If no initial watched mount points then new mount points are not properly watched

[wjhunter3]

If there are no watched mount points when fapolicyd starts then new mount points are not properly watched. To re-create from a fresh install:

• Stop fapolicyd: # systemctl stop fapolicyd
• Edit /etc/fapolicyd/fapolicyd.conf to set watch_fs to only ramfs: watch_fs = ramfs
• Start fapolicyd in debug mode: # /usr/sbin/fapolicyd --debug
• Mount a ramfs, and copy a binary to it: # mkdir /tmp/test # mount -t ramfs /dev/ram0 /tmp/test # cp /bin/ls /tmp/test
• View the output of fapolicyd and note there are no "rule=2 dec=allow..." messages . . . Mount change detected Added /tmp/test mount point (nothing more at this point)
• Restart fapolicyd in debug mode, without unmounting /tmp/test: # /usr/sbin/fapolicyd --debug
• Execute the binary: # /tmp/test/ls
• View the output to see the proper messages: . . . added /tmp/test mount point Starting to listen for events rule=2 dec=allow perm=execute auid=0 pid=39632 exe=/usr/bin/bash : path=/tmp/test/ls ftype=application/x-executable trust=0 rule=2 dec=allow perm=open auid=0 pid=39632 exe=/usr/bin/bash : path=/tmp/test/ls ftype=application/x-executable trust=0

[wjhunter3]

The attached patch will resolve the problem. fapolicyd-1.3.1-issue-254.patch.txt

[radosroka]

Please create PR.

[sopos]

finally I was able to create a tmt test plan with tests with destructive potential [1] where one of the tests it testing this issue and I was actually able to reproduce it on rhel-8 but not rhel-9 which is interesting

1. https://github.com/RedHat-SP-Security/tests/tree/master/fapolicyd/destructive

  # fapolicyd-1.3.2-100.el9
    report
        how: display
            pass /default-0/fapolicyd/destructive/library
                output.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-0/fapolicyd/destructive/library-1/output.txt
                journal.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-0/fapolicyd/destructive/library-1/journal.txt
            pass /default-1/fapolicyd/destructive/mount-umount-after-cli--update
                output.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/mount-umount-after-cli--update-2/output.txt
                journal.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/mount-umount-after-cli--update-2/journal.txt
            pass /default-1/fapolicyd/destructive/newly-mounted-fstype
                output.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/newly-mounted-fstype-3/output.txt
                journal.txt: /var/tmp/tmt/run-022/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/newly-mounted-fstype-3/journal.txt
        summary: 3 tests passed

  # fapolicyd-1.3.2-1.el8
    report
        how: display
            pass /default-0/fapolicyd/destructive/library
                output.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-0/fapolicyd/destructive/library-1/output.txt
                journal.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-0/fapolicyd/destructive/library-1/journal.txt
            pass /default-1/fapolicyd/destructive/mount-umount-after-cli--update
                output.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/mount-umount-after-cli--update-2/output.txt
                journal.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/mount-umount-after-cli--update-2/journal.txt
            fail /default-1/fapolicyd/destructive/newly-mounted-fstype
                output.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/newly-mounted-fstype-3/output.txt
                journal.txt: /var/tmp/tmt/run-024/fapolicyd/destructive/plan/execute/data/guest/default-0/default-1/fapolicyd/destructive/newly-mounted-fstype-3/journal.txt
        summary: 2 tests passed and 1 test failed

[stevegrubb]

Can this issue be closed? Looks like it might be solved but can't tell.