search

ctc-oss / fapolicy-analyzer

Tools to assist with the configuration and management of fapolicyd.
https://ctc-oss.github.io/fapolicy-analyzer
GNU General Public License v3.0
12 stars 5 forks source link

Application Profiler does not report missing fapolicyd service #530

Closed jw3 closed 2 years ago

jw3 commented 2 years ago

In the case where the fapolicyd service is not found the only indication of failure is a stack trace.

The close button becomes unresponsive, the dialog must be closed out with the X

tparchambault commented 2 years ago

Is this symptom observed in a production or development environment? I believe that on a production system, the System object won't be instantiated and the user will get the start-up error dlg. If that API interaction has changed over time then we/I need to revisit the code that handles that failure, i.e. If this is on a production system then it is a bug. The Profiler can "run" in the development environment but only as a convenience for developers. fapd control (start/stop) is not attempted for non-root users, although the AAC will invoke the target executable. Things like chown'ing of stdout/stderr and changing the euid will fail due to inadequate permissions.

jw3 commented 2 years ago

This is on a machine that does not have fapolicyd installed.

tparchambault commented 2 years ago

Understood, but in a normal i.e. rpm install, and when invoked via /usr/sbin/fapolicy-analyzer, there are other checks that occur wrt fapolicyd being installed and run at least once to create and populate the /var/lib/fapolicyd/* otherwise the start-up error dlg is displayed. There is no option to continue; it exits on OK.

Fwiw, I see the same dlg in a development env too when fapolicyd is not installed. Also fwiw I installed fapolicyd via the pkg manager as a data point.

The production box was RHEL8.6 and the dev box was FC34.

NoFapolicydInstalledOnDevBox

FapaVerboseOutputOnDevBox

The dlg is displayed on a failure to create the System object. This has been in place for a while. I'm guessing 6-9 months?

tparchambault commented 2 years ago

The user should never get to the MainWindow and the associated Tool menu items. Feel free to WebEx w/me so we can address this.

jw3 commented 2 years ago

One way to recreate this is to remove the fapolicyd unit file from a working installation.

At a minimum the exception should be caught and the GUI should make it obvious that something went wrong. Toaster message?

tparchambault commented 2 years ago

That is how I generated the above dialogs, i.e. dnf remove fapolicyd. It doesn't get more obvious than that.

tparchambault commented 2 years ago

Clarified w/ @jw3 via voice comms. This is about failing gracefully when systemd control is not functioning correctly e.g. service file disabled, syntax errors, missing or renamed unit file for whatever reason, etc.

jw3 commented 2 years ago

Looks like the core concerns here were addressed during milestone 7, the UI now remains responsive.