Audiobuzz
4ca0b6dd06
Bench on comet-beacon-54 proved every command-socket route is blocked for the hardened agent: chronyd's unix socket is owner-write-only (0755, so even a chrony-group member can't connect), and STIG closes the UDP command port (cmdport 0). Rather than re-open a port or expose chrony's privileged socket, enable chronyd's tracking log and have the agent READ it — no port, no socket, no group, no SELinux domain transition, full hardening intact. - chrony.conf: enable 'log tracking' (idempotent) so chronyd appends source/stratum/offset to /var/log/chrony/tracking.log. Write volume is a ~130B line per clock update (backing off to ~maxpoll when stable) and capped by the chrony RPM's logrotate — negligible on the RAM overlay. cmdport 0 stays, so no STIG deviation. - agent: chronyTracking() now reads the last data line of tracking.log via parseTrackingLog() (source f[2], stratum f[3], offset f[6], leap/sync f[7]); replaces the chronyc exec + parseChrony. Unit test swapped accordingly. - revert the two abandoned approaches: drop the bindcmdaddress line (394ad10) and the fleet_agent_chronyc SELinux nnp_transition module + provisioner block (e6fd4a2, .te deleted) — no chronyc exec means no transition to allow. Removed stig-deviations #16 and #17 (both waivers no longer needed). Needs a workstation image rebuild + reboot. BENCH-VERIFY: tracking.log is world-readable so the DynamicUser agent can read it; under enforcing unconfined_service_t can read chronyd_var_log_t (add a minimal file-read allow if denied); and the offset sign matches chronyc on a synced host.
fleet-agent — on-host control-plane client (telemetry v1)
The workstation-side half of the fleet management plane. It dials the
fleet-manager agent plane, identifies with the host's TPM, and streams
health telemetry up. It is the client peer of the server hub in
serving/fleet-manager/ (agent.go + proto/fleet_agent.proto).
Baked into the immutable verity image, so — like fleet-hostapi and fleet-enrol
— it is a static, reproducible, CGO_ENABLED=0 Go binary built out of the
build VM by CI (deps proxy-fetched, go.sum-pinned) and file-provisioned in.
What it does (v1 — telemetry only)
- Reuses the TPM identity for mTLS. Loads the signing key at the persistent
handle (
0x81000100) as acrypto.Signer(tpmkey.LoadSigner— the private key never leaves the TPM) and the enrolment cert from NV (0x01800100), and presents them as the mTLS client cert. The manager verifies the chain to the fleet CA and derives the cert serial = inventory key — a host can only ever report as itself (agent.go:peerSerial). - Opens the long-lived
Sessionbidi stream (host dials out; no inbound host port — works across the OPNsense L3 hop from the host VLAN to the mgmt plane). - Sends
Hello(image version, kernel, kiosk URL, root hash, starship name — the fleet-generic facts, pulled fromfleet-hostapion127.0.0.1:9099). - Sends a
HealthSnapshoteveryFLEET_AGENT_INTERVAL— load/cpu/temp/mem/ tmpfs, nvme-root, 802.1X-macsec, selinux, chrony, kiosk-active — probed read-only from/proc+/sys(each probe degrades gracefully; a failure never kills the stream). - Receives
DesiredState/Commandand LOGS them. This build does not act on them. The reconcile actuators (apply kiosk URL, reboot, drain) are a deliberate follow-up (seedocs/TODO.md#14) — the receive path is wired now so adding them needs no protocol change.
A dropped stream is retried with jittered backoff; the manager treats stream loss as the host going offline.
Prerequisite: the host must already be enrolled
The manager rejects the stream (PermissionDenied) until an inventory record
exists for the host's cert serial — that record is born when an admin approves
the host's TPM enrolment (fleet-enrol → enrol-broker → manager). Enrolment
precedes the agent; this ordering is expected.
Config (/etc/fleet-agent/agent.env)
All values are fleet-generic (invariant #1). See the file for the full list:
FLEET_AGENT_MANAGER (manager host:port), FLEET_AGENT_CA (fleet root, reused
from /etc/dot1x/radius-ca.pem), FLEET_AGENT_HANDLE / FLEET_AGENT_NVINDEX (TPM
identity, mirror rd.dot1x.*), FLEET_AGENT_INTERVAL, FLEET_AGENT_HOSTAPI.
Layout
| file | purpose |
|---|---|
main.go |
config, connect loop (jittered backoff), Session send/recv |
identity.go |
TPM-backed mTLS client cert + fleet-CA-verifying tls.Config |
snapshot.go |
read-only /proc+/sys health probes + hostapi facts fetch |
tpmkey/ |
copy of files/enrol/tpmkey + read-only LoadSigner (see its header) |
proto/ |
copy of the generated fleet.agent.v1 package (one .proto contract, two peers) |
fleet-agent.service |
hardened unit (tss group for the TPM, INET egress) |
Build / test
cd files/agent
CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o bin/fleet-agent .
go test ./...
# TPM handshake end-to-end (go-tpm software simulator, CGO — isolated module):
( cd simtest && CGO_ENABLED=1 go test ./... )