Chapter 10. Blocking and allowing applications by using fapolicyd

Procedure

1. Install the fapolicyd package:

   # dnf install fapolicyd

2. Set the Audit subsystem for recording fapolicyd events:

   # auditctl -w /etc/fapolicyd/ -p wa -k fapolicyd_changes
   # service try-restart auditd

3. Optional: To try your configuration first, change mode to permissive.

   1. Open the /etc/fapolicyd/fapolicyd.conf file in a text editor of your choice, for example:

      # vi /etc/fapolicyd/fapolicyd.conf

   2. Change the value of the permissive option from 0 to 1, save the file, and exit the editor:

      permissive = 1

      Alternatively, you can debug your configuration by using the fapolicyd --debug-deny --permissive command before you start the service. See the Troubleshooting problems related to fapolicyd section for more information.

4. Enable and start the fapolicyd service:

   # systemctl enable --now fapolicyd

5. If you enabled permissive mode through /etc/fapolicyd/fapolicyd.conf:

   1. Use your applications.

   2. Check Audit logs for fanotify denials, for example:

      # ausearch -ts recent -m fanotify

   3. When debugged, disable permissive mode by changing the corresponding value back to permissive = 0, and restart the service:

      # systemctl restart fapolicyd

Verification

1. Verify that the fapolicyd service is running correctly:

   # systemctl status fapolicyd
   ● fapolicyd.service - File Access Policy Daemon
        Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled)
        Active: active (running) since Tue 2024-10-08 05:53:50 EDT; 11s ago
   …
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from rpmdb backend
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from file backend
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Starting to listen for events

2. Log in as a user without root privileges, and check that fapolicyd is working, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

Procedure

1. Copy your custom binary to the required directory, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

2. Mark your custom binary as trusted, and store the corresponding entry to the myapp file in /etc/fapolicyd/trust.d/:

   # fapolicyd-cli --file add /tmp/ls --trust-file myapp

   • If you skip the --trust-file option, then the previous command adds the corresponding line to /etc/fapolicyd/fapolicyd.trust.

   • To mark all existing files in a directory as trusted, provide the directory path as an argument of the --file option, for example:

     # fapolicyd-cli --file add /tmp/my_bin_dir/ --trust-file myapp

3. Update the fapolicyd database:

   # fapolicyd-cli --update

   Note

   Changing the content of a trusted file or directory changes its checksum, and therefore,fapolicyd no longer considers it trusted.

   To restore trust in the new content, refresh the file trust database by using the fapolicyd-cli --file update command. If you do not provide any argument, the entire database refreshes. Alternatively, you can specify a path to a specific file or directory. Then, update the database by using fapolicyd-cli --update.

Verification

1. Check that you can execute your custom binary, for example:

   $ /tmp/ls
   ls

Procedure

1. Copy your custom binary to the required directory, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

2. Stop the fapolicyd service:

   # systemctl stop fapolicyd

3. Use debug mode to identify a corresponding rule. Because the output of the fapolicyd --debug command is verbose and you can stop it only by pressing Ctrl+C or killing the corresponding process, redirect the error output to a file. In this case, you can limit the output only to access denials by using the --debug-deny option instead of --debug:

   # fapolicyd --debug-deny 2> fapolicy.output &
   [1] 51341

   Alternatively, you can run fapolicyd debug mode in another terminal.

4. Repeat the command that fapolicyd denied:

   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

5. Stop debug mode by resuming it in the foreground and pressing Ctrl+C:

   # fg
   fapolicyd --debug 2> fapolicy.output
   ^C
   …

   Alternatively, kill the process of fapolicyd debug mode:

   # kill 51341

6. Find a rule that denies the execution of your application:

   # cat fapolicy.output | grep 'deny_audit'
   …
   rule=13 dec=deny_audit perm=execute auid=0 pid=6855 exe=/usr/bin/bash : path=/tmp/ls ftype=application/x-executable trust=0

7. Locate the file that contains a rule that denies the execution of your custom binary. In this case, the deny_audit perm=execute rule belongs to the 90-deny-execute.rules file:

   # ls /etc/fapolicyd/rules.d/
   10-languages.rules  40-bad-elf.rules	   72-shell.rules
   20-dracut.rules     41-shared-obj.rules    90-deny-execute.rules
   21-updaters.rules   42-trusted-elf.rules   95-allow-open.rules
   30-patterns.rules   70-trusted-lang.rules
   
   
   # cat /etc/fapolicyd/rules.d/90-deny-execute.rules
   # Deny execution for anything untrusted
   
   deny_audit perm=execute all : all

8. Add a new allow rule to a file that lexically precedes the rule file that contains the rule that denied the execution of your custom binary in the /etc/fapolicyd/rules.d/ directory.

   1. Create the rule file and open it in a text editor of your choice, for example:

      # touch /etc/fapolicyd/rules.d/80-myapps.rules
      # vi /etc/fapolicyd/rules.d/80-myapps.rules

   2. Insert the following rule to the 80-myapps.rules file:

      allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0

      Alternatively, you can allow executions of all binaries in the /tmp directory by adding the following rule to the rule file in /etc/fapolicyd/rules.d/:

      allow perm=execute exe=/usr/bin/bash trust=1 : dir=/tmp/ trust=0

      Important

      To make a rule effective recursively on all directories under the specified directory, add a trailing slash to the value of the dir= parameter in the rule (/tmp/ in the previous example).

9. Prevent changes in the content of your custom binary

   1. Define the required rule using an SHA-256 checksum:

      $ sha256sum /tmp/ls
      780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836  ls

   2. Change the rule to the following definition:

      allow perm=execute exe=/usr/bin/bash trust=1 : sha256hash=780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836

10. Check that the list of compiled rules differs from the rule set in /etc/fapolicyd/rules.d/:

    # fagenrules --check
    /usr/sbin/fagenrules: Rules have changed and should be updated

11. Update the list, which is stored in the /etc/fapolicyd/compiled.rules file:

    # fagenrules --load

12. Check that your custom rule is in the list of fapolicyd rules before the rule that denied the execution:

    # fapolicyd-cli --list
    ...
    13. allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0
    14. deny_audit perm=execute all : all
    …

13. Start the fapolicyd service:

    # systemctl start fapolicyd

Verification

1. Check that your custom binary can be now executed, for example:

   $ /tmp/ls
   ls

Procedure

1. Open the /etc/fapolicyd/fapolicyd.conf file in a text editor of your choice, for example:

   # vi /etc/fapolicyd/fapolicyd.conf

2. Change the value of the integrity option from none to sha256, save the file, and exit the editor:

   integrity = sha256

3. Restart the fapolicyd service:

   # systemctl restart fapolicyd

Verification

1. Back up the file used for the verification:

   # cp /bin/more /bin/more.bak

2. Change the content of the /bin/more binary:

   # cat /bin/less > /bin/more

3. Attempt to use the changed binary as a regular user and verify fapolicyd denies the operation:

   # su example.user
   $ /bin/more /etc/redhat-release
   bash: /bin/more: Operation not permitted

4. Revert the changes:

   # mv -f /bin/more.bak /bin/more

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configuring fapolicyd
     hosts: managed-node-01.example.com
     tasks:
       - name: Allow only executables installed from RPM database and specific files
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.fapolicyd
         vars:
           fapolicyd_setup_permissive: false
           fapolicyd_setup_integrity: sha256
           fapolicyd_setup_trust: rpmdb,file
           fapolicyd_add_trusted_file:
             - <path_to_allowed_command>
             - <path_to_allowed_service>

   The settings specified in the example playbook include the following:

   fapolicyd_setup_permissive: <true|false>

   Enables or disables sending policy decisions to the kernel for enforcement. Set this variable for debugging and testing purposes to false.

   fapolicyd_setup_integrity: <type_type>

   Defines the integrity checking method. You can set one of the following values:

   • none (default): Disables integrity checking.
   • size: The service compares only the file sizes of allowed applications.
   • ima: The service checks the SHA-256 hash that the kernel’s Integrity Measurement Architecture (IMA) stored in a file’s extended attribute. Additionally, the service performs a size check. Note that the role does not configure the IMA kernel subsystem. To use this option, you must manually configure the IMA subsystem.
   • sha256: The service compares the SHA-256 hash of allowed applications.

   fapolicyd_setup_trust: <trust_backends>

   Defines the list of trust backends. If you include the file backend, specify the allowed executable files in the fapolicyd_add_trusted_file list.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.fapolicyd.README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook ~/playbook.yml --syntax-check

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml