Chapter 2. Protecting SAP HANA installation by using fapolicyd

Procedure

1. Open the /etc/fapolicyd/fapolicyd.conf file in a text editor of your choice, for example:

   # vi /etc/fapolicyd/fapolicyd.conf

2. Configure the integrity option and change the default value of none to sha-256:

   integrity = sha-256

Procedure

1. Open the directory /etc/fapolicyd/rules.d.

2. Add a new file with a file name starting with 71 (proposed file name: 71-sap-shellscript.rules) so the rule is placed between the rules of the files 70-trusted-lang.rules and 72-shell.rules, with the following content:

   # Deny shell script execution and sourcing under SAP HANA directories
   
   deny_audit perm=any all : ftype=text/x-shellscript dir=/hana/,/usr/sap/ trust=0

3. Set the ownership of the file to those of the other files in /etc/fapolicyd/rules.d:

   # chown root:fapolicyd 71-sap-shellscript.rules

4. Use the following commands to confirm that new rules have been defined, and then load the new rules:

   # fagenrules --check
   /usr/sbin/fagenrules: Rules have changed and should be updated
   # fagenrules --load

Procedure

1. Install the SAP HANA software if not already done.

2. Use the following commands to add all the SAP HANA files to the fapolicyd trust database. We recommend using a separate trust file for each directory tree, for example, hana and usr_sap:

   # fapolicyd-cli --file add /hana --trust-file hana
   # fapolicyd-cli --file add /usr/sap --trust-file usr_sap

   This creates two files, named hana and usr_sap, in the directory /etc/fapolicyd/trust.d, which contains entries for all files under /hana and /usr/sap.

3. For an SAP HANA installation on a freshly installed RHEL system, the SAP HANA installer creates the directories /hana and /usr/sap, so we can trust that all the files in these directories are valid SAP files.

   In any other case, there might be files in those directories that the SAP HANA installer has not created.

   Therefore, you should carefully verify that all the files in the trust files /etc/fapolicyd/trust.d/hana and /etc/fapolicyd/trust.d/usr_sap are valid SAP files. One of the possible ways is explained below:

   1. Perform a fresh SAP HANA installation on another freshly installed RHEL system.
   2. Repeat step 2 on that system.
   3. Compare the resulting trust files of both systems.

Verification

1. Verify that the fapolicyd service is up and running:

   # systemctl status fapolicyd
   ● fapolicyd.service - File Access Policy Daemon
        Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled)
        Active: active (running) since Thu 2024-03-14 16:38:32 IST; 18h ago
   ...
   Mar 14 16:38:33 host01 fapolicyd[579216]: Trust database checks OK
   Mar 14 16:38:33 host01 fapolicyd[579216]: Starting to listen for events

2. Verify that the non-root users, including the SAP HANA administrator user (example: h70adm), cannot execute any new scripts and binary programs in /hana and /usr/sap:

   # cp -pi /usr/bin/date /hana/
   # su - h70adm
   h70adm@host01:/usr/sap/H70/HDB35> /hana/date
   -sh: /hana/date: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> cat > try-to-start-me.sh
   #!/bin/bash
   echo "I will not execute."
   <ctrl>d
   h70adm@host01:/usr/sap/H70/HDB35> chmod u+x try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> ./try-to-start-me.sh
   -sh: ./try-to-start-me.sh: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> rm try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> exit
   # rm /hana/date
   rm: remove regular file '/hana/date'? y