Audiobuzz
d9d2b50bfb
The build failed: checkmodule rejected `policy_module(chrony_dhcp_dispatcher,
1.0.0)` with "Building a policy module, but no module specification found".
policy_module() is a refpolicy m4 macro expanded only by the refpolicy Makefile
(/usr/share/selinux/devel), not by checkmodule. Use the raw module-policy
declaration `module chrony_dhcp_dispatcher 1.0.0;`, which is exactly what
checkmodule -M -m parses. require{} + allow rule unchanged.
26 lines
1.3 KiB
Plaintext
26 lines
1.3 KiB
Plaintext
# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
|
|
# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
|
|
# Makefile (/usr/share/selinux/devel) and checkmodule rejects it ("no module
|
|
# specification found"). `module <name> <version>;` is what checkmodule wants.
|
|
module chrony_dhcp_dispatcher 1.0.0;
|
|
|
|
########################################
|
|
# Let chronyd reply to the chronyc that our NetworkManager dispatcher script
|
|
# runs. files/etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp loads DHCP
|
|
# option-42 NTP servers with `chronyc reload sources`. That chronyc runs in the
|
|
# confined custom-dispatcher domain (NetworkManager_dispatcher_custom_t), so its
|
|
# reply socket is labeled with that domain, and the shipped policy has no rule
|
|
# for chronyd_t -> that socket. Result (enforcing): chronyd processes the reload
|
|
# but its ack `sendto` is DENIED — chronyc reports failure and the AVC floods the
|
|
# SIEM. This one allow closes it. Minimal + auditable; justified in
|
|
# docs/stig-deviations.md. If a follow-on AVC appears on the bench, extend here.
|
|
########################################
|
|
|
|
require {
|
|
type chronyd_t;
|
|
type NetworkManager_dispatcher_custom_t;
|
|
class unix_dgram_socket sendto;
|
|
}
|
|
|
|
allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;
|