Audiobuzz
835ae7bc24
The NM dispatcher 10-chrony-dhcp-ntp runs `chronyc reload sources` to load DHCP option-42 NTP servers. That chronyc runs in the confined custom-dispatcher domain (NetworkManager_dispatcher_custom_t), so its reply socket carries that label and the shipped policy has no rule for chronyd_t to sendto it. Under enforcing, chronyd does the reload but its ack is denied — chronyc reports failure and the AVC floods the SIEM (seen 2026-07-03; permissive=1 only because the box was booted enforcing=0). Ship a minimal local allow module (files/stig/chrony-dhcp-dispatcher.te): allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto; Built + semodule -i'd in the 2c-STIG provisioner (checkpolicy installed if absent), with an install assertion. `allow` not `dontaudit` — it also lets the reload ack succeed so chronyc returns cleanly. Documented as docs/stig-deviations.md #14 (not a rule waiver — a local functional allow). BENCH-VERIFY: enforcing boot shows no AVC, chronyc reload returns 0, a DHCP-handed NTP server appears in `chronyc sources`; and re-check verity-hash reproducibility (semodule rebuilds the policy store, like the semanage step).
22 lines
1.0 KiB
Plaintext
22 lines
1.0 KiB
Plaintext
policy_module(chrony_dhcp_dispatcher, 1.0.0)
|
|
|
|
########################################
|
|
# Let chronyd reply to the chronyc that our NetworkManager dispatcher script
|
|
# runs. files/etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp loads DHCP
|
|
# option-42 NTP servers with `chronyc reload sources`. That chronyc runs in the
|
|
# confined custom-dispatcher domain (NetworkManager_dispatcher_custom_t), so its
|
|
# reply socket is labeled with that domain, and the shipped policy has no rule
|
|
# for chronyd_t -> that socket. Result (enforcing): chronyd processes the reload
|
|
# but its ack `sendto` is DENIED — chronyc reports failure and the AVC floods the
|
|
# SIEM. This one allow closes it. Minimal + auditable; justified in
|
|
# docs/stig-deviations.md. If a follow-on AVC appears on the bench, extend here.
|
|
########################################
|
|
|
|
require {
|
|
type chronyd_t;
|
|
type NetworkManager_dispatcher_custom_t;
|
|
class unix_dgram_socket sendto;
|
|
}
|
|
|
|
allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;
|