https://lesitedefrancois.be/en/tags/allowlisting/Recent content in Allowlisting on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/fapolicyd/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/fapolicyd/<p><strong>fapolicyd (File Access Policy Daemon)</strong> is an application allowlisting framework for Linux, developed by Red Hat and shipped as a supported component of RHEL 8+. Its security premise is supply-chain integrity at the execution layer: only software that was installed through a trusted package manager (DNF/RPM) or explicitly declared as trusted by an administrator may execute on the system. An attacker who achieves a foothold and drops a new binary — a reverse shell, a lateral movement tool, a cryptominer — will find that binary blocked at execution time, because it is absent from the trust database, regardless of its Unix permissions or SELinux label. fapolicyd addresses a different dimension of access control than <strong>SELinux</strong>: SELinux models how applications behave (what resources they may access); fapolicyd models whether applications are trusted at all (whether they may execute in the first place). The two are complementary: SELinux confines a trusted application&rsquo;s behaviour; fapolicyd prevents untrusted applications from running.</p>