sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

agent: add chrony supplementary group so it can read tracking.log (DAC)

Browse Source 
The tracking.log read was still returning empty under enforcing with NO AVC —
the tell of a DAC (not SELinux) denial. Root cause: /var/log/chrony is mode
0750 chrony:chrony (others have no access), so the agent's DynamicUser (group
tss only) can't even traverse the directory to reach the 0644 tracking.log —
EACCES on open, which produces no audit record. Manager confirmed genuinely on
fleet-manager-1db3977 (chrony-capable), and uptime flowed while chrony didn't,
proving the agent was sending empty chrony (failed read), not a manager gap.
Earlier manual reads worked only as root (sudo) or because fleetadmin had been
usermod'd into chrony during the socket test (reverted on reboot — /etc/group
is on the volatile overlay).

Fix: SupplementaryGroups=tss chrony on the unit — the chrony group has r-x on
the 0750 dir so the agent can traverse it; the log file is world-readable. This
is the DAC half; the fleet_agent_chronylog SELinux module (02a6621) is the TE
half — BOTH are required (verified: group-only -> TE-denied; module-only ->
DAC-denied silently). Corrected the now-stale 'no group' code comment; recorded
the two-layer requirement in the .te and stig-deviations #16. Needs a
workstation image rebuild + reboot.
This commit is contained in:
Audiobuzz
2026-07-10 12:45:44 +00:00
parent 02a6621a19
commit a46e5edf69
4 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/fleet-agent-chronylog.te
+7 -4
View File
@@ -18,10 +18,13 @@ module fleet_agent_chronylog 1.0.0;
#
# This grants ONLY read (open/read/getattr) on the chrony log type plus dir search
# to reach the file — no write, no other chrony access, and NO domain transition
# (the agent reads a file; it does not exec chronyc). Minimal + auditable;
# justified in docs/stig-deviations.md #16. BENCH-VERIFY: the manager's Monitor
# chrony row populates on an enforcing boot; extend here only if a related chrony
# log AVC appears. Same policy-store-rebuild reproducibility caveat as #14/#15.
# (the agent reads a file; it does not exec chronyc). This is the SELinux (TE)
# half; the DAC half is the `chrony` supplementary group in fleet-agent.service,
# needed to traverse the 0750 /var/log/chrony dir — BOTH are required to read the
# log. Minimal + auditable; justified in docs/stig-deviations.md #16. BENCH-VERIFY:
# the manager's Monitor chrony row populates on an enforcing boot; extend here only
# if a related chrony log AVC appears. Same policy-store-rebuild reproducibility
# caveat as #14/#15.
########################################
require {