Tightening Stig hardening

CLAUDE.md

@@ -171,6 +171,33 @@ instead of working around it.
   nondeterministic (timestamp/uuid/key); find + normalize it in 2d hygiene;
   (d) read the generated `stig-deviations.md` — every REVIEW row is a real finding
   to triage or justify in `docs/stig-deviations.md`.
+  **STIG-breaks-login gotchas already hit + fixed (2026-06-19) — don't regress:**
+  (i) **fapolicyd** blocks non-RPM executables → the kiosk's
+  `/usr/local/bin/kiosk-session` must be in fapolicyd's trust (done in
+  2c-STIG-postfix); keep fapolicyd, don't waive it (it's the writable-overlay
+  exec guard dm-verity can't provide). (ii) **Admin SSH key must be ECDSA/RSA,
+  NOT ed25519** — the STIG crypto policy drops ed25519 from sshd's accepted
+  pubkey algorithms (`server-sig-algs` shows ecdsa+rsa-sha2 only), so an ed25519
+  key gets `Permission denied (publickey)` at the signature stage. (iii)
+  **passwordless/key-only appliance accounts** (kiosk, fleetadmin) are exempted
+  from STIG password-aging + faillock account phase in 2c-STIG-postfix (else
+  locked out). (iv) the kiosk unit is `WantedBy=multi-user.target` (not
+  graphical.target, which the host never reaches → unit dead at boot).
+  Offline diagnosis without booting: mount the OCI image's `rootfs.erofs`
+  read-only and inspect `/etc/pam.d`, fapolicyd, sshd config, etc.
+  **REVIEW-row triage (2026-06-20, scan app-9f7d8d1) added two more bench gates —
+  don't regress:** (v) **USBGuard is ENABLED + enforcing** (block target) with a
+  hardware-independent HID/hub allowlist + `AuditBackend=LinuxAudit` (2c-STIG). The
+  generated policy is built on the virtio build VM (no real USB), so without the
+  HID/hub allow rules a **physical console keyboard/mouse is blocked** on real
+  hardware — BENCH-VERIFY console input. (vi) **admin sudo SELinux elevation**:
+  the admin is mapped to **`staff_u`** (`semanage login`) + sudoers
+  `TYPE=sysadm_t ROLE=sysadm_r NOPASSWD:ALL` so `selinux_context_elevation_for_sudo`
+  passes; `staff_u` (not `sysadm_u`) so SSH login isn't gated by `ssh_sysadm_login`.
+  BENCH-VERIFY admin SSH login + sudo + privileged ops under confinement, and
+  **re-check reproducibility** (semanage rebuilds the policy store → possible
+  verity-hash drift). The triage waivers/decisions live in the tailoring +
+  docs/stig-deviations.md #12; the generated report should show 0–1 REVIEW.
 - NTP via DHCP option 42 → chrony (no public-pool egress): confirm on a booted
   host `chronyc sources` lists the DHCP-handed lab server (not `*.pool.ntp.org`).
   Assumes (a) NM exports the lease's NTP servers to the dispatcher as