stigenable: drop redundant packages from KS_STIG_PACKAGES

[dcasota]

Removes three of the eight entries in KS_STIG_PACKAGES, and the same three from examples/ova/packages_stig.json. Each is either already satisfied transitively or is dead weight.

Package	Why it can go
libselinux-utils	Already a dependency of selinux-policy; the stig-hardening role never invokes any of its binaries
ntp	Installed but never configured — no task in the role notifies the time-sync handlers, so all three are dead code, and 0 of the 107 PHTN-50-xxxxxx controls cover time sync
libgcrypt	A workaround for aide declaring only an unversioned Requires: libgcrypt; that belongs in aide.spec

On ntp specifically

Checked against the role Photon 5.0 actually ships, stig-hardening-2.1-10.ph5 (source: vmware/dod-compliance-and-automation, photon/5.0/ansible/vmware-photon-5.0-stig-ansible-hardening):

• tasks/ contains 107 distinct PHTN-50-xxxxxx controls and zero occurrences of ntp, chrony or timesync
• handlers/main.yml defines restart ntpd, restart chrony and restart timesyncd. Of the 25 notify: in the role, they are referenced 0 times — the only handlers ever notified are restart sshd (21), restart rsyslog (2), restart resolved (1) and reload auditd (1)
• var_ntp_servers appears only in README.md, never in a task

So installing ntp satisfies no control — it just adds a package.

Also dropped from examples/ova/packages_stig.json

Per review feedback. The OVA package list and the installer's own declaration now say the same thing. Keeping the two in step matters here: a list restated in two places is the drift that left the STIG menu offering an option the media could not honour.

Verified on real installs

Ten unattended permutation-matrix rows on both installer variants — photon-os-installer-2.8-7 and 2.9-3 — each a full ISO build plus a kickstart install in a VM, with the STIG rows (k03, k04, k07, k08) exercising this change directly:

• additional_packages in the install manifest is exactly [audit, rsyslog, openssl-fips-provider, selinux-policy, aide] — 5 entries
• libselinux-utils and libgcrypt are still installed, as ordinary transitive dependencies; dropping them from the explicit list changed nothing about what lands on the system
• ntp/ntpsec are not installed, and time sync works: systemd-timesyncd active, System clock synchronized: yes
• STIG ansible run: 0 failed tasks; 0 failed units and no Error(1011) on any row

One note on SELinux, since an earlier revision of this description got it wrong: these installs boot Permissive, and that is correct rather than a regression. selinux-policy ships SELINUX=permissive at subrelease ≥ 92 by design; only builds at subrelease ≤ 90 boot Enforcing. This change does not affect the mode either way.

Related

The aide side of this is a versioned Requires: libgcrypt >= 1.10.4 guarded by photon_subrelease >= 91, filed separately against the photon repo (dcasota/photon#21).

[oliverkurth]

I guess these can then also be removed from examples/ova/packages_stig.json. Can you please try that and test?

[dcasota]

The PR has been modified and tested with minimal ISO, kickstart, x86_64, without/with STIG, prebuilt canister. The ongoing tests with a full iso x86_64 should be fine, too. aarch64 hasn't been tested.