From 96881422451d073a3cdebc0d7ea96a4c52c1af72a4c4db9f9e8e2d713fabb16d Mon Sep 17 00:00:00 2001 From: "Marc S. Weidner" Date: Fri, 10 Oct 2025 20:40:50 +0100 Subject: [PATCH] ## V8.13.128.2025.10.10 Signed-off-by: Marc S. Weidner --- config/hooks/live/0810_chrony_setup.chroot | 42 ++++- config/hooks/live/9996_auditd.chroot | 24 ++- .../root/.ciss/check_chrony.sh | 148 ++++++++++++++++++ config/package-lists/live.list.common.chroot | 1 + docs/CHANGELOG.md | 3 + 5 files changed, 214 insertions(+), 4 deletions(-) create mode 100644 config/includes.chroot/root/.ciss/check_chrony.sh diff --git a/config/hooks/live/0810_chrony_setup.chroot b/config/hooks/live/0810_chrony_setup.chroot index ba36fa5..038315c 100644 --- a/config/hooks/live/0810_chrony_setup.chroot +++ b/config/hooks/live/0810_chrony_setup.chroot @@ -16,7 +16,9 @@ printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" " mkdir -p /var/log/chrony export DEBIAN_FRONTEND="noninteractive" -apt-get install chrony -y +export TZ="Etc/UTC" + +apt-get install -y adjtimex chrony tzdata systemctl enable chrony.service @@ -65,11 +67,47 @@ maxupdateskew 100.0 rtcsync -makestep 1 3 +makestep 0.25 3 EOF chmod 0644 /etc/chrony/chrony.conf +[[ -f /root/.ciss/check_chrony.sh ]] && chmod 0700 /root/.ciss/check_chrony.sh + +### Build right/UTC from tzdata leap table if missing. +if [[ ! -e /usr/share/zoneinfo/right/UTC ]]; then + + install -d -m 0755 /usr/share/zoneinfo/right + + ### Minimal zic source for a fixed UTC zone. + declare -r tmp_src="/tmp/UTC.src" + printf 'Zone UTC 0 - UTC\n' > "${tmp_src}" + + ### Prefer the zic-format leapseconds file. + declare leap_zic="/usr/share/zoneinfo/leapseconds" + + if [[ -s "${leap_zic}" ]]; then + + zic -d /usr/share/zoneinfo/right -L "${leap_zic}" "${tmp_src}" + + else + + echo "WARNING: ${leap_zic} not found; building right/UTC without leap info." >&2 + zic -d /usr/share/zoneinfo/right -L /dev/null "${tmp_src}" + + fi + + rm -f "${tmp_src}" + +fi + +if [[ -e /usr/share/zoneinfo/right/UTC ]]; then + + ### Expect to see 'Sat Dec 31 23:59:60 UTC 2016' rendered in right/UTC + TZ=right/UTC date -ud '2017-01-01 00:00:00 -1 second' || true + +fi + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}" exit 0 diff --git a/config/hooks/live/9996_auditd.chroot b/config/hooks/live/9996_auditd.chroot index c443a5b..d90cf5e 100644 --- a/config/hooks/live/9996_auditd.chroot +++ b/config/hooks/live/9996_auditd.chroot @@ -1,6 +1,6 @@ #!/bin/bash # SPDX-Version: 3.0 -# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; +# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; @@ -346,7 +346,7 @@ if (( ${#rules[@]} == 0 )); then fi if ! /sbin/augenrules --check >/dev/null 2>&1; then - log "ERROR: augenrules --check failed. Fix the *.rules first." + log "ERROR: augenrules --check failed. Fix the /etc/audit/rules.d/*.rules first." exit 128 fi @@ -376,6 +376,26 @@ fi log "Done. /etc/audit/audit.rules generated at build-time (no kernel load)." +mkdir -p /etc/systemd/system/audit-rules.service.d + +cat << EOF >| /etc/systemd/system/audit-rules.service.d/10-ciss.conf +# SPDX-Version: 3.0 +# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; +# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git +# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency +# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; +# SPDX-FileType: SOURCE +# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0 +# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework. +# SPDX-PackageName: CISS.debian.live.builder +# SPDX-Security-Contact: security@coresecret.eu + +[Service] +ExecStart= +ExecStart=/sbin/auditctl -R /etc/audit/audit.rules + +EOF + printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}" exit 0 diff --git a/config/includes.chroot/root/.ciss/check_chrony.sh b/config/includes.chroot/root/.ciss/check_chrony.sh new file mode 100644 index 0000000..25897af --- /dev/null +++ b/config/includes.chroot/root/.ciss/check_chrony.sh @@ -0,0 +1,148 @@ +#!/bin/bash +# SPDX-Version: 3.0 +# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; +# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git +# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency +# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; +# SPDX-FileType: SOURCE +# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0 +# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework. +# SPDX-PackageName: CISS.debian.live.builder +# SPDX-Security-Contact: security@coresecret.eu + +# Minimal leap-second probe for Debian/chrony systems +# - Prints kernel leap flags & TAI offset (ΔAT) +# - Reads tzdata's leap-seconds list (authoritative TAI-UTC) +# - Shows chrony tracking summary (incl. leap status) +# - Demonstrates 23:59:60 rendering via TZ=right/UTC + +set -Ceuo pipefail + +####################################### +# Minimal leap-second probe for Debian/chrony systems +# - Prints kernel leap flags & TAI offset (ΔAT) +# - Reads tzdata's leap-seconds list (authoritative TAI-UTC) +# - Shows chrony tracking summary (incl. leap status) +# - Demonstrates 23:59:60 rendering via TZ=right/UTC +# Globals: +# None +# Arguments: +# None +# Returns: +# 0: on success +####################################### +main() { + ### 1) System TZ and tzdata source. + printf "System TZ link: [%s]\n\n" "$(readlink -f /etc/localtime || true)" + + if [[ -f /usr/share/zoneinfo/leap-seconds.list ]]; then + + declare tz_leap_line tz_tai tz_ntp ts_human + + tz_leap_line="$(awk '($1 !~ /^#/) {L=$0} END{print L}' /usr/share/zoneinfo/leap-seconds.list)" + tz_ntp="$(awk '{print $1}' <<<"${tz_leap_line}")" + tz_tai="$(awk '{print $2}' <<<"${tz_leap_line}")" + ts_human="$(awk -F'#' '{gsub(/^[[:space:]]+/, "", $2); print $2}' <<<"${tz_leap_line}")" + + printf "tzdata ΔAT (TAI-UTC): %s s [last change at: %s; NTP ts: %s]\n\n" "${tz_tai:-?}" "${ts_human:-?}" "${tz_ntp:-?}" + + else + + printf "tzdata leap-seconds.list not found.\n" + + fi + + ### 2) Kernel view (requires adjtimex). + if command -v adjtimex >/dev/null 2>&1; then + + printf "Kernel time status (adjtimex -p):\n" + adjtimex -p | sed 's/^/ /' + declare k_tai + k_tai="$(adjtimex -p | awk '/^tai:/ {print $2}')" + + if [[ -n "${k_tai:-}" ]]; then + + printf "Kernel-exported ΔAT [tai]: %s s\n" "${k_tai}" + + fi + + else + + printf "Package: 'adjtimex' not found. Install 'adjtimex' for kernel leap/TAI details.\n\n" + + fi + + ### 3) Chrony summary. + if command -v chronyc >/dev/null 2>&1; then + + printf "\n" + printf "chronyc tracking:\n" + chronyc -n tracking | sed 's/^/ /' + + else + + printf "Package: 'chronyc' not found. Skipping chrony status.\n\n" + + fi + + ### 4) right/UTC demonstration of 23:59:60 (uses 2016-12-31 leap). + if [[ -f /usr/share/zoneinfo/right/UTC ]]; then + + printf "\n" + printf "right/UTC leap rendering check (expect 23:59:60):\n\n" + TZ=right/UTC date -ud '2017-01-01 00:00:00 -1 second' || true + + else + + printf "\n" + printf "File: 'tzdata right/UTC' zone not installed; skipping 23:59:60 demo.\n\n" + + fi + + printf "\n" + printf "Hint:\n" + + printf " • ΔAT (TAI-UTC) should match tzdata and kernel (chrony sets kernel TAI if leapsectz/leapseclist is used).\n" + printf " • For monotonic intervals, apps must use CLOCK_MONOTONIC, not CLOCK_REALTIME.\n" + + return 0 +} + +### Build right/UTC from tzdata leap table if missing. +if [[ ! -e /usr/share/zoneinfo/right/UTC ]]; then + + install -d -m 0755 /usr/share/zoneinfo/right + + ### Minimal zic source for a fixed UTC zone. + declare -r tmp_src="/tmp/UTC.src" + printf 'Zone UTC 0 - UTC\n' > "${tmp_src}" + + ### Prefer the zic-format leapseconds file. + declare leap_zic="/usr/share/zoneinfo/leapseconds" + + if [[ -s "${leap_zic}" ]]; then + + zic -d /usr/share/zoneinfo/right -L "${leap_zic}" "${tmp_src}" + + else + + echo "WARNING: ${leap_zic} not found; building right/UTC without leap info." >&2 + zic -d /usr/share/zoneinfo/right -L /dev/null "${tmp_src}" + + fi + + rm -f "${tmp_src}" + +fi + +if [[ -e /usr/share/zoneinfo/right/UTC ]]; then + + ### Expect to see 'Sat Dec 31 23:59:60 UTC 2016' rendered in right/UTC + TZ=right/UTC date -ud '2017-01-01 00:00:00 -1 second' || true + +fi + +main "$@" + +exit 0 +# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh diff --git a/config/package-lists/live.list.common.chroot b/config/package-lists/live.list.common.chroot index 95757f6..0c64133 100644 --- a/config/package-lists/live.list.common.chroot +++ b/config/package-lists/live.list.common.chroot @@ -8,6 +8,7 @@ # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework. # SPDX-PackageName: CISS.debian.live.builder # SPDX-Security-Contact: security@coresecret.eu +adjtimex apparmor apparmor-profiles-extra apparmor-utils diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index f2520c9..714c1d6 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -15,8 +15,11 @@ include_toc: true ## V8.13.128.2025.10.10 * **Added**: [0040_ssh_config_setup.chroot](../config/hooks/live/0040_ssh_config_setup.chroot) +* **Added**: [check_chrony.sh](../config/includes.chroot/root/.ciss/check_chrony.sh) * **Updated**: [0810_chrony_setup.chroot](../config/hooks/live/0810_chrony_setup.chroot) +* **Updated**: [9996_auditd.chroot](../config/hooks/live/9996_auditd.chroot) * **Updated**: [sshd_config](../config/includes.chroot/etc/ssh/sshd_config) +* **Updated**: [live.list.common.chroot](../config/package-lists/live.list.common.chroot) ## V8.13.096.2025.10.09 * **Added**: [0010_install_apparmor.chroot](../config/hooks/live/0010_install_apparmor.chroot)