10장. Blocking and allowing applications by using fapolicyd

The fapolicyd framework provides the following components:

The administrator can define allow and deny execution rules for any application with the option to audit based on a path, hash, MIME type, or trust.

The fapolicyd framework introduces the concept of trust. An application is trusted when the system package manager correctly installs it and therefore registered in the system RPM database. The fapolicyd daemon uses the RPM database as a list of trusted binaries and scripts.

The fapolicyd RPM plugin registers any system update that is handled by either the DNF or RPM package manager. The plugin notifies the fapolicyd daemon about changes in this database. Other ways of adding applications require the creation of custom rules and restarting the fapolicyd service.

For more information, see the fapolicyd-related man pages listed by using the man -k fapolicyd command on your system.

The fapolicyd service configuration is located in the /etc/fapolicyd/ directory with the following structure:

Rules in /etc/fapolicyd/rules.d/ are organized in several files, each representing a different policy goal. The numbers at the beginning of the corresponding file names determine the order in /etc/fapolicyd/compiled.rules:

For more information and examples, see the documentation installed with the fapolicyd package in the /usr/share/doc/fapolicyd/ directory, the /usr/share/fapolicyd/sample-rules/README-rules file, and the fapolicyd.rules(5) and fagenrules(8) man pages on your system.

You can use one of the following ways for fapolicyd integrity checking:

By default, fapolicyd does no integrity checking. Integrity checking based on the file size is fast, but an attacker can replace the content of the file and preserve its byte size. Computing and checking SHA-256 checksums is more secure, but it affects the performance of the system. The integrity = ima option in fapolicyd.conf requires support for files' extended attributes (also known as xattr) on all file systems containing executable files.