fix(fips): resolve failing stig check (#21435)

* fix(fips): resolve failing stig check

* Update Dockerfile.fips

(cherry picked from commit 31898f8)

Author: kruskall

packaging/docker/Dockerfile.fips

@@ -17,6 +17,7 @@ RUN --mount=type=cache,target=/root/go/pkg/mod \
 COPY --chmod=0644 apm-server-fips.yml ./apm-server.yml
 RUN sed -i 's/127.0.0.1:8200/0.0.0.0:8200/' apm-server.yml
 RUN sed -i 's/localhost:9200/elasticsearch:9200/' apm-server.yml
+RUN rm -f empty && touch empty
 
 ################################################################################
 # Build stage 1
@@ -69,6 +70,12 @@ ENV LIBBEAT_MONITORING_CGROUPS_HIERARCHY_OVERRIDE=/
 # running in Docker.
 ENV BEAT_STRICT_PERMS=false
 
+# STIG V-203716 requires that "The operating system must prohibit user installation
+# of system software without explicit privileged status." but this requirement does not
+# always apply cleanly to all base images, particularly Chainguard Static.
+# Since /usr/lib contains no files, the check fails, so we add an empty root-owned file to satisfy it.
+COPY --chmod=0755 --chown=0:0 --from=builder /src/empty /usr/lib/empty
+
 COPY --chmod=0644 --chown=nonroot:nonroot licenses/ELASTIC-LICENSE-2.0.txt /licenses/
 COPY --chmod=0644 --chown=nonroot:nonroot NOTICE-fips.txt /licenses/NOTICE.txt