will fapolicyd be ported to run on Amazon Linux 2023 (kernel 6.1 based) ?

[ehousey]

Hi,

As we move to Amazon Linux 2023, which is based on the 6.1 version of the Linux kernel, fapolicyd does not build. An error is produced during the build dependency phase, looking for the "uthash-devel" rpm. This does not seem to exist for Amazon Linux 2023.

Has anyone been able to build fapolicyd for Amazon Linux 2023 (or a kernel based on 6.1) ?

Thank you, Ed

[radosroka]

How do you build fapolicyd? Can you elaborate?

[ehousey]

Hi radosroka,

Well, any RPM versions of fapolicyd I could find were not running on Amazon Linux 2 ("2" as in, before Amazon Linux 2023). Someone had posted steps on building fapolicyd from source to run on AL2, though a few of the steps were incorrect (at least for me). I reworked the steps and was able to build fapolicyd based on an Amazon Linux 2 system. running a 5.4 version of the kernel

But now, Amazon Linux 2023 is running kernel (6.1.56 at last peek), and the header file "uthash-devel.h" does not appear to be available for this newer version of the kernel. Hence I am stuck.

Ed

[radosroka]

Can you share the steps? I would like to see them. uthash is a separate package on fedora and on some older RHELs(not sure which releases) hence you can install it. If its not availabe we used to bundle it.

https://github.com/linux-application-whitelisting/fapolicyd/blob/main/fapolicyd.spec https://github.com/linux-application-whitelisting/fapolicyd/blob/main/fapolicyd-uthash-bundle.patch

[ehousey]

Hi radosroka,

Sure, here are the steps I used. I can try your uthash-bundle patch out and see if I can get any further. These steps were used to build an fapolicyd RPM on AL2. I'm trying to do the same thing but on AL 2023.

Thanks Ed

Enable the extras repo for kernel 5.4 (needed for the plumbing necessary for fapolicyd to work)

amazon-linux-extras install kernel-5.4 -y

Install kernel 5.4

yum -y -q install kernel

Reboot the system

reboot

When it's back up on the 5.4 kernel...

Changedir into our builddir

cd /usr/local/build

Copy the tarball to /usr/local/build/fapolicyd-1.3.2.tar.gz

aws s3 cp s3:///fapolicyd-1.3.2.tar.gz .

Extract the tarball

tar -xzvpf /usr/local/build/fapolicyd-1.3.1.tar.gz -C /usr/local/build/

Substitute "deny_audit" for "deny_syslog" in all /usr/local/build/fapolicyd-1.3.1/rules.d files

Changedir into the extracted codebase

cd /usr/local/build/fapolicyd-1.3.1

Enable the EPEL repository for Amazon Linux (via extras)

amazon-linux-extras install epel -y

Install necessary packages for building the RPM (via spec file)

if [ -f /etc/yum.repos.d/nodesource-el7.repo ] then mv /etc/yum.repos.d/nodesource-el7.repo /home/ec2-user fi yum-builddep -y -q /usr/local/build/fapolicyd-1.3.1/fapolicyd.spec

Run autogen.sh to prepare our build environment

./autogen.sh

Run configure to configure for building with RPM and audit

./configure --with-rpm --with-audit --disable-shared --disable-dependency-tracking

Changedir back to our builddir

cd /usr/local/build

Remove old tar.gz

rm -f /usr/local/build/fapolicyd-1.3.1.tar.gz

Create the new tarball

tar -czvf fapolicyd-1.3.1.tar.gz fapolicyd-1.3.1

Make the SOURCES directory for building the RPM

mkdir -p /usr/local/build/SOURCES

Link in the tarball (softlink)

rm -f /usr/local/build/SOURCES/fapolicyd-1.3.1.tar.gz ln -s /usr/local/build/fapolicyd-1.3.1.tar.gz /usr/local/build/SOURCES/fapolicyd-1.3.1.tar.gz

Install rpm-build (necessary for the next step)

yum -y -q install rpm-build

Build the RPM against the spec file for our specific environment

Edit fapolicyd.spec:

remove %changelog

comment out

%ghost %{_sysconfdir}/%{name}/rules.d/*

in %files section

# rpmbuild --define "_topdir pwd" -ba fapolicyd-1.3.1/fapolicyd.spec

Generated RPM is now in this location if everything went correctly!

ls -l /usr/local/build/RPMS/x86_64/fapolicyd-1.3.1-1.x86_64.rpm

Let's attempt to install it ourselves

cd /usr/local/build/RPMS/x86_64 rpm -ivh fapolicyd-1.3.1-1.x86_64.rpm

rpm -ivh fapolicyd-debuginfo-1.3.1-1.x86_64.rpm

[radosroka]

You need to also download uthash tarball with specific version see .spec file and put it to the right place.

[radosroka]

Btw have you tried to install uthash-devel manually?

[ehousey]

Hi radosroka,

Great news! I was able to successfully build the 1.0.4 version of fapolicyd on Amazon Linux 2023. Thank you for the reference to the uthash-devel RPM. I have included the steps I used to build the fapolicyd RPM for Amazon Linux 2023 below.

source for uthash-devel rpm: https://rpmfind.net/linux/rpm2html/search.php?query=uthash-devel

Install all necessary build rpms

dnf -y groupinstall "Development Tools" dnf -y install pcre2-devel openssl-devel systemd-devel dnf-utils aws s3 cp s3://YOUR S3 BUCKET/uthash-devel-2.3.0-6.fc39.noarch.rpm . rpm -ivh uthash-devel-2.3.0-6.fc39.noarch.rpm

Unpack the source

mkdir -p /usr/local/build cd /usr/local/build aws s3 cp s3://YOUR S3 BUCKET/fapolicyd-1.0.4.tar.gz . tar -xzvpf /usr/local/build/fapolicyd-1.0.4.tar.gz -C /usr/local/build/ cd /usr/local/build/fapolicyd-1.0.4

<ensure init/fapolicyd.conf has permissive = 1>

Install rpm dependencies and configure

yum-builddep -y -q /usr/local/build/fapolicyd-1.0.4/fapolicyd.spec ./autogen.sh ./configure --with-rpm --with-audit --disable-shared --disable-dependency-tracking

Changedir back to our builddir

cd /usr/local/build

Remove old tar.gz

rm -f /usr/local/build/fapolicyd-1.0.4.tar.gz

Create the new tarball

tar -czvf fapolicyd-1.0.4.tar.gz fapolicyd-1.0.4

Make the SOURCES directory for building the RPM

mkdir -p /usr/local/build/SOURCES

Link in the tarball (softlink)

rm -f /usr/local/build/SOURCES/fapolicyd-1.0.4.tar.gz ln -s /usr/local/build/fapolicyd-1.0.4.tar.gz /usr/local/build/SOURCES/fapolicyd-1.0.4.tar.gz

Install rpm-build (necessary for the next step)

yum -y -q install rpm-build

Build the RPM against the spec file for our specific environment

rpmbuild --define "_topdir pwd" -ba fapolicyd-1.0.4/fapolicyd.spec

Generated RPM is now in this location if everything went correctly!

ls -l /usr/local/build/RPMS/x86_64/fapolicyd-1.0.4-1.x86_64.rpm

Let's attempt to install it ourselves

cd /usr/local/build/RPMS/x86_64 rpm -ivh fapolicyd-1.0.4-1.x86_64.rpm

Ed