From 9b0d4a61ea2383f536c2b78ae0b82530c3d79ca4 Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Sat, 20 Jun 2026 14:50:40 +0930
Subject: [PATCH] Change email notification to syslog

---
 .gitignore                        | 3 +++
 diskless.pkr.hcl                  | 7 +++++++
 docs/stig-deviations.md           | 7 +++++++
 files/stig/diskless-tailoring.xml | 5 +++++
 4 files changed, 22 insertions(+)

diff --git a/.gitignore b/.gitignore
index 27a3afb..ae81594 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 reports
+keys
+# Throwaway USBGuard mass-storage test image (see the USBGuard verify steps)
+/usbguard-test.img
diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index b2e850f..ce0743d 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -526,6 +526,13 @@ build {
       #     is waived in the tailoring to match.
       "echo '==> supplemental: removing unused MTA (postfix)'",
       "dnf remove -y postfix >/dev/null 2>&1 || true",
+      # Removing postfix leaves auditd's STIG `space_left_action = email` with no
+      # MTA (it warns at boot and can't send). Repoint the 75%-full alert to
+      # SYSLOG so it rides the remote audit offload (2f) instead. Only
+      # space_left_action changes; admin_space_left_action stays `single` (STIG).
+      # The auditd_data_retention_space_left_action rule (wants email) is waived in
+      # the tailoring to match — see docs/stig-deviations.md #12.
+      "[ -f /etc/audit/auditd.conf ] && sed -i 's/^space_left_action[[:space:]]*=.*/space_left_action = SYSLOG/' /etc/audit/auditd.conf || true",
       # (b) USBGuard: usbguard is already installed + enabled, but its policy was
       #     generated on the build VM (no real USB input). Add the LinuxAudit audit
       #     backend (configure_usbguard_auditbackend) AND a hardware-independent
diff --git a/docs/stig-deviations.md b/docs/stig-deviations.md
index a5027d4..c187796 100644
--- a/docs/stig-deviations.md
+++ b/docs/stig-deviations.md
@@ -76,6 +76,13 @@ private keys stored on the host; host keys regenerate per boot).
   MTA is dead attack surface. This also makes `postfix_prevent_unrestricted_relay`
   N/A. Audit-failure notification relies on the remote offload, not email
   (`auditd ... action_mail_acct` stays configured but is not the alerting path).
+- `auditd_data_retention_space_left_action` — **consequence of removing postfix.**
+  STIG sets `space_left_action = email`, but with no MTA auditd logs *"Email
+  option is specified but /usr/lib/sendmail doesn't seem executable"* at every
+  boot and can't send. 2c-STIG repoints **`space_left_action = SYSLOG`** so the
+  75%-full alert rides the remote audit offload (2f) instead; this rule wants
+  `email`, so it's waived. `admin_space_left_action` stays `single` (the critical
+  action, unaffected) and `action_mail_acct = root` stays set.
 
 **Remediated to pass (not waived):**
 - `configure_usbguard_auditbackend` + `usbguard_allow_hid` / `usbguard_allow_hub`
diff --git a/files/stig/diskless-tailoring.xml b/files/stig/diskless-tailoring.xml
index 90b2dba..2f253b5 100644
--- a/files/stig/diskless-tailoring.xml
+++ b/files/stig/diskless-tailoring.xml
@@ -144,6 +144,11 @@
          notification is via remote offload, not email) -> the rule that
          requires postfix installed becomes N/A. -->
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_postfix_installed" selected="false"/>
+    <!-- Consequence of removing postfix: auditd's STIG space_left_action=email
+         has no MTA, so it's repointed to SYSLOG (alert rides the remote audit
+         offload). This rule wants 'email', so waive it. admin_space_left_action
+         stays 'single' (unaffected). See #12. -->
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="false"/>
 
     <!-- USBGuard (decision: ENABLE with a hardware-independent allowlist).
          usbguard is already installed + the service enabled, but its policy was