search

ctc-oss / fapolicy-analyzer

Tools to assist with the configuration and management of fapolicyd.
https://ctc-oss.github.io/fapolicy-analyzer
GNU General Public License v3.0
12 stars 5 forks source link

Reload rules with signal #877

Closed jw3 closed 8 months ago

jw3 commented 1 year ago

Rules can now be reloaded with a signal rather than full daemon reload.

https://github.com/linux-application-whitelisting/fapolicyd/pull/243

Flashback: Trust was moved to using the full daemon reload because Rules required it. Now that Rules can be signaled, Trust could return to a signal. This opens the door for deployments without a daemon reload.

There could be other impacts there though, for example if bad rules were deployed, there might not be a way to write compiled.rules without stopping the daemon. Daemon stopping could become a fallback, with the optimization of not stopping becoming the first attempt.

The summary is that its not clear-cut that this needs to be supported, needs some though.

After a quick read of the linked PR it is not obvious whether rules.d is recalculated in any way, or if compiled.rules is the only thing being reloaded. Ill dig deeper later, but either way we are good, since we are writing still writing our own compiled.rules. This could impact the validity of #555.

tparchambault commented 11 months ago

Does the Profiler use the same unit file? I'm thinking of the use-case where we are dry running a proposed rule set (if that's even a thing on the roadmap.)