10.5. Enabling fapolicyd integrity checks

Procedure

1. Open the /etc/fapolicyd/fapolicyd.conf file in a text editor of your choice, for example:

   # vi /etc/fapolicyd/fapolicyd.conf

2. Change the value of the integrity option from none to sha256, save the file, and exit the editor:

   integrity = sha256

3. Restart the fapolicyd service:

   # systemctl restart fapolicyd

Verification

1. Back up the file used for the verification:

   # cp /bin/more /bin/more.bak

2. Change the content of the /bin/more binary:

   # cat /bin/less > /bin/more

3. Attempt to use the changed binary as a regular user and verify fapolicyd denies the operation:

   # su example.user
   $ /bin/more /etc/redhat-release
   bash: /bin/more: Operation not permitted

4. Revert the changes:

   # mv -f /bin/more.bak /bin/more