sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17)

Browse Source 
Its OVAL requires a literal ^server line in the baked chrony.conf, which can
never exist under secure_ntp: the fail-closed re-strip removes every static
server and the NTS source is derived at runtime into /run/chrony-dhcp. Surfaced
as the single REVIEW row on scan poam-hardening-4e9ab45 (the first full scan of
the post-secure-ntp merge).
This commit is contained in:
Audiobuzz
2026-07-12 09:25:02 +00:00
parent 4e9ab45d34
commit 943f3e29ce
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/stig-deviations.md
+13 -4
View File
@@ -298,11 +298,20 @@ boot; (b) no other chrony-log AVC (extend here if one appears); (c)
**reproducibility** — `semodule -i` rebuilds the policy store, re-check verity hash
stability (same concern as #14/#15). Only shipped when `enable_stig=true`.
## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11)
## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11; +`chronyd_server_directive` 2026-07-12)
**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll`
(unselected in `diskless-tailoring.xml`; plus a belt-and-suspenders re-strip in
`2c-STIG-postfix`).
**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll`,
`chronyd_server_directive` (unselected in `diskless-tailoring.xml`; plus a
belt-and-suspenders re-strip in `2c-STIG-postfix`).
**Addendum 2026-07-12 (scan `poam-hardening-4e9ab45` — the first full scan of the
post-secure-ntp merge):** `chronyd_server_directive` is the **check-only companion**
of the two rules above — its OVAL requires a literal `^server` line in the baked
`/etc/chrony.conf` (or `/etc/chrony.d/*.conf`). Under `secure_ntp` that can never
exist: the re-strip removes every static server (each would be an unauthenticated
fallback defeating NTS fail-closure), and the real NTS source is derived from the
DHCP domain at runtime into `/run/chrony-dhcp` (a path the OVAL doesn't inspect).
Same rationale as below applies; added to the waiver set.
**Why:** these rules remediate by writing a **static, unauthenticated**
`server <pool> maxpoll 16` into `/etc/chrony.conf`. The fleet instead configures
files/stig/diskless-tailoring.xml
+7 -1
View File
@@ -181,10 +181,16 @@
DNS/NTP spoofer could shift the clock through it — the exact F-03 risk).
Unselect so remediation adds no plain server; 2c-STIG-postfix also
re-strips any server/pool when secure_ntp=true (belt-and-suspenders).
The STIG intent (time IS synchronised, authenticated under NTS) is met.
chronyd_server_directive is the CHECK-ONLY companion (requires a literal
`^server` line in the baked chrony.conf/chrony.d — impossible under
secure_ntp, where the NTS source lands in /run/chrony-dhcp at runtime;
surfaced as the 1 REVIEW on scan poam-hardening-4e9ab45, the first
post-secure-ntp full scan). The STIG intent (time IS synchronised,
authenticated under NTS) is met.
Justified in docs/stig-deviations.md #17. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" selected="false"/>
</xccdf:Profile>
</xccdf:Tailoring>