stig-hardening: first-boot SELinux relabel + FIPS PAM (default and subrelease-90)

[dcasota]

Summary

Add the first-boot SELinux relabel service and the FIPS PAM fixes to stig-hardening, across the maintained 5.0 subrelease variants:

• SPECS/stig-hardening (subrelease ≥ 92; also used by 91) → 2.1-10
• SPECS/90/stig-hardening (subrelease 90) → 2.1-5.1.3

Both add:

• fix-selinux-relabel-first-boot.patch — first-boot SELinux relabel service for unlabeled filesystems.
• fix-stig-playbook-fips-pam.patch — PHTN-50-000192 pam_faillock guard, FIPS module config, IMA hash.

Why the relabel service is needed

The installer kernel has SELinux compiled in but boots with no policy loaded, so lsetxattr for security.selinux returns EINVAL and install-time labeling is impossible. Every file the STIG Ansible playbook writes during installation therefore lands as unlabeled_t. When the installed system boots with SELINUX=enforcing, confined processes are denied access to those files.

Ordering fix — the relabel must run before the units that read those files

The service originally declared only:

Before=getty-pre.target sysinit.target

That is not sufficient. systemd-sysctl.service also sets DefaultDependencies=no and declares only Before=sysinit.target, so the two units are each ordered against that target but not against each other — systemd is free to run them in either order. On a measured STIG install it ran systemd-sysctl first:

18:19:23  Starting Apply Kernel Variables...
18:19:23  AVC denied { read } comm="systemd-sysctl"
              name="zz-stig-hardening.conf" tcontext=unlabeled_t permissive=0
18:19:23  systemd-sysctl: Failed to open file '/etc/sysctl.d/zz-stig-hardening.conf'
18:19:23  Failed to start Apply Kernel Variables.
18:19:24  Starting SELinux Relabel Filesystem (first boot)...   <- one second later

systemd-sysctl aborts on the first unreadable file, so every kernel parameter in zz-stig-hardening.conf is silently absent for the whole first boot. On a system installed specifically to be STIG-hardened that is a compliance gap, not the cosmetic first-boot noise the patch header previously described — so the "known limitation / a reboot resolves all failures" note has been replaced with the fix.

The service now also declares:

Before=systemd-sysctl.service auditd.service systemd-networkd.service

systemd-sysctl.service is DefaultDependencies=no, so an explicit Before= is the only thing that can constrain it. Applied to both the default and the subrelease-90 copies.

Testing

Reproduced and diagnosed on permutations k03 (minimal / POI 2.8 / STIG / ext4 / kickstart) and k04 (same, btrfs) — filesystem-independent, identical failure on both:

	before
guest.failed_units	1 — systemd-sysctl.service failed
AVC denials on first boot	55 (auditctl 50, chmod 31, modprobe, iptables, sshd-session)
denials after the relabel completes	0

The relabel itself works correctly — zero denials after it runs, which is why a reboot cleared the symptom. Only the ordering was wrong.

Rebased onto current 5.0 (the earlier branch was ~124 commits behind, which made the diff noisy); the change touches only stig-hardening.

🤖 Generated with Claude Code