Adding secure NTP

docs/stig-deviations.md

@@ -109,8 +109,9 @@ SELinux user (`semanage login`) so the `staff_r`→`sysadm_r` sudo transition is
 authorized at runtime. `staff_u` (not `sysadm_u`) is used so SSH login isn't gated
 by the `ssh_sysadm_login` boolean. **⚠ Two bench gates before trusting:** (a)
 admin SSH login + `sudo` + every privileged op must work under `staff_u`
-confinement — if it locks out, `enable_stig=false` is the escape hatch and this
-reverts to a justified deviation; (b) reproducibility — `semanage` rebuilds the
+confinement — if it locks out, waive the offending rule in the tailoring as a
+justified deviation (STIG is now enforced-true — there is no `enable_stig=false`
+escape hatch, POA&M P-03); (b) reproducibility — `semanage` rebuilds the
 SELinux policy store, so confirm the verity hash is stable across two builds (and
 normalize in 2d hygiene if it drifts).
 
@@ -135,7 +136,8 @@ reboot** — it cannot exfiltrate data, alter the read-only root, or bypass auth
 a shell. Authenticated reboot paths (`systemctl reboot` over the key-only admin
 SSH session) are unaffected either way. The console itself is otherwise locked
 down (kiosk autologin to a single locked browser; no getty shell on tty1;
-`debug_shell` is lab-only and never shipped). If a future deployment wants the
+the `debug_shell` back-door was removed from the template entirely, 2026-07-11).
+If a future deployment wants the
 hotkey disabled (e.g. a physically exposed terminal), re-select both rule IDs.
 
 ## 14. Local SELinux policy module `chrony_dhcp_dispatcher` (added 2026-07-03)
@@ -214,7 +216,9 @@ turns app-allowlisting ON for the whole root at runtime for the first time**, so
 **BENCH-VERIFY HARD:** boot + kiosk render + admin SSH + sudo + TPM enrolment all
 still work (nothing legit is untrusted — the 4 custom binaries + rpmdb are trusted),
 a novel `/tmp` binary is now **blocked** (EPERM), and no new AVCs (extend the `.te`
-if any). `enable_stig=false` is the escape hatch if it regresses the boot/secure path.
+if any). If it regresses the boot/secure path, waive the offending rule in the
+tailoring as a justified deviation — STIG is enforced-true (no `enable_stig=false`
+escape hatch, POA&M P-03).
 
 **VERIFIED 2026-07-04 (build `fapolicyd-tmpfs-12043d3`, host `comet-beacon-54`) —
 enforcing, no false positives.** `fapolicyd active (running)`, `permissive = 0`,