10.4. Adding custom allow and deny rules for fapolicyd

Procedure

1. Copy your custom binary to the required directory, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

2. Stop the fapolicyd service:

   # systemctl stop fapolicyd

3. Use debug mode to identify a corresponding rule. Because the output of the fapolicyd --debug command is verbose and you can stop it only by pressing Ctrl+C or killing the corresponding process, redirect the error output to a file. In this case, you can limit the output only to access denials by using the --debug-deny option instead of --debug:

   # fapolicyd --debug-deny 2> fapolicy.output &
   [1] 51341

   Alternatively, you can run fapolicyd debug mode in another terminal.

4. Repeat the command that fapolicyd denied:

   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

5. Stop debug mode by resuming it in the foreground and pressing Ctrl+C:

   # fg
   fapolicyd --debug 2> fapolicy.output
   ^C
   …

   Alternatively, kill the process of fapolicyd debug mode:

   # kill 51341

6. Find a rule that denies the execution of your application:

   # cat fapolicy.output | grep 'deny_audit'
   …
   rule=13 dec=deny_audit perm=execute auid=0 pid=6855 exe=/usr/bin/bash : path=/tmp/ls ftype=application/x-executable trust=0

7. Locate the file that contains a rule that denies the execution of your custom binary. In this case, the deny_audit perm=execute rule belongs to the 90-deny-execute.rules file:

   # ls /etc/fapolicyd/rules.d/
   10-languages.rules  40-bad-elf.rules	   72-shell.rules
   20-dracut.rules     41-shared-obj.rules    90-deny-execute.rules
   21-updaters.rules   42-trusted-elf.rules   95-allow-open.rules
   30-patterns.rules   70-trusted-lang.rules
   
   
   # cat /etc/fapolicyd/rules.d/90-deny-execute.rules
   # Deny execution for anything untrusted
   
   deny_audit perm=execute all : all

8. Add a new allow rule to a file that lexically precedes the rule file that contains the rule that denied the execution of your custom binary in the /etc/fapolicyd/rules.d/ directory.

   1. Create the rule file and open it in a text editor of your choice, for example:

      # touch /etc/fapolicyd/rules.d/80-myapps.rules
      # vi /etc/fapolicyd/rules.d/80-myapps.rules

   2. Insert the following rule to the 80-myapps.rules file:

      allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0

      Alternatively, you can allow executions of all binaries in the /tmp directory by adding the following rule to the rule file in /etc/fapolicyd/rules.d/:

      allow perm=execute exe=/usr/bin/bash trust=1 : dir=/tmp/ trust=0

      중요

      To make a rule effective recursively on all directories under the specified directory, add a trailing slash to the value of the dir= parameter in the rule (/tmp/ in the previous example).

9. Prevent changes in the content of your custom binary

   1. Define the required rule using an SHA-256 checksum:

      $ sha256sum /tmp/ls
      780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836  ls

   2. Change the rule to the following definition:

      allow perm=execute exe=/usr/bin/bash trust=1 : sha256hash=780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836

10. Check that the list of compiled rules differs from the rule set in /etc/fapolicyd/rules.d/:

    # fagenrules --check
    /usr/sbin/fagenrules: Rules have changed and should be updated

11. Update the list, which is stored in the /etc/fapolicyd/compiled.rules file:

    # fagenrules --load

12. Check that your custom rule is in the list of fapolicyd rules before the rule that denied the execution:

    # fapolicyd-cli --list
    ...
    13. allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0
    14. deny_audit perm=execute all : all
    …

13. Start the fapolicyd service:

    # systemctl start fapolicyd

Verification

1. Check that your custom binary can be now executed, for example:

   $ /tmp/ls
   ls