Audiobuzz
a46e5edf69
The tracking.log read was still returning empty under enforcing with NO AVC —
the tell of a DAC (not SELinux) denial. Root cause: /var/log/chrony is mode
0750 chrony:chrony (others have no access), so the agent's DynamicUser (group
tss only) can't even traverse the directory to reach the 0644 tracking.log —
EACCES on open, which produces no audit record. Manager confirmed genuinely on
fleet-manager-1db3977 (chrony-capable), and uptime flowed while chrony didn't,
proving the agent was sending empty chrony (failed read), not a manager gap.
Earlier manual reads worked only as root (sudo) or because fleetadmin had been
usermod'd into chrony during the socket test (reverted on reboot — /etc/group
is on the volatile overlay).
Fix: SupplementaryGroups=tss chrony on the unit — the chrony group has r-x on
the 0750 dir so the agent can traverse it; the log file is world-readable. This
is the DAC half; the fleet_agent_chronylog SELinux module (02a6621) is the TE
half — BOTH are required (verified: group-only -> TE-denied; module-only ->
DAC-denied silently). Corrected the now-stale 'no group' code comment; recorded
the two-layer requirement in the .te and stig-deviations #16. Needs a
workstation image rebuild + reboot.
60 lines
2.3 KiB
Desktop File
60 lines
2.3 KiB
Desktop File
[Unit]
|
|
Description=Fleet on-host control-plane agent (telemetry: TPM-mTLS to fleet-manager)
|
|
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/fleet-management-design.md
|
|
# Needs the network up to dial the manager; hostapi is a SOFT dep (facts source) —
|
|
# After, not Requires, so the agent still streams health if hostapi is down.
|
|
After=network-online.target fleet-hostapi.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=exec
|
|
EnvironmentFile=/etc/fleet-agent/agent.env
|
|
ExecStart=/usr/local/bin/fleet-agent
|
|
# Always retry — a diskless box has nothing better to do than reconnect. The agent
|
|
# also self-reconnects the stream; Restart covers a hard crash / TPM transient.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# --- sandboxing (STIG-friendly; looser than hostapi — needs the TPM + egress) ---
|
|
# Runs as a transient unprivileged user. Groups:
|
|
# tss — /dev/tpmrm0 (the private key stays in the TPM; the agent only signs
|
|
# the TLS handshake through it).
|
|
# chrony — TRAVERSE /var/log/chrony to read tracking.log for the clock-health
|
|
# probe. That dir is mode 0750 chrony:chrony (others have no access), so
|
|
# DAC needs group membership to even enter it — a bare 0644 on the log
|
|
# file isn't enough. (SELinux read of the chronyd_var_log_t label is a
|
|
# SEPARATE layer, granted by the fleet_agent_chronylog module.)
|
|
DynamicUser=yes
|
|
SupplementaryGroups=tss chrony
|
|
# Expose ONLY the TPM resource-manager node (no PrivateDevices — that would hide it).
|
|
DeviceAllow=/dev/tpmrm0 rw
|
|
DevicePolicy=closed
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectProc=default
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
# INET egress to the manager (not loopback-only, unlike hostapi); AF_UNIX for the
|
|
# journal, AF_NETLINK for Go's source-address/interface selection.
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|