10.3. Marking files as trusted using an additional source of trust

Procedure

1. Copy your custom binary to the required directory, for example:

   $ cp /bin/ls /tmp
   $ /tmp/ls
   bash: /tmp/ls: Operation not permitted

2. Mark your custom binary as trusted, and store the corresponding entry to the myapp file in /etc/fapolicyd/trust.d/:

   # fapolicyd-cli --file add /tmp/ls --trust-file myapp

   • If you skip the --trust-file option, then the previous command adds the corresponding line to /etc/fapolicyd/fapolicyd.trust.

   • To mark all existing files in a directory as trusted, provide the directory path as an argument of the --file option, for example:

     # fapolicyd-cli --file add /tmp/my_bin_dir/ --trust-file myapp

3. Update the fapolicyd database:

   # fapolicyd-cli --update

   참고

   Changing the content of a trusted file or directory changes its checksum, and therefore,fapolicyd no longer considers it trusted.

   To restore trust in the new content, refresh the file trust database by using the fapolicyd-cli --file update command. If you do not provide any argument, the entire database refreshes. Alternatively, you can specify a path to a specific file or directory. Then, update the database by using fapolicyd-cli --update.

Verification

1. Check that you can execute your custom binary, for example:

   $ /tmp/ls
   ls