sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

agent: add chrony supplementary group so it can read tracking.log (DAC)

Browse Source 
The tracking.log read was still returning empty under enforcing with NO AVC —
the tell of a DAC (not SELinux) denial. Root cause: /var/log/chrony is mode
0750 chrony:chrony (others have no access), so the agent's DynamicUser (group
tss only) can't even traverse the directory to reach the 0644 tracking.log —
EACCES on open, which produces no audit record. Manager confirmed genuinely on
fleet-manager-1db3977 (chrony-capable), and uptime flowed while chrony didn't,
proving the agent was sending empty chrony (failed read), not a manager gap.
Earlier manual reads worked only as root (sudo) or because fleetadmin had been
usermod'd into chrony during the socket test (reverted on reboot — /etc/group
is on the volatile overlay).

Fix: SupplementaryGroups=tss chrony on the unit — the chrony group has r-x on
the 0750 dir so the agent can traverse it; the log file is world-readable. This
is the DAC half; the fleet_agent_chronylog SELinux module (02a6621) is the TE
half — BOTH are required (verified: group-only -> TE-denied; module-only ->
DAC-denied silently). Corrected the now-stale 'no group' code comment; recorded
the two-layer requirement in the .te and stig-deviations #16. Needs a
workstation image rebuild + reboot.
This commit is contained in:
Audiobuzz
2026-07-10 12:45:44 +00:00
parent 02a6621a19
commit a46e5edf69
4 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/agent/fleet-agent.service
+9 -3
View File
@@ -16,10 +16,16 @@ Restart=always
RestartSec=5
# --- sandboxing (STIG-friendly; looser than hostapi — needs the TPM + egress) ---
# Runs as a transient unprivileged user in the tss group for /dev/tpmrm0 (the
# private key stays in the TPM; the agent only signs the TLS handshake through it).
# Runs as a transient unprivileged user. Groups:
# tss — /dev/tpmrm0 (the private key stays in the TPM; the agent only signs
# the TLS handshake through it).
# chrony — TRAVERSE /var/log/chrony to read tracking.log for the clock-health
# probe. That dir is mode 0750 chrony:chrony (others have no access), so
# DAC needs group membership to even enter it — a bare 0644 on the log
# file isn't enough. (SELinux read of the chronyd_var_log_t label is a
# SEPARATE layer, granted by the fleet_agent_chronylog module.)
DynamicUser=yes
SupplementaryGroups=tss
SupplementaryGroups=tss chrony
# Expose ONLY the TPM resource-manager node (no PrivateDevices — that would hide it).
DeviceAllow=/dev/tpmrm0 rw
DevicePolicy=closed