2.5. fapolicyd 서비스 활성화

검증

1. fapolicyd 서비스가 실행 중인지 확인합니다.

   # systemctl status fapolicyd
   ● fapolicyd.service - File Access Policy Daemon
        Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled)
        Active: active (running) since Thu 2024-03-14 16:38:32 IST; 18h ago
   ...
   Mar 14 16:38:33 host01 fapolicyd[579216]: Trust database checks OK
   Mar 14 16:38:33 host01 fapolicyd[579216]: Starting to listen for events

   Copy to Clipboard Toggle word wrap

2. SAP HANA 관리자 사용자(예: h70adm)를 포함하여 루트가 아닌 사용자가 /hana 및 /usr/sap: 새 스크립트와 바이너리 프로그램을 실행할 수 없는지 확인합니다.

   # cp -pi /usr/bin/date /hana/
   # su - h70adm
   h70adm@host01:/usr/sap/H70/HDB35> /hana/date
   -sh: /hana/date: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> cat > try-to-start-me.sh
   #!/bin/bash
   echo "I will not execute."
   <ctrl>d
   h70adm@host01:/usr/sap/H70/HDB35> chmod u+x try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> ./try-to-start-me.sh
   -sh: ./try-to-start-me.sh: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> rm try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> exit
   # rm /hana/date
   rm: remove regular file '/hana/date'? y

   Copy to Clipboard Toggle word wrap