1FAPOLICYD(8) System Administration Utilities FAPOLICYD(8)
2
6 fapolicyd - File Access Policy Daemon
7
9 fapolicyd [options]
10
12 fapolicyd is a userspace daemon that determines access rights to files
13 based on a trust database and file or process attributes. It can be
14 used to either blacklist or whitelist file access and execution.
15 Configuring fapolicyd is done with the files in the /etc/fapolicyd/
17 directory. There are three files: fapolicyd.rules , fapolicyd.conf ,
18 and fapolicyd.trust
19 . The first one sets the access rights, the second determines the dae‐
20 mon's configuration, and the last allows admin defined trusted files.
21 The default rules will generate audit events whenever there is a
23 denial. NOTE: you must have at least 1 audit rule loaded for the audit
24 system to create the full FANOTIFY event. It doesn't matter which rule
25 is loaded. To see if you have any denials, you can run the following
26 command:
27 ausearch --start today -m fanotify -i
30 or instead of -i, you can add --format text to get an easier to read
32 audit event.
33
36 --debug
37 leave the daemon in the foreground for debugging. Event informa‐
38 tion is written to stderr so that policy decisions can be
39 observed.
40 --debug-deny
42 leave the daemon in the foreground for debugging. Event informa‐
43 tion is written to stderr only when the decision is to deny
44 access.
45 --permissive
47 the daemon will allow file access regardless of the policy deci‐
48 sion. This is useful for debugging rules before making them per‐
49 manent.
50 --no-details
52 when fapolicyd ends, it dumps a usage report with various sta‐
53 tistics that may be useful for tuning performance. It can also
54 detail which processes it knew about and files being accessed by
55 them. This can be useful for forensics investigations. In some
56 settings, this may not be desirable as the file names may be
57 sensitive. Using this option removes process and file names
58 leaving only the statistics. The default without giving this
59 option is to generate a full report.
60
62 SIGTERM
63 caused fapolicyd to discontinue processing events and exit.
64
67 Whatever you do, DO NOT TRY TO ATTACH WITH PTRACE. Ptrace attachment
68 sends a SIGSTOP which cannot be blocked. Since your whole system
69 depends on fapolicyd approving access to glibc and various critical
70 libraries, that will not happen until SIGCONT is sent. The system can
71 deadlock if the continue signal is not sent.
72 To get audit events, you must have auditing enabled and at least one
74 systemcall rule loaded. Otherwise you will not get any events.
75 If the rpmdb is set as a trust source, you should minimize the number
77 of 32 bit packages on the system. In such cases, there may be a 32 bit
78 and 64 file with the same pathname. Obviously only one can exist on the
79 disk. So, this will always cause database miscompares and cause a delay
80 in the daemon being operational.
81 If you are running in the debug mode and wish to compare rule numbers
83 reported in the output with which rule is actually triggering, you can
84 see the rules with the corresponding number by running the following
85 command:
86 fapolicyd-cli --list
88
91 /etc/fapolicyd/fapolicyd.conf - daemon configuration
92 /etc/fapolicyd/fapolicyd.rules - access control rules
94 /etc/fapolicyd/fapolicyd.trust - admin defined trusted files
96 /var/log/fapolicyd-access.log - information about what was being
98 accessed.
99
102 fapolicyd-cli(1), fapolicyd.rules(5), fapolicyd.trust(5), and fapoli‐
103 cyd.conf(5)
104
107 Steve Grubb
108Red Hat January 2020 FAPOLICYD(8)