sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

secure-ntp: label /run/chrony-dhcp so chronyd can read the NTS source under SELinux

Browse Source 
Second bench defect after removing the distro 20-chrony-dhcp clobberer
(secure-ntp-5a3eaed, comet-beacon-54): the dispatcher wrote the correct
`server ntp.fleet.lab iburst nts` line, but chrony loaded ZERO sources --
`chronyc reload sources` returned 200 OK yet authdata/sources stayed empty.

Root cause (AVC): chronyd_t was DENIED read on the .sources files because they and
/run/chrony-dhcp itself were labeled generic var_run_t; chronyd_t may only read its
own chronyd_var_run_t. The dispatcher's `mkdir -p` creates the dir as var_run_t and
files inherit it. The distro 20-chrony-dhcp we removed had been restorecon-ing them
to the readable label, so removing it exposed a latent labelling gap.

Stock RHEL policy already maps /run/chrony-dhcp -> chronyd_var_run_t (a restorecon
relabels it and chrony immediately reaches NTS Cook 8). Fix: ship
/etc/tmpfiles.d/chrony-dhcp.conf so systemd-tmpfiles pre-creates the dir with that
fcontext at sysinit, before any NM event -- the dispatcher's files then inherit
chronyd_var_run_t and chronyd can read them. No SELinux allow rules needed
(bench-verified: after the fix a real NM event wrote the source as chronyd_var_run_t,
no AVC, authdata -> NTS Cook 8). Applies in both secure_ntp modes.

Also: the dispatcher now skips `lo` -- it was writing a spurious lo.sources
duplicate of the same server (the distro script had skipped loopback).

BENCH-VERIFY on the next clean build: a normal boot leaves the source file labeled
chronyd_var_run_t (ls -Z), no lo.sources, and authdata reaches NTS/cookies>0 with no
manual step.
This commit is contained in:
Audiobuzz
2026-07-12 02:53:05 +00:00
parent 5a3eaedec5
commit 5294860e74
5 changed files with 79 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+8 -1
View File
@@ -282,7 +282,14 @@ instead of working around it.
line in the shared `/run/chrony-dhcp/<iface>.sources` with the plain option-42
server — silently defeating NTS (authdata Mode `-`, Cook 0). The provisioner now
`rm`s it (NTS then reached Cook 8 on the bench). Don't re-add a competing writer to
that file. **Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
that file. **Second bench finding (2026-07-12, FIXED):** removing that distro script
also removed the `restorecon` that had been labelling the sources — the dispatcher's
`mkdir -p` leaves `/run/chrony-dhcp` + files as generic `var_run_t`, which
`chronyd_t` is SELinux-DENIED reading (loads 0 sources, `authdata` empty). Fixed by
`/etc/tmpfiles.d/chrony-dhcp.conf` pre-creating the dir with the stock
`chronyd_var_run_t` fcontext at sysinit, so the dispatcher's files inherit a readable
label (no allow rules). The dispatcher also now skips `lo` (was writing a spurious
duplicate). **Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
unauthenticated **DHCP option 42** path (plain `server <ip> iburst`).
- `fleet` Plymouth theme: confirm (a) the script plugin package actually
installed (`/usr/lib64/plymouth/script.so` — else the build fell back to