[packages/fapolicyd] Up to 2.0.1
arekm
arekm at pld-linux.org
Thu Oct 8 18:15:02 CEST 2026
commit 5cd30b876a3f87e47305effd8416174011b51320
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Oct 8 18:14:08 2026 +0200
Up to 2.0.1
fapolicyd-poldek.patch | 11 ++++
fapolicyd.init | 102 +++++++++++++++++++++++++++++++
fapolicyd.spec | 161 ++++++++++++++++++++++++++++++++++++++++++++-----
fapolicyd.sysconfig | 3 +
4 files changed, 261 insertions(+), 16 deletions(-)
---
diff --git a/fapolicyd.spec b/fapolicyd.spec
index 7941060..3f47963 100644
--- a/fapolicyd.spec
+++ b/fapolicyd.spec
@@ -1,20 +1,26 @@
-# TODO: handle "fapolicyd" user, systemd service etc. (see upstream fapolicyd.spec)
-#
# Conditional build:
%bcond_without audit # decision auditing support
%bcond_without rpm # RPM database as a trust source
+%bcond_without tests # unit tests
+%bcond_with selinux # SELinux policy module (needs selinux-policy-devel)
Summary: Application allow listing daemon
Summary(pl.UTF-8): Demon do obsługi listy dozwolonych aplikacji
Name: fapolicyd
-Version: 1.3.3
-Release: 0.1
-License: GPL v2+
+Version: 2.0.1
+Release: 1
+License: GPL v3+
Group: Daemons
-Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
-# Source0-md5: 072f3e281662838f608b3da6e1061a9e
+#Source0Download: https://github.com/linux-application-whitelisting/fapolicyd/releases
+Source0: https://github.com/linux-application-whitelisting/fapolicyd/releases/download/v%{version}/%{name}-%{version}.tar.gz
+# Source0-md5: d063b6db132bcefee2814cf46545c826
+Source1: %{name}.init
+Source2: %{name}.sysconfig
+Source3: https://github.com/linux-application-whitelisting/fapolicyd-selinux/archive/v1.2/%{name}-selinux-1.2.tar.gz
+# Source3-md5: cb7f9e705e03a14408812a101d6aef30
Patch0: %{name}-ldso.patch
-URL: https://people.redhat.com/sgrubb/fapolicyd/
+Patch1: %{name}-poldek.patch
+URL: https://github.com/linux-application-whitelisting/fapolicyd
BuildRequires: autoconf >= 2.60
BuildRequires: automake
BuildRequires: file
@@ -30,7 +36,22 @@ BuildRequires: pkgconfig
BuildRequires: rpmbuild(macros) >= 1.673
BuildRequires: udev-devel
BuildRequires: uthash-devel
+Requires(post,preun,postun): systemd-units >= 38
+Requires(post,preun): /sbin/chkconfig
+Requires(postun): /usr/sbin/groupdel
+Requires(postun): /usr/sbin/userdel
+Requires(pre): /bin/id
+Requires(pre): /usr/bin/getgid
+Requires(pre): /usr/sbin/groupadd
+Requires(pre): /usr/sbin/useradd
+# magic.mgc is only in file; fapolicyd-magic.mgc is compiled by the build-time file and older libmagic cannot read it
+Requires: file >= 5.48
+Requires: rc-scripts
+Requires: systemd-units >= 38
Requires: uname(release) >= 4.20
+Provides: group(fapolicyd)
+Provides: user(fapolicyd)
+%{?with_selinux:BuildRequires: selinux-policy-devel}
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
%description
@@ -47,9 +68,29 @@ prawach dostępu do plików. Aplikacje znane przez źródło reputacji mają
dostęp dozwolony, natomiast nieznane aplikacje nie. Demon wykorzystuje
interfejs jądra fanotify do określania praw dostępu do plików.
+%if %{with selinux}
+%package selinux
+Summary: SELinux policy module for fapolicyd
+Summary(pl.UTF-8): Moduł polityki SELinux dla fapolicyd
+Group: Base
+Requires(post,postun): /usr/sbin/semodule
+Requires: %{name} = %{version}-%{release}
+Requires: selinux-policy
+BuildArch: noarch
+
+%description selinux
+SELinux policy module for fapolicyd. It is optional - fapolicyd works
+without it.
+
+%description selinux -l pl.UTF-8
+Moduł polityki SELinux dla fapolicyd. Jest opcjonalny - fapolicyd
+działa bez niego.
+%endif
+
%prep
-%setup -q
+%setup -q %{?with_selinux:-a3}
%patch -P0 -p1
+%patch -P1 -p1
%build
%{__libtoolize}
@@ -59,11 +100,27 @@ interfejs jądra fanotify do określania praw dostępu do plików.
%{__automake}
%configure \
%{?with_audit:--with-audit} \
- %{!?with_rpm:--without-rpm}
+ %{!?with_rpm:--without-rpm} \
+ --disable-shared
+
+# rules must name the same dynamic linker the daemon was configured with
+ld_so=$(%{__sed} -n 's/^#define SYSTEM_LD_SO "\(.*\)"$/\1/p' config.h)
+test -n "$ld_so"
+%{__sed} -i -e "s|%%ld_so_path%%|$ld_so|" rules.d/*.rules
+
%{__make}
+%if %{with tests}
+%{__make} check
+%endif
+
+%if %{with selinux}
+%{__make} -C %{name}-selinux-1.2
+%endif
+
%install
rm -rf $RPM_BUILD_ROOT
+install -d $RPM_BUILD_ROOT{/var/log,/etc/{rc.d/init.d,sysconfig},%{systemdtmpfilesdir},/var/lib/fapolicyd,%{_sysconfdir}/fapolicyd/{rules.d,trust.d}}
%{__make} install \
DESTDIR=$RPM_BUILD_ROOT \
@@ -72,27 +129,99 @@ rm -rf $RPM_BUILD_ROOT
%{__mv} $RPM_BUILD_ROOT%{bash_compdir}/fapolicyd{.bash_completion,}
+install -p %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/fapolicyd
+cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/fapolicyd
+cp -p init/fapolicyd-tmpfiles.conf $RPM_BUILD_ROOT%{systemdtmpfilesdir}/fapolicyd.conf
+
+# default policy: the "known-libs" set from README-rules
+for f in 10-languages 20-dracut 21-updaters 30-patterns 40-bad-elf 41-shared-obj \
+ 42-trusted-elf 70-trusted-lang 72-shell 90-deny-execute 95-allow-open; do
+ cp -p $RPM_BUILD_ROOT%{_datadir}/fapolicyd/sample-rules/$f.rules \
+ $RPM_BUILD_ROOT%{_sysconfdir}/fapolicyd/rules.d
+done
+
+touch $RPM_BUILD_ROOT%{_sysconfdir}/fapolicyd/compiled.rules \
+ $RPM_BUILD_ROOT/var/log/fapolicyd-access.log
+
+%if %{with selinux}
+install -D -p %{name}-selinux-1.2/%{name}.pp.bz2 $RPM_BUILD_ROOT%{_datadir}/selinux/packages/targeted/%{name}.pp.bz2
+install -D -p -m644 %{name}-selinux-1.2/%{name}.if $RPM_BUILD_ROOT%{_datadir}/selinux/devel/include/contrib/ipp-%{name}.if
+%endif
+
# no API exported
%{__rm} $RPM_BUILD_ROOT%{_libdir}/libfapolicyd.{a,la}
%clean
rm -rf $RPM_BUILD_ROOT
+%pre
+%groupadd -g 367 fapolicyd
+%useradd -u 367 -d /var/lib/fapolicyd -s /bin/false -c "File Access Policy Daemon" -g fapolicyd fapolicyd
+
+%post
+/sbin/chkconfig --add fapolicyd
+%service fapolicyd restart "File Access Policy Daemon"
+%systemd_post fapolicyd.service
+
+%preun
+if [ "$1" = "0" ]; then
+ %service -q fapolicyd stop
+ /sbin/chkconfig --del fapolicyd
+fi
+%systemd_preun fapolicyd.service
+
+%postun
+%systemd_reload
+if [ "$1" = "0" ]; then
+ %userremove fapolicyd
+ %groupremove fapolicyd
+fi
+
+%if %{with selinux}
+%post selinux
+/usr/sbin/semodule -n -i %{_datadir}/selinux/packages/targeted/%{name}.pp.bz2
+
+%postun selinux
+if [ "$1" = "0" ]; then
+ /usr/sbin/semodule -n -r %{name}
+fi
+
+%files selinux
+%defattr(644,root,root,755)
+%{_datadir}/selinux/packages/targeted/%{name}.pp.bz2
+%{_datadir}/selinux/devel/include/contrib/ipp-%{name}.if
+%endif
+
%files
%defattr(644,root,root,755)
-%doc AUTHORS ChangeLog README.md TODO
+%doc AUTHORS ChangeLog NEWS README.md TODO doc/systemd-watchdog.md
%attr(755,root,root) %{_sbindir}/fagenrules
%attr(755,root,root) %{_sbindir}/fapolicyd
%attr(755,root,root) %{_sbindir}/fapolicyd-cli
-%dir %{_sysconfdir}/fapolicyd
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd.conf
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd.trust
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd-filter.conf
-%{_datadir}/fapolicyd
+%if %{with rpm}
+%attr(755,root,root) %{_libexecdir}/fapolicyd-rpm-loader
+%endif
+%attr(750,root,fapolicyd) %dir %{_sysconfdir}/fapolicyd
+%attr(750,root,fapolicyd) %dir %{_sysconfdir}/fapolicyd/rules.d
+%attr(750,root,fapolicyd) %dir %{_sysconfdir}/fapolicyd/trust.d
+%attr(640,root,fapolicyd) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd.conf
+%attr(640,root,fapolicyd) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd.trust
+%attr(640,root,fapolicyd) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/fapolicyd-filter.conf
+%attr(640,root,fapolicyd) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/fapolicyd/rules.d/*.rules
+%ghost %attr(640,root,fapolicyd) %{_sysconfdir}/fapolicyd/compiled.rules
+%attr(754,root,root) /etc/rc.d/init.d/fapolicyd
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/fapolicyd
%{systemdunitdir}/fapolicyd.service
+%{systemdtmpfilesdir}/fapolicyd.conf
%{bash_compdir}/fapolicyd
+%{_datadir}/fapolicyd
+%attr(770,root,fapolicyd) %dir /var/lib/fapolicyd
+%ghost %attr(440,fapolicyd,fapolicyd) %{_localstatedir}/log/fapolicyd-access.log
%{_mandir}/man5/fapolicyd.conf.5*
+%{_mandir}/man5/fapolicyd.metrics.5*
%{_mandir}/man5/fapolicyd.rules.5*
+%{_mandir}/man5/fapolicyd.state.5*
+%{_mandir}/man5/fapolicyd.timing.5*
%{_mandir}/man5/fapolicyd.trust.5*
%{_mandir}/man5/fapolicyd-filter.conf.5*
%{_mandir}/man5/rpm-filter.conf.5*
diff --git a/fapolicyd-poldek.patch b/fapolicyd-poldek.patch
new file mode 100644
index 0000000..84ab42d
--- /dev/null
+++ b/fapolicyd-poldek.patch
@@ -0,0 +1,11 @@
+# PLD updater is poldek (librpm in-process), upstream rule covers only dnf
+--- fapolicyd-2.0.1.orig/rules.d/21-updaters.rules 2026-10-08 16:25:28.989501898 +0200
++++ fapolicyd-2.0.1/rules.d/21-updaters.rules 2026-10-08 16:25:29.169501898 +0200
+@@ -2,6 +2,6 @@
+ # or things go very bad (deadlock).
+
+ allow perm=open exe=/usr/bin/rpm : all
+-allow perm=open exe=%python3_path% comm=dnf : all
++allow perm=open exe=/usr/bin/poldek : all
+
+
diff --git a/fapolicyd.init b/fapolicyd.init
new file mode 100644
index 0000000..06ff845
--- /dev/null
+++ b/fapolicyd.init
@@ -0,0 +1,102 @@
+#!/bin/sh
+#
+# fapolicyd File Access Policy Daemon
+#
+# chkconfig: 2345 02 98
+# description: fapolicyd decides file access rights based on a trust database \
+# and a set of rules, using the kernel's fanotify interface.
+#
+# processname: fapolicyd
+# config: /etc/sysconfig/fapolicyd
+# config: /etc/fapolicyd/fapolicyd.conf
+# pidfile: /run/fapolicyd/fapolicyd.pid
+
+# Source function library
+. /etc/rc.d/init.d/functions
+
+# Get service config - may override defaults
+[ -f /etc/sysconfig/fapolicyd ] && . /etc/sysconfig/fapolicyd
+
+start() {
+ if [ -f /var/lock/subsys/fapolicyd ]; then
+ msg_already_running "File Access Policy Daemon"
+ return
+ fi
+
+ msg_starting "File Access Policy Daemon"
+ # the daemon hardcodes /run/fapolicyd for its pid file and fifo; /var/run is not /run on PLD
+ install -d -m 770 -o root -g fapolicyd /run/fapolicyd
+ /usr/sbin/fagenrules >/dev/null
+ RETVAL=$?
+ if [ $RETVAL -eq 0 ]; then
+ daemon /usr/sbin/fapolicyd $FAPOLICYD_OPTIONS
+ RETVAL=$?
+ else
+ fail
+ fi
+ [ $RETVAL -eq 0 ] && touch /var/lock/subsys/fapolicyd
+}
+
+stop() {
+ if [ ! -f /var/lock/subsys/fapolicyd ]; then
+ msg_not_running "File Access Policy Daemon"
+ return
+ fi
+
+ msg_stopping "File Access Policy Daemon"
+ killproc --pidfile /run/fapolicyd/fapolicyd.pid fapolicyd
+ rm -f /var/lock/subsys/fapolicyd >/dev/null 2>&1
+}
+
+condrestart() {
+ if [ ! -f /var/lock/subsys/fapolicyd ]; then
+ msg_not_running "File Access Policy Daemon"
+ RETVAL=$1
+ return
+ fi
+
+ stop
+ start
+}
+
+reload() {
+ if [ ! -f /var/lock/subsys/fapolicyd ]; then
+ msg_not_running "File Access Policy Daemon"
+ RETVAL=7
+ return
+ fi
+
+ # SIGHUP makes the daemon reload its rules and configuration
+ /usr/sbin/fagenrules --load
+ RETVAL=$?
+}
+
+RETVAL=0
+# See how we were called.
+case "$1" in
+ start)
+ start
+ ;;
+ stop)
+ stop
+ ;;
+ restart)
+ stop
+ start
+ ;;
+ try-restart)
+ condrestart 0
+ ;;
+ reload|force-reload)
+ reload
+ ;;
+ status)
+ status --pidfile /run/fapolicyd/fapolicyd.pid fapolicyd
+ RETVAL=$?
+ ;;
+ *)
+ msg_usage "$0 {start|stop|restart|try-restart|reload|force-reload|status}"
+ exit 3
+esac
+
+exit $RETVAL
diff --git a/fapolicyd.sysconfig b/fapolicyd.sysconfig
new file mode 100644
index 0000000..f423ff3
--- /dev/null
+++ b/fapolicyd.sysconfig
@@ -0,0 +1,3 @@
+# Extra options for fapolicyd, see fapolicyd(8). For example "--permissive"
+# logs policy violations without enforcing them.
+#FAPOLICYD_OPTIONS=""
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/fapolicyd.git/commitdiff/5cd30b876a3f87e47305effd8416174011b51320
More information about the pld-cvs-commit
mailing list