sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

image: SELinux allow fleet-agent chronyc probe under NoNewPrivileges

Browse Source 
fleet-agent reports clock health via 'chronyc -n tracking', but the hardened
unit runs with NoNewPrivileges (explicit + forced by DynamicUser/SystemCallFilter/
MemoryDenyWriteExecute). SELinux transitions the exec'd chronyc into chronyc_t,
and NNP forbids that domain change without process2:nnp_transition — which the
base policy doesn't grant for unconfined_service_t -> chronyc_t. Under enforcing
the exec is denied (avc: denied { nnp_transition } comm=fleet-agent, seen on
comet-beacon-54), so chronyc never runs and every chrony_* health field stays
empty (Monitor chrony row shows '—'). uptime/cpu/mem are unaffected (no exec).

Ship a minimal local module (files/stig/fleet-agent-chronyc.te) granting only
that one nnp_transition to the MORE-confined chronyc_t domain — the safe
direction the permission exists to gate — loosening nothing else in the agent
sandbox. Built + semodule -i'd in 2c-STIG alongside the existing
chrony_dhcp_dispatcher / fapolicyd_tmpfs modules. Justified in
docs/stig-deviations.md #16. Needs a workstation image rebuild + reboot; same
policy-store-rebuild reproducibility re-check as #14/#15.
This commit is contained in:
Audiobuzz
2026-07-10 08:39:27 +00:00
parent 1db3977238
commit e6fd4a2dde
3 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+16
View File
@@ -899,6 +899,22 @@ build {
"semodule -i /tmp/fapolicyd_tmpfs.pp",
"rm -f /tmp/fapolicyd_tmpfs.mod /tmp/fapolicyd_tmpfs.pp",
"semodule -l | grep -q '^fapolicyd_tmpfs' && echo '==> SELinux module fapolicyd_tmpfs installed' || { echo 'ERROR: fapolicyd_tmpfs module not installed' >&2; exit 1; }",
# SELinux: let the fleet-agent's chrony probe transition to chronyc_t under
# NoNewPrivileges. The agent (unconfined_service_t) shells out to `chronyc -n
# tracking` for clock offset/source/stratum; the shipped policy transitions
# chronyc into chronyc_t, but the hardened unit's NNP (explicit + forced by
# DynamicUser/SystemCallFilter/MDWE) makes SELinux require process2:nnp_transition
# for that move, which the base policy doesn't grant -> `denied { nnp_transition }`
# -> chronyc never runs -> all chrony_* health fields stay empty. Ship a minimal
# allow (docs/stig-deviations.md). Installed unconditionally like the modules
# above (the rule is inert without the agent). checkpolicy ensured above. Same
# policy-store-rebuild reproducibility caveat as chrony/fapolicyd.
"echo '==> supplemental: SELinux module fleet_agent_chronyc (fleet-agent chronyc under NNP)'",
"checkmodule -M -m -o /tmp/fleet_agent_chronyc.mod /tmp/stig/fleet-agent-chronyc.te",
"semodule_package -o /tmp/fleet_agent_chronyc.pp -m /tmp/fleet_agent_chronyc.mod",
"semodule -i /tmp/fleet_agent_chronyc.pp",
"rm -f /tmp/fleet_agent_chronyc.mod /tmp/fleet_agent_chronyc.pp",
"semodule -l | grep -q '^fleet_agent_chronyc' && echo '==> SELinux module fleet_agent_chronyc installed' || { echo 'ERROR: fleet_agent_chronyc module not installed' >&2; exit 1; }",
"rm -rf /tmp/stig",
"echo '==> STIG remediation complete (report at /root/stig-report.html, ARF at /root/stig-arf.xml)'",
]