2.5. 启用 fapolicyd 服务

验证

1. 验证 fapolicyd 服务是否正在运行：

   # systemctl status fapolicyd
   ● fapolicyd.service - File Access Policy Daemon
        Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled)
        Active: active (running) since Thu 2024-03-14 16:38:32 IST; 18h ago
   ...
   Mar 14 16:38:33 host01 fapolicyd[579216]: Trust database checks OK
   Mar 14 16:38:33 host01 fapolicyd[579216]: Starting to listen for events

   Copy to Clipboard Toggle word wrap

2. 验证非 root 用户，包括 SAP HANA 管理员用户（例如： h70adm），无法在 /hana 和 /usr/sap 中执行任何新脚本和二进制程序：

   # cp -pi /usr/bin/date /hana/
   # su - h70adm
   h70adm@host01:/usr/sap/H70/HDB35> /hana/date
   -sh: /hana/date: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> cat > try-to-start-me.sh
   #!/bin/bash
   echo "I will not execute."
   <ctrl>d
   h70adm@host01:/usr/sap/H70/HDB35> chmod u+x try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> ./try-to-start-me.sh
   -sh: ./try-to-start-me.sh: Operation not permitted
   h70adm@host01:/usr/sap/H70/HDB35> rm try-to-start-me.sh
   h70adm@host01:/usr/sap/H70/HDB35> exit
   # rm /hana/date
   rm: remove regular file '/hana/date'? y

   Copy to Clipboard Toggle word wrap