tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17)

Its OVAL requires a literal ^server line in the baked chrony.conf, which can
never exist under secure_ntp: the fail-closed re-strip removes every static
server and the NTS source is derived at runtime into /run/chrony-dhcp. Surfaced
as the single REVIEW row on scan poam-hardening-4e9ab45 (the first full scan of
the post-secure-ntp merge).

docs/stig-deviations.md

@@ -298,11 +298,20 @@ boot; (b) no other chrony-log AVC (extend here if one appears); (c)
 **reproducibility** — `semodule -i` rebuilds the policy store, re-check verity hash
 stability (same concern as #14/#15). Only shipped when `enable_stig=true`.
 
-## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11)
+## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11; +`chronyd_server_directive` 2026-07-12)
 
-**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll`
+**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll`,
-(unselected in `diskless-tailoring.xml`; plus a belt-and-suspenders re-strip in
+`chronyd_server_directive` (unselected in `diskless-tailoring.xml`; plus a
-`2c-STIG-postfix`).
+belt-and-suspenders re-strip in `2c-STIG-postfix`).
+
+**Addendum 2026-07-12 (scan `poam-hardening-4e9ab45` — the first full scan of the
+post-secure-ntp merge):** `chronyd_server_directive` is the **check-only companion**
+of the two rules above — its OVAL requires a literal `^server` line in the baked
+`/etc/chrony.conf` (or `/etc/chrony.d/*.conf`). Under `secure_ntp` that can never
+exist: the re-strip removes every static server (each would be an unauthenticated
+fallback defeating NTS fail-closure), and the real NTS source is derived from the
+DHCP domain at runtime into `/run/chrony-dhcp` (a path the OVAL doesn't inspect).
+Same rationale as below applies; added to the waiver set.
 
 **Why:** these rules remediate by writing a **static, unauthenticated**
 `server <pool> maxpoll 16` into `/etc/chrony.conf`. The fleet instead configures

files/stig/diskless-tailoring.xml

@@ -181,10 +181,16 @@
          DNS/NTP spoofer could shift the clock through it — the exact F-03 risk).
          Unselect so remediation adds no plain server; 2c-STIG-postfix also
          re-strips any server/pool when secure_ntp=true (belt-and-suspenders).
-         The STIG intent (time IS synchronised, authenticated under NTS) is met.
+         chronyd_server_directive is the CHECK-ONLY companion (requires a literal
+         `^server` line in the baked chrony.conf/chrony.d — impossible under
+         secure_ntp, where the NTS source lands in /run/chrony-dhcp at runtime;
+         surfaced as the 1 REVIEW on scan poam-hardening-4e9ab45, the first
+         post-secure-ntp full scan). The STIG intent (time IS synchronised,
+         authenticated under NTS) is met.
          Justified in docs/stig-deviations.md #17. -->
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" selected="false"/>
 
   </xccdf:Profile>
 </xccdf:Tailoring>