From d9d2b50bfb0cda76957fe2081923c4d976ba5391 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Fri, 3 Jul 2026 02:53:57 +0000 Subject: [PATCH] =?UTF-8?q?stig:=20fix=20chrony=20SELinux=20.te=20?= =?UTF-8?q?=E2=80=94=20use=20raw=20module=20syntax,=20not=20policy=5Fmodul?= =?UTF-8?q?e()=20macro?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The build failed: checkmodule rejected `policy_module(chrony_dhcp_dispatcher, 1.0.0)` with "Building a policy module, but no module specification found". policy_module() is a refpolicy m4 macro expanded only by the refpolicy Makefile (/usr/share/selinux/devel), not by checkmodule. Use the raw module-policy declaration `module chrony_dhcp_dispatcher 1.0.0;`, which is exactly what checkmodule -M -m parses. require{} + allow rule unchanged. --- files/stig/chrony-dhcp-dispatcher.te | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/files/stig/chrony-dhcp-dispatcher.te b/files/stig/chrony-dhcp-dispatcher.te index 1ad644e..33d0a11 100644 --- a/files/stig/chrony-dhcp-dispatcher.te +++ b/files/stig/chrony-dhcp-dispatcher.te @@ -1,4 +1,8 @@ -policy_module(chrony_dhcp_dispatcher, 1.0.0) +# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy +# `policy_module()` m4 macro — that macro is only expanded by the refpolicy +# Makefile (/usr/share/selinux/devel) and checkmodule rejects it ("no module +# specification found"). `module ;` is what checkmodule wants. +module chrony_dhcp_dispatcher 1.0.0; ######################################## # Let chronyd reply to the chronyc that our NetworkManager dispatcher script