scan `poam-hardening-5bc6d27`):**
the first cut wrote a per-USER rule (`<admin> ALL=...`), which elevates fine at
runtime (bench host `comet-beacon-54`: `sudo id` →
`staff_u:sysadm_r:sysadm_t`) but the rule still scanned **fail** — the SSG OVAL
patterns (`^\s*%\w+.*TYPE=(\w+)` / `...ROLE=(\w+)`) only match **%group**
rules. Fixed by writing the rule for `%wheel` (the admin is a wheel member);
next scan should pass. **Bench status:** (a) SSH login + sudo under `staff_u`
confinement VERIFIED 2026-07-12 (re-check after the %wheel change — behaviour
should be identical, the rule targets the same account via its group); (b)
reproducibility of the verity hash across two builds (semanage rebuilds the
policy store) — still open.
## 13. Ctrl+Alt+Del console reboot hotkey kept enabled (decision 2026-06-20)