↓ Skip to main content
Le Site de François
  1. Index/

fapolicyd (File Access Policy Daemon)

Security Linux Rhel Allowlisting Integrity Policy

fapolicyd (File Access Policy Daemon) is an application allowlisting framework for Linux, developed by Red Hat and shipped as a supported component of RHEL 8+. Its security premise is supply-chain integrity at the execution layer: only software that was installed through a trusted package manager (DNF/RPM) or explicitly declared as trusted by an administrator may execute on the system. An attacker who achieves a foothold and drops a new binary — a reverse shell, a lateral movement tool, a cryptominer — will find that binary blocked at execution time, because it is absent from the trust database, regardless of its Unix permissions or SELinux label. fapolicyd addresses a different dimension of access control than SELinux: SELinux models how applications behave (what resources they may access); fapolicyd models whether applications are trusted at all (whether they may execute in the first place). The two are complementary: SELinux confines a trusted application’s behaviour; fapolicyd prevents untrusted applications from running.

The kernel mechanism underlying fapolicyd is fanotify with the FAN_OPEN_EXEC_PERM event type. When any process calls execve(), execveat(), or uselib(), the kernel generates a FAN_OPEN_EXEC_PERM event and blocks the executing thread until fapolicyd returns a verdict. fapolicyd looks up the file in its trust database — an lmdb key-value store at /var/lib/fapolicyd/ — and evaluates the matching rule in its policy. The trust database is populated automatically via a DNF plugin that notifies fapolicyd whenever packages are installed or removed, keeping the database in sync with the RPM state without manual intervention; rpm-based installations outside DNF require a manual fapolicyd-cli --update to refresh the database. Files can also be added to the trust database explicitly via /etc/fapolicyd/fapolicyd.trust or the trust.d/ directory, for files delivered outside the package manager (custom scripts, vendored binaries, container runtimes). The policy rule language (/etc/fapolicyd/rules.d/) allows rules combining trust status, file path patterns, process path, UID/GID, and file type — for example, permitting any trusted executable to run from /usr, blocking execution from /tmp, /var/tmp, and /dev/shm unconditionally (a common dropper target), and denying untrusted scripts regardless of interpreter. Like SELinux and AppArmor, fapolicyd supports a permissive mode (permissive = 1 in fapolicyd.conf) that logs violations without enforcing them, enabling policy refinement before enforcement.

The three integrity checking modes are fapolicyd’s most security-relevant configuration axis. In the default mode (integrity checking off), fapolicyd trusts any file at a known path that is in the trust database by name — it does not verify the file’s contents, so a file replaced in-place with a malicious binary of the same name and size would pass. Size-based integrity adds a comparison of the file’s current size against the size recorded in the trust database, catching coarse tampering. SHA-256 hash integrity (integrity = sha256 in fapolicyd.conf) computes the SHA-256 hash of the file at execution time and compares it against the hash in the trust database — catching any content modification, at the cost of a hash computation on every execution of an uncached file. The third mode, IMA-based integrity (integrity = ima), reads the IMA-computed hash from the file’s security.ima extended attribute rather than computing it on the fly, combining the performance of a fast xattr lookup with the security of content-based verification — but requires IMA appraisal to be configured and the filesystem to support i_version. Red Hat does not recommend enabling hash integrity by default due to deadlock risk on systems where the hash computation itself triggers further fanotify events, but it is the correct mode for high-assurance deployments. fapolicyd integrates with the Linux audit subsystem for logging, composes naturally with USBGuard (USBGuard controls what hardware can connect; fapolicyd controls what software from that hardware can run), and pairs with IMA measurement for attestation: the combination of IMA’s runtime measurement log and fapolicyd’s execution gating gives a system where every executed file is both attested (IMA recorded its hash in TPM PCR 10) and authorised (fapolicyd confirmed it was trusted before allowing execution).

Related

AIDE (Advanced Intrusion Detection Environment)

Security Linux Integrity Monitoring Rhel Compliance
AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection tool that implements file integrity monitoring (FIM): it builds a baseline database capturing cryptographic hashes and metadata for every file it is configured to watch, and on subsequent runs compares the live filesystem against that database, reporting anything that has been added, removed, or changed. Its security premise is detection after the fact: AIDE does not prevent modifications (that is the role of fapolicyd, SELinux, and IMA), but it provides a reliable, auditable record that modifications occurred, when a check was run, and which specific attributes changed. An attacker who compromises a system and modifies a binary, a configuration file, a cron job, or an SSH authorized_keys file will leave a fingerprint in the next AIDE check — provided the database has not also been compromised, which is the central operational concern the tool’s deployment model must address.

USBGuard

Security Linux Usb Hardware Policy Rhel
USBGuard is a security framework for Linux that controls which USB devices are permitted to interact with the system. It sits above the kernel’s native USB authorisation subsystem — a per-device authorisation flag in the USB core that determines whether a device can be configured and begin sending data — and enforces a policy defined in a rule file against every device that connects or is present at startup. The threat model USBGuard addresses is both insider threat (unauthorised storage devices, data exfiltration) and hardware attack: BadUSB devices — malicious firmware embedded in devices that present themselves as HID keyboards, network adapters, or other trusted classes — can be blocked by a sufficiently specific USBGuard policy that restricts which USB interface classes are permitted. A USB device that claims to be a keyboard (03:01:01) but was not explicitly authorised cannot send keystrokes; a USB storage device plugged into a workstation with a policy that only allows a specific keyboard and mouse is blocked outright. USBGuard cannot protect against devices present at boot (before the daemon starts), so it is a defence-in-depth control for the running OS rather than a substitute for physical port security.

IMA (Integrity Measurement Architecture)

Security Linux Kernel Attestation Tpm Integrity
IMA (Integrity Measurement Architecture) is a Linux kernel subsystem, merged in kernel 2.6.30, that hooks into the kernel’s file access paths — execve(), mmap(), open() — and computes a cryptographic hash of each file’s contents before it is accessed, according to a configurable policy. It is the runtime half of the Linux integrity story: where TPM PCR measurements and Secure Boot cover what was loaded during the boot sequence, IMA covers what happens after the OS is running, hashing executables, libraries, kernel modules, firmware, and configuration files as they are opened, creating a continuously updated record of everything the system has actually used.