Audiobuzz 4e9ab45d34 2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules ...

The per-user rule elevated fine at runtime (bench-verified staff_u->sysadm_r on
comet-beacon-54) but scanned fail: the OVAL patterns are ^\s*%\w+.*TYPE=/ROLE=,
so only a %group rule can pass. Write the drop-in as %wheel (the admin is a
wheel member; same file 2c wrote, so no unconfined per-user rule survives).

2026-07-12 06:43:00 +00:00

..

design-v2-errata.md

tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

2026-07-03 02:51:38 +00:00

diskless-fleet-design-v2.pdf

Initial commit

2026-06-12 01:46:29 +00:00

fleet-management-design.md

docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

2026-07-10 22:45:00 +00:00

irap-poam.md

Adding secure NTP

2026-07-11 17:32:05 +09:30

irap-sar.md

Adding secure NTP

2026-07-11 17:32:05 +09:30

oqe-collection.md

Adding rsyslog tls

2026-07-12 14:04:19 +09:30

secure-boot-keys.md

Update SSP

2026-06-25 23:46:42 +00:00

secure-ntp-design.md

secure-ntp: label /run/chrony-dhcp so chronyd can read the NTS source under SELinux

2026-07-12 02:53:05 +00:00

ssh-host-certificate-design.md

docs: cite clean build 28d31e4 for F-02 bench-verification

2026-07-11 11:31:57 +00:00

ssp-annex-a-ism-residual-risk.md

docs(ssp): flip F-03/R-17 NTS to bench-verified (2026-07-12, clean build 5294860)

2026-07-12 05:47:11 +00:00

ssp.md

docs(ssp): flip F-03/R-17 NTS to bench-verified (2026-07-12, clean build 5294860)

2026-07-12 05:47:11 +00:00

stig-deviations.md

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

2026-07-12 06:43:00 +00:00

TODO.md

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

2026-07-12 06:43:00 +00:00

tpm-enrolment-design.md

ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench

2026-07-11 09:44:33 +00:00