sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request 'fapolicyd-tmpfs' (#16) from fapolicyd-tmpfs into main

Browse Source 
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/16
This commit is contained in:
audiobuzz
2026-07-05 03:21:46 +00:00
parent 2d9e813488 e27f068aaf
commit 6b675a1bda
3 changed files with 146 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+34
View File
@@ -809,6 +809,21 @@ build {
"semodule -i /tmp/chrony_dhcp_dispatcher.pp",
"rm -f /tmp/chrony_dhcp_dispatcher.mod /tmp/chrony_dhcp_dispatcher.pp",
"semodule -l | grep -q '^chrony_dhcp_dispatcher' && echo '==> SELinux module chrony_dhcp_dispatcher installed' || { echo 'ERROR: chrony_dhcp_dispatcher module not installed' >&2; exit 1; }",
# SELinux: allow fapolicyd to statfs (getattr) tmpfs. fapolicyd is the exec
# guard for the WRITABLE overlay (dm-verity covers only the RO erofs lower);
# it statfs's mounts to decide which to watch (tmpfs is in its default
# watch_fs). This host's root is systemd.volatile=overlay, so statfs("/")
# lands on the tmpfs upper (audit: dev=tmpfs ino=1 name="/") and the shipped
# policy denies it -> fapolicyd can't fully guard the tmpfs mounts (/, /tmp,
# /dev/shm) — a real exec-guard gap. Ship a minimal allow (docs/stig-deviations.md).
# checkpolicy already ensured above. Same policy-store-rebuild reproducibility
# caveat as chrony.
"echo '==> supplemental: SELinux module fapolicyd_tmpfs (fapolicyd statfs the volatile-overlay tmpfs)'",
"checkmodule -M -m -o /tmp/fapolicyd_tmpfs.mod /tmp/stig/fapolicyd-tmpfs.te",
"semodule_package -o /tmp/fapolicyd_tmpfs.pp -m /tmp/fapolicyd_tmpfs.mod",
"semodule -i /tmp/fapolicyd_tmpfs.pp",
"rm -f /tmp/fapolicyd_tmpfs.mod /tmp/fapolicyd_tmpfs.pp",
"semodule -l | grep -q '^fapolicyd_tmpfs' && echo '==> SELinux module fapolicyd_tmpfs installed' || { echo 'ERROR: fapolicyd_tmpfs module not installed' >&2; exit 1; }",
"rm -rf /tmp/stig",
"echo '==> STIG remediation complete (report at /root/stig-report.html, ARF at /root/stig-arf.xml)'",
]
@@ -874,6 +889,25 @@ build {
" for f in /usr/local/bin/kiosk-session /usr/local/bin/fleet-sb-enroll /usr/local/bin/fleet-hostapi /usr/sbin/fleet-enrol; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
" fapolicyd-cli --update 2>/dev/null || true",
" echo '==> fapolicyd: trusted custom binaries (kiosk-session, fleet-sb-enroll, fleet-hostapi) + rebuilt trust db'",
# watch_fs: the diskless root is OVERLAYFS (systemd.volatile=overlay), but the
# shipped watch_fs lacks 'overlay', so fapolicyd marks NO overlay mount and
# therefore intercepts NO exec on / — the exec guard for the writable overlay
# (the whole reason we keep fapolicyd; dm-verity can't cover the tmpfs upper)
# is effectively OFF at runtime. VERIFIED on the bench 2026-07-03: a novel
# non-RPM binary in /tmp (overlayfs) ran freely under `permissive=0`. Add
# 'overlay' so fapolicyd actually watches the root; trust is path-based
# (integrity=none) so overlay paths resolve against the rpmdb trust as normal.
# The #15 tmpfs getattr allow supports this (fapolicyd statfs's the overlay's
# tmpfs upper). Idempotent. BENCH-VERIFY HARD — this turns app-allowlisting ON
# for the WHOLE root at runtime for the first time: boot + kiosk render + admin
# SSH + sudo + TPM enrolment must ALL still work (nothing legit is untrusted),
# a novel /tmp binary must now be BLOCKED (EPERM), and watch for new AVCs.
# enable_stig=false is the escape hatch if it regresses the boot/secure path.
" if [ -f /etc/fapolicyd/fapolicyd.conf ]; then",
" grep -Eq '^watch_fs.*overlay' /etc/fapolicyd/fapolicyd.conf || sed -ri '/^watch_fs *=/ s/$/,overlay/' /etc/fapolicyd/fapolicyd.conf",
" grep -Eq '^watch_fs.*overlay' /etc/fapolicyd/fapolicyd.conf || { echo 'ERROR: failed to add overlay to fapolicyd watch_fs' >&2; exit 1; }",
" echo '==> fapolicyd: watch_fs now includes overlay (guards the volatile-overlay root)'",
" fi",
"fi",
]
}
docs/stig-deviations.md
+81
View File
@@ -167,6 +167,87 @@ re-check the verity hash is stable across two builds (same concern as the
(the module install lives in the STIG-gated provisioner); a non-STIG *enforcing*
build would still see the AVC.
## 15. Local SELinux policy module `fapolicyd_tmpfs` (added 2026-07-03)
Not a STIG-rule waiver — a **minimal local `allow` module** shipped to close an
**exec-guard gap** under enforcing SELinux. Source: `files/stig/fapolicyd-tmpfs.te`;
built + `semodule -i`'d in the 2c-STIG provisioner (right after #14).
**The one rule:** `allow fapolicyd_t tmpfs_t:filesystem getattr;`
**Why:** fapolicyd is the app-allowlisting **exec guard for the writable RAM
overlay** — dm-verity covers only the read-only erofs lower, so a binary dropped
into the tmpfs overlay upper is exactly what fapolicyd must catch (this is why we
KEEP fapolicyd; see "Things that are NOT deviations"). fapolicyd `statfs`'s mounts
to decide which to watch, and **tmpfs is in its default `watch_fs`**. This image's
root is `systemd.volatile=overlay`, so `statfs("/")` returns the overlay **upper**
— a tmpfs (audit: `dev=tmpfs ino=1 name="/"`, `fapolicyd_t → tmpfs_t:filesystem
getattr`, `permissive=0`, seen 2026-07-03). The shipped policy has no such rule
(no ordinary host has its root on tmpfs), so under enforcing the `getattr` is
**denied**, fapolicyd cannot fully mark the tmpfs mounts (`/`, `/tmp`, `/dev/shm`),
and its guard over the writable overlay is **incomplete** — a real gap, not just
SIEM noise. An **`allow`** (not `dontaudit`): we *want* fapolicyd to see the tmpfs.
**Scope:** one perm (`getattr`) on one class (`filesystem`), two well-known types.
Grants no file read/write, only the `statfs` fapolicyd needs to classify + watch
the mount. **BENCH-VERIFY:** (a) the AVC is gone on an enforcing boot; (b) fapolicyd
**blocks a non-RPM executable dropped in `/tmp`** (proves the guard now covers the
overlay tmpfs) while the trusted kiosk/appliance binaries still run; (c)
**reproducibility** — `semodule -i` rebuilds the policy store, so re-check verity
hash stability across two builds (same concern as #12/#14). NB: only shipped when
`enable_stig=true`; a non-STIG enforcing build would still see the AVC and the gap.
**UPDATE 2026-07-03 — the getattr allow alone did NOT close the exec gap; the real
enabler is `watch_fs`.** Bench test on `comet-beacon-54`: with the `.te` installed
(AVC gone, `fapolicyd active`, `permissive=0`), a **novel** non-RPM executable in
`/tmp` (hash NOT in the trust db) still **ran** (`exit=0`). Root cause: the diskless
root is **overlayfs** (`stat -f /` → `overlayfs`, `/tmp` too), but the shipped
`watch_fs = ext2,ext3,ext4,tmpfs,xfs,vfat,iso9660,btrfs` has **no `overlay`**.
fapolicyd marks mounts by fs type, so it never marks the overlay = it intercepts
**no exec on `/`** — the whole root, `/usr` and `/tmp` alike. So the exec guard was
effectively **OFF at runtime** on every diskless host. Fix: the 2c-STIG fapolicyd
step now appends **`overlay` to `watch_fs`** in `fapolicyd.conf` (idempotent) so
fapolicyd watches the overlay root; trust is path-based (`integrity=none`) so overlay
paths resolve against the rpmdb trust normally. The `fapolicyd_tmpfs` `.te` above is
still needed — it supports fapolicyd statfs'ing the overlay's tmpfs upper. **This
turns app-allowlisting ON for the whole root at runtime for the first time**, so
**BENCH-VERIFY HARD:** boot + kiosk render + admin SSH + sudo + TPM enrolment all
still work (nothing legit is untrusted — the 4 custom binaries + rpmdb are trusted),
a novel `/tmp` binary is now **blocked** (EPERM), and no new AVCs (extend the `.te`
if any). `enable_stig=false` is the escape hatch if it regresses the boot/secure path.
**VERIFIED 2026-07-04 (build `fapolicyd-tmpfs-12043d3`, host `comet-beacon-54`) —
enforcing, no false positives.** `fapolicyd active (running)`, `permissive = 0`,
`watch_fs = ...,overlay` (the fix took), `stat -f / /tmp` → both `overlayfs` (so the
test hits the overlay rule, not the pre-existing tmpfs one). A novel-hash binary
(`cp /bin/true /tmp/n; printf '\0' >>/tmp/n`) was **denied**: `bash: /tmp/n: Operation
not permitted`, `exit=126`, and the audit record confirms fapolicyd did it —
`type=FANOTIFY ... resp=2` (FAN_DENY) `obj_trust=0` (target not in trust db). The
**deny sweep was empty** (`journalctl -t fapolicyd -b | grep dec=deny` → nothing),
i.e. **zero false denials**: kiosk-session/weston/chromium + the NM dispatcher scripts
all ran trusted; admin SSH + `sudo` worked under `staff_u:staff_r:staff_t`. So the
exec guard went from **effectively OFF** (pre-fix, overlay unwatched) to **enforcing
on the whole overlay root** with nothing legit broken. My NM-dispatcher false-denial
worry did not materialise.
**Scope caveat — this closes the UNTRUSTED-PATH half, not the MODIFIED-TRUSTED-PATH
half.** With `integrity = none`, trust is by **path**, so watching the overlay blocks
a *new* file at an *untrusted* path (`/tmp/n`) — proven above. It does **not** catch a
*trusted* path whose **content** was swapped: writing to e.g. `/usr/bin/bash` triggers
an overlayfs **copy-up** into the tmpfs upper — same path, new inode, **outside
dm-verity's coverage** (verity only protects the erofs lower, which is now shadowed) —
and the path-based rule still trusts it. Closing that residual gap needs either
`integrity = sha256` (fapolicyd re-hashes at exec, content ≠ trust-db hash → deny; the
rpmdb backend already carries SHA-256 digests, so it's a one-line `fapolicyd.conf`
change — cost is per-exec userspace hashing, partly redundant with verity on the
un-tampered lower) **or** an **un-shadowable `/usr`** so copy-up can't happen at all
(read-only mount → write fails EROFS, no tmpfs copy is ever created; path-trust becomes
sound again). The latter is tracked as **TODO #15** ("scope root overlay to per-subtree
tmpfs — un-shadowable `/usr`") and is the preferred fix since it removes the attack
surface rather than detecting abuse of it. Requires a write primitive to a root-owned
path either way (already-privileged context), which is fapolicyd's defense-in-depth
threat model — not an unprivileged bypass.
## Things that are NOT deviations (kept / enforced)
- **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).
files/stig/fapolicyd-tmpfs.te
+31
View File
@@ -0,0 +1,31 @@
# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
# Makefile and checkmodule rejects it. See chrony-dhcp-dispatcher.te for the why.
module fapolicyd_tmpfs 1.0.0;
########################################
# Let fapolicyd statfs (getattr) tmpfs filesystems.
#
# fapolicyd is the app-allowlisting EXEC GUARD for the writable RAM overlay:
# dm-verity covers only the read-only erofs lower, so an executable dropped into
# the tmpfs overlay upper is exactly what fapolicyd must catch. fapolicyd statfs's
# mounts to decide which to watch, and tmpfs is in its default watch_fs. This
# host's root is `systemd.volatile=overlay`, so statfs("/") returns the overlay
# UPPER — a tmpfs (the audit shows dev=tmpfs ino=1, name="/") — and the shipped
# policy has no `fapolicyd_t tmpfs_t:filesystem getattr` rule (no normal host has
# its root on tmpfs). Result under enforcing: the getattr is DENIED, fapolicyd
# cannot fully mark the tmpfs mounts (/, /tmp, /dev/shm), and its guard over the
# writable overlay is incomplete — a real exec-guard gap, not just SIEM noise.
# This single allow closes it. Minimal + auditable; justified in
# docs/stig-deviations.md. BENCH-VERIFY: after this, fapolicyd blocks a non-RPM
# executable dropped in /tmp (the overlay). If a follow-on fapolicyd AVC on the
# overlay appears on the bench, extend here.
########################################
require {
type fapolicyd_t;
type tmpfs_t;
class filesystem getattr;
}
allow fapolicyd_t tmpfs_t:filesystem getattr;