Chapter 11. Restricting the execution of applications by using the fapolicyd RHEL system role By using the fapolicyd software framework, you can restrict the execution of applications based on a user-defined policy and the framework verifies the integrity of applications before execution. This an efficient method to prevent running untrustworthy and possibly malicious applications. You can automate the installation and configuration of fapolicyd by using the fapolicyd RHEL system role. Important The fapolicyd service prevents only the execution of unauthorized applications that run as regular users, and not as root . 11.1. Preventing users from executing untrustworthy code by using the fapolicyd RHEL system role You can automate the installation and configuration of the fapolicyd service by using the fapolicyd RHEL system role. With this role, you can remotely configure the service to allow users to execute only trusted applications, for example, the ones which are listed in the RPM database and in an allow list. Additionally, the service can perform integrity checks before it executes an allowed application. Prerequisites You have prepared the control node and the managed nodes . You are logged in to the control node as a user who can run playbooks on the managed nodes. The account you use to connect to the managed nodes has sudo permissions on them. Procedure Create a playbook file, for example ~/playbook.yml , with the following content: --- - name: Configuring fapolicyd hosts: managed-node-01.example.com tasks: - name: Allow only executables installed from RPM database and specific files ansible.builtin.include_role: name: rhel-system-roles.fapolicyd vars: fapolicyd_setup_permissive: false fapolicyd_setup_integrity: sha256 fapolicyd_setup_trust: rpmdb,file fapolicyd_add_trusted_file: - <path_to_allowed_command> - <path_to_allowed_service> The settings specified in the example playbook include the following: fapolicyd_setup_permissive: <true|false> Enables or disables sending policy decisions to the kernel for enforcement. Set this variable for debugging and testing purposes to false . fapolicyd_setup_integrity: <type_type> Defines the integrity checking method. You can set one of the following values: none (default): Disables integrity checking. size : The service compares only the file sizes of allowed applications. ima : The service checks the SHA-256 hash that the kernel's Integrity Measurement Architecture (IMA) stored in a file's extended attribute. Additionally, the service performs a size check. Note that the role does not configure the IMA kernel subsystem. To use this option, you must manually configure the IMA subsystem. sha256 : The service compares the SHA-256 hash of allowed applications. fapolicyd_setup_trust: <trust_backends> Defines the list of trust backends. If you include the file backend, specify the allowed executable files in the fapolicyd_add_trusted_file list. For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.fapolicyd.README.md file on the control node. Validate the playbook syntax: Note that this command only validates the syntax and does not protect against a wrong but valid configuration. Run the playbook: Verification Execute a binary application that is not on the allow list as a user: Additional resources /usr/share/ansible/roles/rhel-system-roles.fapolicyd/README.md file /usr/share/doc/rhel-system-roles/fapolicyd/ directory

Commands:
--- - name: Configuring fapolicyd hosts: managed-node-01.example.com tasks: - name: Allow only executables installed from RPM database and specific files ansible.builtin.include_role: name: rhel-system-roles.fapolicyd vars: fapolicyd_setup_permissive: false fapolicyd_setup_integrity: sha256 fapolicyd_setup_trust: rpmdb,file fapolicyd_add_trusted_file: - <path_to_allowed_command> - <path_to_allowed_service>
ansible-playbook ~/playbook.yml --syntax-check
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'su -c "/bin/not_authorized_application " <user_name> ' bash: line 1: /bin/not_authorized_application: Operation not permitted non-zero return code