stig: ship SELinux allow module for chrony DHCP-NTP dispatcher (stop chronyd AVC)

The NM dispatcher 10-chrony-dhcp-ntp runs `chronyc reload sources` to load DHCP
option-42 NTP servers. That chronyc runs in the confined custom-dispatcher
domain (NetworkManager_dispatcher_custom_t), so its reply socket carries that
label and the shipped policy has no rule for chronyd_t to sendto it. Under
enforcing, chronyd does the reload but its ack is denied — chronyc reports
failure and the AVC floods the SIEM (seen 2026-07-03; permissive=1 only because
the box was booted enforcing=0).

Ship a minimal local allow module (files/stig/chrony-dhcp-dispatcher.te):
  allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;
Built + semodule -i'd in the 2c-STIG provisioner (checkpolicy installed if
absent), with an install assertion. `allow` not `dontaudit` — it also lets the
reload ack succeed so chronyc returns cleanly. Documented as
docs/stig-deviations.md #14 (not a rule waiver — a local functional allow).

BENCH-VERIFY: enforcing boot shows no AVC, chronyc reload returns 0, a
DHCP-handed NTP server appears in `chronyc sources`; and re-check verity-hash
reproducibility (semodule rebuilds the policy store, like the semanage step).

diskless.pkr.hcl

@@ -716,6 +716,20 @@ build {
       "evaluated=$(grep -oE '<result>(pass|fixed|fail)</result>' /root/stig-arf.xml | wc -l)",
       "[ \"$evaluated\" -gt 0 ] || { echo 'ERROR: STIG scan evaluated 0 rules (all notapplicable/notselected) — SSG datastream/CPE mismatch for this distro. Hardening did NOT run; aborting.' >&2; exit 1; }",
       "echo \"==> STIG scan evaluated $evaluated rules (pass/fixed/fail)\"",
+      # SELinux: allow chronyd to reply to the chronyc our NM dispatcher runs for
+      # DHCP option-42 NTP (10-chrony-dhcp-ntp -> `chronyc reload sources`). The
+      # dispatcher's confined domain (NetworkManager_dispatcher_custom_t) labels
+      # chronyc's reply socket, and the shipped policy denies chronyd_t sendto to
+      # it -> AVC flood + failed reload under enforcing. Ship a minimal allow
+      # module (docs/stig-deviations.md). NB: rebuilds the policy store — include
+      # in the reproducibility check alongside semanage (verity hash stability).
+      "echo '==> supplemental: SELinux module chrony_dhcp_dispatcher (chronyd reply to NM-dispatcher chronyc)'",
+      "command -v checkmodule >/dev/null 2>&1 || dnf install -y checkpolicy",
+      "checkmodule -M -m -o /tmp/chrony_dhcp_dispatcher.mod /tmp/stig/chrony-dhcp-dispatcher.te",
+      "semodule_package -o /tmp/chrony_dhcp_dispatcher.pp -m /tmp/chrony_dhcp_dispatcher.mod",
+      "semodule -i /tmp/chrony_dhcp_dispatcher.pp",
+      "rm -f /tmp/chrony_dhcp_dispatcher.mod /tmp/chrony_dhcp_dispatcher.pp",
+      "semodule -l | grep -q '^chrony_dhcp_dispatcher' && echo '==> SELinux module chrony_dhcp_dispatcher installed' || { echo 'ERROR: chrony_dhcp_dispatcher module not installed' >&2; exit 1; }",
       "rm -rf /tmp/stig",
       "echo '==> STIG remediation complete (report at /root/stig-report.html, ARF at /root/stig-arf.xml)'",
     ]