sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

stig: ship SELinux allow module for chrony DHCP-NTP dispatcher (stop chronyd AVC)

Browse Source 
The NM dispatcher 10-chrony-dhcp-ntp runs `chronyc reload sources` to load DHCP
option-42 NTP servers. That chronyc runs in the confined custom-dispatcher
domain (NetworkManager_dispatcher_custom_t), so its reply socket carries that
label and the shipped policy has no rule for chronyd_t to sendto it. Under
enforcing, chronyd does the reload but its ack is denied — chronyc reports
failure and the AVC floods the SIEM (seen 2026-07-03; permissive=1 only because
the box was booted enforcing=0).

Ship a minimal local allow module (files/stig/chrony-dhcp-dispatcher.te):
  allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;
Built + semodule -i'd in the 2c-STIG provisioner (checkpolicy installed if
absent), with an install assertion. `allow` not `dontaudit` — it also lets the
reload ack succeed so chronyc returns cleanly. Documented as
docs/stig-deviations.md #14 (not a rule waiver — a local functional allow).

BENCH-VERIFY: enforcing boot shows no AVC, chronyc reload returns 0, a
DHCP-handed NTP server appears in `chronyc sources`; and re-check verity-hash
reproducibility (semodule rebuilds the policy store, like the semanage step).
This commit is contained in:
Audiobuzz
2026-07-03 01:16:26 +00:00
parent 0e139f5346
commit 835ae7bc24
3 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/stig-deviations.md
+29
View File
@@ -138,6 +138,35 @@ down (kiosk autologin to a single locked browser; no getty shell on tty1;
`debug_shell` is lab-only and never shipped). If a future deployment wants the
hotkey disabled (e.g. a physically exposed terminal), re-select both rule IDs.
## 14. Local SELinux policy module `chrony_dhcp_dispatcher` (added 2026-07-03)
Not a STIG-rule waiver — a **minimal local `allow` module** shipped to keep a
legitimate function working under enforcing SELinux. Source:
`files/stig/chrony-dhcp-dispatcher.te`; built + `semodule -i`'d in the 2c-STIG
provisioner.
**The one rule:** `allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;`
**Why:** the NM dispatcher script `10-chrony-dhcp-ntp` loads DHCP option-42 NTP
servers by running `chronyc reload sources`. That `chronyc` runs in the confined
custom-dispatcher domain (`NetworkManager_dispatcher_custom_t`), so its reply
socket carries that label; the shipped policy has no rule for `chronyd_t` to
`sendto` it. Under enforcing, chronyd processes the reload but its **ack is
denied** — `chronyc` reports failure and the AVC floods the SIEM (seen
2026-07-03). An **`allow`** (not `dontaudit`) is used deliberately: it both stops
the noise and lets the reload ack succeed, so `chronyc` returns cleanly.
**Scope:** one direction, one class/perm, two well-known types. It grants no
network/file access and nothing beyond the chronyd↔dispatcher reply the DHCP-NTP
path needs. **BENCH-VERIFY:** (a) on an *enforcing* boot the AVC is gone and
`chronyc reload sources` from the dispatcher returns 0 (confirm a DHCP-handed NTP
server appears in `chronyc sources`); (b) no follow-on AVC (extend the `.te` if
one shows); (c) **reproducibility** — `semodule -i` rebuilds the policy store, so
re-check the verity hash is stable across two builds (same concern as the
`semanage` step, #12/sudo elevation). NB: only shipped when `enable_stig=true`
(the module install lives in the STIG-gated provisioner); a non-STIG *enforcing*
build would still see the AVC.
## Things that are NOT deviations (kept / enforced)
- **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).