CMP-3618 added chrony-wait fix

[vickeybrown]

Description:

Fixed chrony-wait.service timeout failures when "cmdport 0" is configured by the "chronyd_no_chronyc_network" rule. The default chrony-wait.service uses -h 127.0.0.1,::1 which forces network connection to chronyd's command port, but the STIG-required cmdport 0 setting disables network access. This causes chrony-wait.service to timeout and fail, preventing time-sync.target from being reached.

The fix replaces the entire chrony-wait.service unit file to:

1. Remove the -h flag so chronyc uses the Unix socket at /run/chrony/chronyd.sock
2. Remove PrivateUsers=yes and other sandboxing restrictions that block Unix socket access

Rationale:

The "chronyd_no_chronyc_network" rule implements STIG requirements by setting "cmdport 0" to disable network access to chronyd's command port, while enabling local access via bindcmdaddress/run/chrony/chronyd.sock. However, chrony-wait.service bypasses the Unix socket by hard-coding network addresses, causing it to fail when cmdport is disabled. This breaks time synchronization verification on RHCOS nodes and can cause compliance remediation failures in OpenShift environments.

Review Hints:

Testing on OpenShift/RHCOS:

# Apply the chronyd_no_chronyc_network remediation
oc patch complianceremediation/<name> -n openshift-compliance --type=merge -p '{"spec":{"apply":true}}' 

# After MachineConfig applies, verify on a node:
oc debug node/<worker-node> 
chroot /host

# Verify chrony.conf has the required settings
grep -E '(cmdport|bindcmdaddress)' /etc/chrony.conf
# Should show: 
# cmdport 0
# bindcmdaddress /run/chrony/chronyd.sock

# Verify the replacement service file exists                                                              
cat /etc/systemd/system/chrony-wait.service
# Should have: ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1 (no -h flag)                               

# Verify chrony-wait.service succeeds
systemctl status chrony-wait.service
# Should show: Active: active (exited)

[openshift-ci]

Hi @vickeybrown. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yuumasato]

/ok-to-test

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_client_only' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_client_only
+++ xccdf_org.ssgproject.content_rule_chronyd_client_only
@@ -22,3 +22,8 @@
         mode: 420
         overwrite: true
         path: /etc/chrony.d/ntp-server.conf
+      - contents:
+          source: data:,{{ %5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A }}
+        mode: 420
+        overwrite: true
+        path: /etc/systemd/system/chrony-wait.service

bash remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
+++ xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
@@ -1,6 +1,7 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel-core && { rpm --quiet -q chrony; }; then
 
+# Disable network access to chronyd command port
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.
 stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^cmdport")
@@ -23,6 +24,83 @@
     printf '%s\n' "$formatted_output" >> "/etc/chrony.conf"
 fi
 
+# Enable Unix domain socket for local chronyc access (allows chrony-wait.service to function)
+# Strip any search characters in the key arg so that the key can be replaced without
+# adding any search characters to the config file.
+stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^bindcmdaddress")
+
+# shellcheck disable=SC2059
+printf -v formatted_output "%s %s" "$stripped_key" "/run/chrony/chronyd.sock"
+
+# If the key exists, change it. Otherwise, add it to the config_file.
+# We search for the key string followed by a word boundary (matched by \>),
+# so if we search for 'setting', 'setting2' won't match.
+if LC_ALL=C grep -q -m 1 -i -e "^bindcmdaddress\\>" "/etc/chrony.conf"; then
+    escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
+    LC_ALL=C sed -i --follow-symlinks "s/^bindcmdaddress\\>.*/$escaped_formatted_output/gi" "/etc/chrony.conf"
+else
+    if [[ -s "/etc/chrony.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/chrony.conf" || true)" ]]; then
+        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/chrony.conf"
+    fi
+    printf '%s\n' "$formatted_output" >> "/etc/chrony.conf"
+fi
+
+# Fix chrony-wait.service to use Unix socket instead of network socket
+# The default service uses -h 127.0.0.1,::1 which fails when cmdport is 0
+# Replace the entire service to remove PrivateUsers and other restrictions (KCS 7064388)
+if systemctl list-unit-files chrony-wait.service >/dev/null 2>&1; then
+    cat > /etc/systemd/system/chrony-wait.service << 'EOF'
+[Unit]
+Description=Wait for chrony to synchronize system clock (KCS 7064388)
+Documentation=man:chronyc(1)
+After=chronyd.service
+Requires=chronyd.service
+Before=time-sync.target
+Wants=time-sync.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
+TimeoutStartSec=180
+RemainAfterExit=yes
+StandardOutput=null
+
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
+DevicePolicy=closed
+IPAddressAllow=localhost
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+PrivateDevices=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+UMask=0777
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    systemctl enable chrony-wait.service
+fi
+
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
+++ xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
@@ -53,3 +53,149 @@
   - low_severity
   - no_reboot_needed
   - restrict_strategy
+
+- name: Disable network management of chrony daemon
+  block:
+
+  - name: Check for duplicate values
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      create: true
+      regexp: (?i)^\s*bindcmdaddress\s+
+      state: absent
+    check_mode: true
+    changed_when: false
+    register: dupes
+
+  - name: Deduplicate values from /etc/chrony.conf
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      create: true
+      regexp: (?i)^\s*bindcmdaddress\s+
+      state: absent
+    when: dupes.found is defined and dupes.found > 1
+
+  - name: Insert correct line to /etc/chrony.conf
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      create: true
+      regexp: (?i)^\s*bindcmdaddress\s+
+      line: bindcmdaddress /run/chrony/chronyd.sock
+      state: present
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"chrony" in ansible_facts.packages'
+  tags:
+  - CCE-82840-0
+  - DISA-STIG-RHEL-08-030742
+  - NIST-800-53-CM-7(1)
+  - chronyd_no_chronyc_network
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Check if chrony-wait.service exists
+  ansible.builtin.stat:
+    path: /usr/lib/systemd/system/chrony-wait.service
+  register: chrony_wait_service
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"chrony" in ansible_facts.packages'
+  tags:
+  - CCE-82840-0
+  - DISA-STIG-RHEL-08-030742
+  - NIST-800-53-CM-7(1)
+  - chronyd_no_chronyc_network
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Replace chrony-wait.service to use Unix socket (KCS 7064388)
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/chrony-wait.service
+    content: |
+      [Unit]
+      Description=Wait for chrony to synchronize system clock (KCS 7064388)
+      Documentation=man:chronyc(1)
+      After=chronyd.service
+      Requires=chronyd.service
+      Before=time-sync.target
+      Wants=time-sync.target
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
+      TimeoutStartSec=180
+      RemainAfterExit=yes
+      StandardOutput=null
+
+      CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+      CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
+      CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
+      CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
+      CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
+      DevicePolicy=closed
+      IPAddressAllow=localhost
+      IPAddressDeny=any
+      LockPersonality=yes
+      MemoryDenyWriteExecute=yes
+      PrivateDevices=yes
+      ProcSubset=pid
+      ProtectClock=yes
+      ProtectControlGroups=yes
+      ProtectHome=yes
+      ProtectHostname=yes
+      ProtectKernelLogs=yes
+      ProtectKernelModules=yes
+      ProtectKernelTunables=yes
+      ProtectProc=invisible
+      ProtectSystem=strict
+      RestrictAddressFamilies=AF_UNIX
+      RestrictNamespaces=yes
+      RestrictRealtime=yes
+      SystemCallArchitectures=native
+      SystemCallFilter=@system-service
+      SystemCallFilter=~@privileged @resources
+      UMask=0777
+
+      [Install]
+      WantedBy=multi-user.target
+    mode: '0644'
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"chrony" in ansible_facts.packages'
+  - chrony_wait_service.stat.exists
+  tags:
+  - CCE-82840-0
+  - DISA-STIG-RHEL-08-030742
+  - NIST-800-53-CM-7(1)
+  - chronyd_no_chronyc_network
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Reload systemd daemon and enable chrony-wait.service
+  ansible.builtin.systemd:
+    name: chrony-wait.service
+    daemon_reload: true
+    enabled: true
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"chrony" in ansible_facts.packages'
+  - chrony_wait_service.stat.exists
+  tags:
+  - CCE-82840-0
+  - DISA-STIG-RHEL-08-030742
+  - NIST-800-53-CM-7(1)
+  - chronyd_no_chronyc_network
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - restrict_strategy

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
+++ xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
@@ -22,3 +22,8 @@
         mode: 420
         overwrite: true
         path: /etc/chrony.d/ntp-server.conf
+      - contents:
+          source: data:,{{ %5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A }}
+        mode: 420
+        overwrite: true
+        path: /etc/systemd/system/chrony-wait.service

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll
+++ xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll
@@ -22,3 +22,8 @@
         mode: 420
         overwrite: true
         path: /etc/chrony.d/ntp-server.conf
+      - contents:
+          source: data:,{{ %5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A }}
+        mode: 420
+        overwrite: true
+        path: /etc/systemd/system/chrony-wait.service

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers
+++ xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers
@@ -22,3 +22,8 @@
         mode: 420
         overwrite: true
         path: /etc/chrony.d/ntp-server.conf
+      - contents:
+          source: data:,{{ %5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A }}
+        mode: 420
+        overwrite: true
+        path: /etc/systemd/system/chrony-wait.service

kubernetes remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server' differs.
--- xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server
+++ xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server
@@ -22,3 +22,8 @@
         mode: 420
         overwrite: true
         path: /etc/chrony.d/ntp-server.conf
+      - contents:
+          source: data:,{{ %5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A }}
+        mode: 420
+        overwrite: true
+        path: /etc/systemd/system/chrony-wait.service

[Mab879]

Thanks for the PR.

1. I would suggest putting this fix into a new rules

[Mab879]

Suggested change

	- name: Check if chrony-wait.service exists
	- name: "{{{ rule_title }} - Check if chrony-wait.service exists"

[Mab879]

Suggested change

	- name: Replace chrony-wait.service to use Unix socket (KCS 7064388)
	- name: {{{ rule_title }}} - Replace chrony-wait.service to use Unix socket (KCS 7064388)

[vickeybrown]

I broke the change into its own rule, and added it to the profiles that currently have the "chronyd_no_chronyc_network" rule since that was what was causing the issue - not sure if that's the move or not so let me know if it needs adjustment

[Mab879]

The CI fails are valid, please take a look.

Also, please organize commits before we merge this.

[Mab879]

/ok-to-test

[openshift-ci]

@vickeybrown: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.16-images	2c3e53f	link	true	/test 4.16-images
ci/prow/e2e-aws-openshift-platform-compliance	2c3e53f	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.