[dcasota]

Problem

The installer kernel has SELinux compiled in but boots with no policy loaded, so lsetxattr for security.selinux returns EINVAL and files cannot be labeled at install time. Every file the STIG playbook writes during installation therefore lands as unlabeled_t, and confined processes are denied access to them once the installed system boots enforcing.

Ordering a first-boot relabel only against sysinit.target is not enough: systemd-sysctl.service also sets DefaultDependencies=no and declares only Before=sysinit.target, so the two units are not ordered against each other. On a STIG install systemd runs systemd-sysctl first:

Starting Apply Kernel Variables...
AVC denied { read } comm="systemd-sysctl"
    name="zz-stig-hardening.conf" tcontext=unlabeled_t permissive=0
Failed to start Apply Kernel Variables.
Starting SELinux Relabel Filesystem (first boot)...

systemd-sysctl aborts on the first unreadable file, so every kernel parameter in zz-stig-hardening.conf is absent for the whole first boot - a compliance gap on a system installed to be STIG-hardened.

The playbook also has three FIPS/PAM defects:

• PHTN-50-000192: regex_search() in set_fact returns None when nothing matches, preauthsearch == "" is then false, the cleanup step is skipped while the add steps run, and the PAM auth stack gets duplicate pam_faillock.so entries.
• With fips=1, IMA still defaults to sha1, which FIPS mode disables.
• When the FIPS provider is present but /etc/ssl/fipsmodule.cnf is missing, OpenSSL cannot initialise FIPS mode under fips=1 and pam_unix.so cannot verify passwords.

Change

Two new patches to the playbook, in both maintained 5.0 copies of stig-hardening:

• fix-selinux-relabel-first-boot.patch: adds files/selinux-relabel.service to the role and, as the last task of tasks/photon.yml, when /etc/selinux/config has SELINUX=enforcing, copies that unit to /etc/systemd/system (an administrator unit, owned by no package), enables it and creates /.selinux-relabel. The oneshot unit runs restorecon -R -e /proc -e /sys -e /dev / on first boot, removes the trigger file, and is ordered After=local-fs.target, Before=getty-pre.target sysinit.target and explicitly Before=systemd-sysctl.service auditd.service systemd-networkd.service.
• fix-stig-playbook-fips-pam.patch: | default('') on the PHTN-50-000192 search results, ima_hash=sha256 added to the kernel command line when fips=1 is set, and openssl fipsinstall generating /etc/ssl/fipsmodule.cnf when fips.so exists and the file does not.

%install copies an explicit list of role directories; files is added to it in both specs, so the unit the copy task needs is packaged.

spec	built for subrelease	release
SPECS/stig-hardening/stig-hardening.spec (Patch3, Patch4)	>= 91	2.1-9 -> 2.1-10
SPECS/90/stig-hardening/stig-hardening.spec (Patch2, Patch3)	<= 90	2.1-5.1.2 -> 2.1-5.1.3

Both copies carry byte-identical patch files; the subrelease-90 copy only differs in patch numbering, because it does not have fix-photon.yml-for-latest-audit-and-ansible.patch. Each spec gets one %changelog entry.

Testing

• rpmspec -P (x86_64 and aarch64) succeeds for SPECS/stig-hardening at subreleases 91, 92 and 93 (Release: 10) and for SPECS/90/stig-hardening at subrelease 90 (Release: 5.1.3).
• check_spec.py --mainline 93 exits 0 for SPECS/stig-hardening at subreleases 91, 92 and 93 and for SPECS/90/stig-hardening at subrelease 90.
• stig-hardening-ph5-2.1.tar.gz matches config.yaml's archive_sha512sum; for each spec all its patches apply in spec order with patch -p1 --fuzz=0, the %install copy list succeeds on the patched tree and installs files/selinux-relabel.service, and the patched tasks/photon.yml and vars/main.yml parse as YAML.

🤖 Generated with Claude Code