Audiobuzz 943f3e29ce tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17) ...

Its OVAL requires a literal ^server line in the baked chrony.conf, which can
never exist under secure_ntp: the fail-closed re-strip removes every static
server and the NTS source is derived at runtime into /run/chrony-dhcp. Surfaced
as the single REVIEW row on scan poam-hardening-4e9ab45 (the first full scan of
the post-secure-ntp merge).

2026-07-12 09:25:02 +00:00

..

design-v2-errata.md

tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100

2026-07-03 02:51:38 +00:00

diskless-fleet-design-v2.pdf

Initial commit

2026-06-12 01:46:29 +00:00

fleet-management-design.md

docs: reflect chrony/uptime metrics, agent-cert renewer, and the chrony-access findings

2026-07-10 22:45:00 +00:00

irap-poam.md

Adding secure NTP

2026-07-11 17:32:05 +09:30

irap-sar.md

Adding secure NTP

2026-07-11 17:32:05 +09:30

oqe-collection.md

Adding rsyslog tls

2026-07-12 14:04:19 +09:30

secure-boot-keys.md

Update SSP

2026-06-25 23:46:42 +00:00

secure-ntp-design.md

secure-ntp: label /run/chrony-dhcp so chronyd can read the NTS source under SELinux

2026-07-12 02:53:05 +00:00

ssh-host-certificate-design.md

docs: cite clean build 28d31e4 for F-02 bench-verification

2026-07-11 11:31:57 +00:00

ssp-annex-a-ism-residual-risk.md

docs(ssp): flip F-03/R-17 NTS to bench-verified (2026-07-12, clean build 5294860)

2026-07-12 05:47:11 +00:00

ssp.md

docs(ssp): flip F-03/R-17 NTS to bench-verified (2026-07-12, clean build 5294860)

2026-07-12 05:47:11 +00:00

stig-deviations.md

tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17)

2026-07-12 09:25:02 +00:00

TODO.md

2c-STIG: sudo SELinux elevation rule must be %wheel — SSG OVAL only matches %group sudoers rules

2026-07-12 06:43:00 +00:00

tpm-enrolment-design.md

ssh-hostcert + enrol-broker: fix defects surfaced by the F-02 bench

2026-07-11 09:44:33 +00:00