Open pabchin opened 10 months ago
There are some program that, for whatever reason, start up wrong. You can use strace to reproduce the problem. If it starts up in a way that looks like the linker ran first, you will trigger this pattern. Sometimes this is associated with containers. Fapolicyd has limited visibility to containers because the fanotify API is not namespace aware.
So, the first question is, are containers running on the system? Are there any sandboxing frameworks using namespaces? Is there anything in common such as they are services started by systemd using it's security options (namespaces)?
Hello,
I have an embedded system where applications sometimes issue "system(some shell command)" or "system(some shell script)".
Occasionally, I see entries like this on the /var/log/messages
fapolicyd[1584]: rule=3 dec=deny_syslog perm=execute pid=6753 exe=/bin/busybox : path=/lib/ld-2.32.so ftype=application/x-sharedlib trust=1
OR
fapolicyd[1641]: rule=3 dec=deny_syslog perm=execute pid=31533 exe=/usr/local/bin/some_app : path=/lib/ld-2.32.so ftype=application/x-sharedlib trust=1
The commands executed (busybox or some_app) should not be denied. If this were an issue with rule 3, I would expect it to always happen.
I'm going to disable rule 3 and see if this still happens. But since it is intermittent and the first 'deny' rule is rule 3, I'm concerned it will just then hit rule 4.
Does any of the parameters in fapolicyd.conf need to be changed to avoid this?
Here are my rules list:
fapolicyd-cli -l
Here are current fapolicyd.conf:
permissive = 0 nice_val = 14 q_size = 800 uid = root gid = root do_stat_report = 1 detailed_report = 1 db_max_size = 50 subj_cache_size = 1549 obj_cache_size = 8191 watch_fs = ext2,ext3,ext4,tmpfs,xfs,vfat,iso9660,btrfs trust = file integrity = size syslog_format = rule,dec,perm,pid,exe,:,path,ftype,trust allow_filesystem_mark = 0 ~
Thanks