CMP-3618 added chrony-wait fix

[vickeybrown]

Description:

Fixed chrony-wait.service timeout failures when "cmdport 0" is configured by the "chronyd_no_chronyc_network" rule. The default chrony-wait.service uses -h 127.0.0.1,::1 which forces network connection to chronyd's command port, but the STIG-required cmdport 0 setting disables network access. This causes chrony-wait.service to timeout and fail, preventing time-sync.target from being reached.

The fix replaces the entire chrony-wait.service unit file to:

1. Remove the -h flag so chronyc uses the Unix socket at /run/chrony/chronyd.sock
2. Remove PrivateUsers=yes and other sandboxing restrictions that block Unix socket access

Rationale:

The "chronyd_no_chronyc_network" rule implements STIG requirements by setting "cmdport 0" to disable network access to chronyd's command port, while enabling local access via bindcmdaddress/run/chrony/chronyd.sock. However, chrony-wait.service bypasses the Unix socket by hard-coding network addresses, causing it to fail when cmdport is disabled. This breaks time synchronization verification on RHCOS nodes and can cause compliance remediation failures in OpenShift environments.

Review Hints:

Testing on OpenShift/RHCOS:

# Apply the chronyd_no_chronyc_network remediation
oc patch complianceremediation/<name> -n openshift-compliance --type=merge -p '{"spec":{"apply":true}}' 

# After MachineConfig applies, verify on a node:
oc debug node/<worker-node> 
chroot /host

# Verify chrony.conf has the required settings
grep -E '(cmdport|bindcmdaddress)' /etc/chrony.conf
# Should show: 
# cmdport 0
# bindcmdaddress /run/chrony/chronyd.sock

# Verify the replacement service file exists                                                              
cat /etc/systemd/system/chrony-wait.service
# Should have: ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1 (no -h flag)                               

# Verify chrony-wait.service succeeds
systemctl status chrony-wait.service
# Should show: Active: active (exited)

[openshift-ci]

Hi @vickeybrown. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yuumasato]

/ok-to-test

[Mab879]

Thanks for the PR.

1. I would suggest putting this fix into a new rules

[Mab879]

Suggested change

	- name: Check if chrony-wait.service exists
	- name: "{{{ rule_title }} - Check if chrony-wait.service exists"

[vickeybrown]

Adjusted it

[Mab879]

Suggested change

	- name: Replace chrony-wait.service to use Unix socket (KCS 7064388)
	- name: {{{ rule_title }}} - Replace chrony-wait.service to use Unix socket (KCS 7064388)

[vickeybrown]

Adjusted

[vickeybrown]

I broke the change into its own rule, and added it to the profiles that currently have the "chronyd_no_chronyc_network" rule since that was what was causing the issue - not sure if that's the move or not so let me know if it needs adjustment

[Mab879]

The CI fails are valid, please take a look.

Also, please organize commits before we merge this.

[Mab879]

/ok-to-test

[Mab879]

Looks like there still one merge conflict.

[Mab879]

$ ./automatus.py rule --datastream ../build/ssg-rhel9-ds.xml [VM NAME] chronyd_configure_local_socket             
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/github.com/ComplianceAsCode/content/tests/logs/rule-custom-2026-04-21-1230/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_chronyd_configure_local_socket
INFO - Script cmdport_zero.fail.sh using profile (all) OK
INFO - Script missing_marker.fail.sh using profile (all) OK
INFO - Script not_installed.pass.sh using profile (all) OK
ERROR - Rule 'chronyd_configure_local_socket' test setup script 'service_fixed.pass.sh' failed with exit code 2
ERROR - Environment failed to prepare, skipping test

I think the main issue is the leading indent in service_fixed.pass.sh.

[Mab879]

It might be better to check the ExecStart for the correct flags.

[openshift-ci]

@vickeybrown: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	ebbb2d8	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.