Fix fapolicyd for kiosk

diskless.pkr.hcl

@@ -531,14 +531,17 @@ build {
     destination = "${var.artifact_dir}/${var.image_version}/stig-arf.xml"
   }
 
-  # --- 2c-STIG-postfix. Keep the key-only APPLIANCE ACCOUNTS usable after STIG.
-  # STIG turns on pam_faillock (account phase) + password aging/inactivity
-  # (account_disable_post_pw_expiration, accounts_*_age_*). The kiosk autologin
-  # user and the fleet admin are PASSWORDLESS / key-only, so the hardened account
-  # phase rejects them: the kiosk PAM session never opens (getty keeps tty1), and
-  # sshd denies the otherwise-valid key as "Permission denied (publickey)" (key
-  # auth succeeds, then pam_acct_mgmt fails). Runs AFTER remediation so STIG can't
-  # re-break it. Justified in docs/stig-deviations.md (#10, appliance accounts).
+  # --- 2c-STIG-postfix. Undo the STIG settings that lock out this architecture.
+  # Runs AFTER remediation so STIG can't re-break it. Two fixes:
+  #  (a) APPLIANCE ACCOUNTS: STIG enables pam_faillock (account phase) + password
+  #      aging/inactivity. The kiosk + fleet-admin accounts are PASSWORDLESS /
+  #      key-only, so the hardened account phase rejects them (kiosk session never
+  #      opens; sshd account phase denies). Exempt just those two accounts.
+  #  (b) fapolicyd: STIG's app-allowlisting blocks non-RPM executables, killing
+  #      the kiosk (ExecStart=/usr/local/bin/kiosk-session). Keep fapolicyd (it's
+  #      the exec-guard for the writable overlay that dm-verity can't cover) and
+  #      trust the custom kiosk binary instead of disabling it.
+  # Both justified in docs/stig-deviations.md (#10).
   provisioner "shell" {
     environment_vars = [
       "ENABLE_STIG=${var.enable_stig}",
@@ -565,6 +568,17 @@ build {
       "  restorecon /etc/pam.d/sshd",
       "  echo \"==> /etc/pam.d/sshd: account-stack bypass ensured for $ADMIN_USER\"",
       "fi",
+      # fapolicyd (STIG app-allowlisting) blocks execution of any non-RPM file.
+      # The kiosk's ExecStart=/usr/local/bin/kiosk-session is exactly that, so
+      # fapolicyd kills the kiosk. KEEP fapolicyd (it's the real exec-guard for the
+      # writable RAM overlay, which dm-verity does NOT cover) and instead TRUST the
+      # custom kiosk files: add them to fapolicyd's trust DB and rebuild it. weston
+      # /chromium are RPM-installed so already trusted. (See docs/stig-deviations.md.)
+      "if command -v fapolicyd-cli >/dev/null 2>&1; then",
+      "  for f in /usr/local/bin/kiosk-session; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
+      "  fapolicyd-cli --update 2>/dev/null || true",
+      "  echo '==> fapolicyd: trusted custom kiosk binaries + rebuilt trust db'",
+      "fi",
     ]
   }