10.2. Deploying fapolicyd

Procedure

1. Install the fapolicyd package:

   # dnf install fapolicyd

2. Set the Audit subsystem for recording fapolicyd events:

   # auditctl -w /etc/fapolicyd/ -p wa -k fapolicyd_changes
   # service try-restart auditd

3. Optional: To try your configuration first, change mode to permissive.

   1. Open the /etc/fapolicyd/fapolicyd.conf file in a text editor of your choice, for example:

      # vi /etc/fapolicyd/fapolicyd.conf

   2. Change the value of the permissive option from 0 to 1, save the file, and exit the editor:

      permissive = 1

      Alternatively, you can debug your configuration by using the fapolicyd --debug-deny --permissive command before you start the service. See the Troubleshooting problems related to fapolicyd section for more information.

4. Enable and start the fapolicyd service:

   # systemctl enable --now fapolicyd

5. If you enabled permissive mode through /etc/fapolicyd/fapolicyd.conf:

   1. Use your applications.

   2. Check Audit logs for fanotify denials, for example:

      # ausearch -ts recent -m fanotify

   3. When debugged, disable permissive mode by changing the corresponding value back to permissive = 0, and restart the service:

      # systemctl restart fapolicyd

Verification

1. Verify that the fapolicyd service is running correctly:

   # systemctl status fapolicyd
   ● fapolicyd.service - File Access Policy Daemon
        Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled)
        Active: active (running) since Tue 2024-10-08 05:53:50 EDT; 11s ago
   …
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from rpmdb backend
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from file backend
   Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Starting to listen for events

2. Log in as a user without root privileges, and check that fapolicyd is working, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted