Audiobuzz
02a6621a19
The tracking.log approach (4ca0b6d) works in permissive but is blocked under
enforcing: chrony's log is labeled chronyd_var_log_t, confined by the shipped
policy to chronyd_t despite the 0644 mode. Verified on comet-beacon-54 — a
non-root read succeeds permissive, but under enforcing even a STIG-confined
admin (staff_t) gets Permission denied (ls -Z on the file is itself blocked).
The agent runs unconfined_service_t (confirmed via ps -eZ) and is denied the
same way.
Ship a minimal read-only allow module (files/stig/fleet-agent-chronylog.te):
allow unconfined_service_t chronyd_var_log_t:file { open read getattr } + dir
search to reach it. No write, no other chrony access, and no domain transition
(the agent reads a file; it does not exec chronyc) — narrower than the
abandoned nnp-transition module. Built + semodule -i'd in 2c-STIG alongside the
existing chrony_dhcp_dispatcher / fapolicyd_tmpfs modules. docs/stig-deviations
#16. Needs a workstation image rebuild + reboot; same policy-store-rebuild
reproducibility re-check as #14/#15.
36 lines
1.9 KiB
Plaintext
36 lines
1.9 KiB
Plaintext
# Raw module-policy syntax (compiled with `checkmodule -M -m`), NOT the refpolicy
|
|
# `policy_module()` m4 macro — that macro is only expanded by the refpolicy
|
|
# Makefile and checkmodule rejects it. See chrony-dhcp-dispatcher.te for the why.
|
|
module fleet_agent_chronylog 1.0.0;
|
|
|
|
########################################
|
|
# Let the fleet-agent READ chrony's tracking log under enforcing SELinux.
|
|
#
|
|
# fleet-agent (telemetry) reports clock health (source/stratum/offset) by reading
|
|
# /var/log/chrony/tracking.log (chronyd appends a line per clock update; enabled
|
|
# via `log tracking`). The agent runs as unconfined_service_t. chrony's log dir +
|
|
# files are labeled chronyd_var_log_t, and the shipped policy confines that type
|
|
# to chronyd_t + log-admin roles — so although the file is mode 0644, under
|
|
# enforcing the read is DENIED by type enforcement (DAC allows, TE does not).
|
|
# Verified 2026-07-10 on comet-beacon-54: with SELinux enforcing even a
|
|
# STIG-confined admin login (staff_t) gets "Permission denied" reading it, though
|
|
# a permissive-mode read succeeds — the tell-tale of a type-enforcement block.
|
|
#
|
|
# This grants ONLY read (open/read/getattr) on the chrony log type plus dir search
|
|
# to reach the file — no write, no other chrony access, and NO domain transition
|
|
# (the agent reads a file; it does not exec chronyc). Minimal + auditable;
|
|
# justified in docs/stig-deviations.md #16. BENCH-VERIFY: the manager's Monitor
|
|
# chrony row populates on an enforcing boot; extend here only if a related chrony
|
|
# log AVC appears. Same policy-store-rebuild reproducibility caveat as #14/#15.
|
|
########################################
|
|
|
|
require {
|
|
type unconfined_service_t;
|
|
type chronyd_var_log_t;
|
|
class dir { search getattr open };
|
|
class file { open read getattr };
|
|
}
|
|
|
|
allow unconfined_service_t chronyd_var_log_t:dir { search getattr open };
|
|
allow unconfined_service_t chronyd_var_log_t:file { open read getattr };
|