stig-hardening: first-boot SELinux relabel + FIPS PAM (default and subrelease-90) - #9
Closed
dcasota wants to merge 2 commits into
Closed
stig-hardening: first-boot SELinux relabel + FIPS PAM (default and subrelease-90)#9dcasota wants to merge 2 commits into
dcasota wants to merge 2 commits into
Conversation
dcasota
force-pushed
the
fix-selinux-relabel
branch
2 times, most recently
from
April 12, 2026 22:10
f15326d to
66b2757
Compare
dcasota
force-pushed
the
fix-selinux-relabel
branch
from
May 11, 2026 20:55
66b2757 to
d85f14a
Compare
This was referenced Jun 5, 2026
dcasota
force-pushed
the
fix-selinux-relabel
branch
from
June 6, 2026 02:33
d85f14a to
a6edd63
Compare
dcasota
changed the title
Edgarruiz8585
approved these changes
Jul 6, 2026
Edgarruiz8585
left a comment
Edgarruiz8585
left a comment
There was a problem hiding this comment.
Verificado por Edgarruiz8585 Verificado e integración dentro de Edgarruiz8585 🆗 👍🏾💜
dcasota
force-pushed
the
fix-selinux-relabel
branch
2 times, most recently
from
September 1, 2026 10:08
100096c to
044e89f
Compare
dcasota
force-pushed
the
fix-selinux-relabel
branch
2 times, most recently
from
September 9, 2026 11:16
c20d780 to
d9736ed
Compare
Repository owner
deleted a comment from
Edgarruiz8585
Sep 9, 2026
…brelease-90) Rebased onto the current 5.0 head, clearing the conflict this PR had been sitting in. fix-selinux-relabel-first-boot.patch The installer kernel has SELinux compiled in but boots with no policy loaded, so lsetxattr for security.selinux returns EINVAL and install-time labeling is not possible. Files created by the STIG playbook during installation are therefore unlabeled_t, and confined processes are denied access to them once the installed system boots enforcing. Adds a oneshot selinux-relabel.service that runs restorecon -R / on first boot. fix-stig-playbook-fips-pam.patch PAM faillock guard, FIPS module config, IMA hash. Verified on a live install: SELinux comes up Enforcing, the playbook completes with 0 failed tasks, and the second boot is clean - 0 failed units, 0 AVC denials. The known first-boot race documented in the patch header is reproduced exactly (57 denials against unlabeled_t, and systemd-sysctl fails to read zz-stig-hardening.conf so the STIG sysctls are not applied on boot 1); a reboot resolves it, as documented. Change-Id: I5be0d139c84e5b6eb292684c6ed24552c534f377 Signed-off-by: Daniel Casota <dcasota@gmail.com>
…book files
selinux-relabel.service declared only Before=getty-pre.target
sysinit.target. systemd-sysctl.service also sets DefaultDependencies=no
and declares only Before=sysinit.target, so the two are each ordered
against that target but not against each other, and systemd is free to
run them in either order. Measured on a STIG install, it ran
systemd-sysctl first:
18:19:23 Starting Apply Kernel Variables...
18:19:23 AVC denied { read } comm="systemd-sysctl"
name="zz-stig-hardening.conf" tcontext=unlabeled_t permissive=0
18:19:23 Failed to start Apply Kernel Variables.
18:19:24 Starting SELinux Relabel Filesystem (first boot)...
The playbook writes zz-stig-hardening.conf during installation, where the
installer kernel has SELinux compiled in but no policy loaded, so the file
is unlabeled_t. Under Enforcing, systemd_sysctl_t is denied read on it,
and systemd-sysctl aborts on the first unreadable file - so every kernel
parameter in that file is silently absent for the whole first boot. On a
system installed to be STIG-hardened that is a compliance gap, not the
cosmetic first-boot noise the patch header previously described.
Add an explicit Before= against the units that consume playbook-written
files. Both the default and the subrelease-90 copies are updated.
Change-Id: Iddb0543f8077297151d2d9da2b345eb4f9dc061f
Signed-off-by: Daniel Casota <dcasota@gmail.com>
dcasota
force-pushed
the
fix-selinux-relabel
branch
from
September 9, 2026 20:08
d9736ed to
7e55681
Compare
Owner
Author
|
Replaced by #31. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(obsolete)