Change email notification to syslog

.gitignore

@@ -1 +1,4 @@
 reports
+keys
+# Throwaway USBGuard mass-storage test image (see the USBGuard verify steps)
+/usbguard-test.img

diskless.pkr.hcl

@@ -526,6 +526,13 @@ build {
       #     is waived in the tailoring to match.
       "echo '==> supplemental: removing unused MTA (postfix)'",
       "dnf remove -y postfix >/dev/null 2>&1 || true",
+      # Removing postfix leaves auditd's STIG `space_left_action = email` with no
+      # MTA (it warns at boot and can't send). Repoint the 75%-full alert to
+      # SYSLOG so it rides the remote audit offload (2f) instead. Only
+      # space_left_action changes; admin_space_left_action stays `single` (STIG).
+      # The auditd_data_retention_space_left_action rule (wants email) is waived in
+      # the tailoring to match — see docs/stig-deviations.md #12.
+      "[ -f /etc/audit/auditd.conf ] && sed -i 's/^space_left_action[[:space:]]*=.*/space_left_action = SYSLOG/' /etc/audit/auditd.conf || true",
       # (b) USBGuard: usbguard is already installed + enabled, but its policy was
       #     generated on the build VM (no real USB input). Add the LinuxAudit audit
       #     backend (configure_usbguard_auditbackend) AND a hardware-independent

docs/stig-deviations.md

@@ -76,6 +76,13 @@ private keys stored on the host; host keys regenerate per boot).
   MTA is dead attack surface. This also makes `postfix_prevent_unrestricted_relay`
   N/A. Audit-failure notification relies on the remote offload, not email
   (`auditd ... action_mail_acct` stays configured but is not the alerting path).
+- `auditd_data_retention_space_left_action` — **consequence of removing postfix.**
+  STIG sets `space_left_action = email`, but with no MTA auditd logs *"Email
+  option is specified but /usr/lib/sendmail doesn't seem executable"* at every
+  boot and can't send. 2c-STIG repoints **`space_left_action = SYSLOG`** so the
+  75%-full alert rides the remote audit offload (2f) instead; this rule wants
+  `email`, so it's waived. `admin_space_left_action` stays `single` (the critical
+  action, unaffected) and `action_mail_acct = root` stays set.
 
 **Remediated to pass (not waived):**
 - `configure_usbguard_auditbackend` + `usbguard_allow_hid` / `usbguard_allow_hub`

files/stig/diskless-tailoring.xml

@@ -144,6 +144,11 @@
          notification is via remote offload, not email) -> the rule that
          requires postfix installed becomes N/A. -->
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_postfix_installed" selected="false"/>
+    <!-- Consequence of removing postfix: auditd's STIG space_left_action=email
+         has no MTA, so it's repointed to SYSLOG (alert rides the remote audit
+         offload). This rule wants 'email', so waive it. admin_space_left_action
+         stays 'single' (unaffected). See #12. -->
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="false"/>
 
     <!-- USBGuard (decision: ENABLE with a hardware-independent allowlist).
          usbguard is already installed + the service enabled, but its policy was