A Guide to Fapolicyd Rules Configuration and Default Deny Mode (Application control)

Rishi Abhishek

3 min read

·

Sep 27, 2024

--

2

Listen

Share

Press enter or click to view image in full size

Overview

This guide walks through setting up fapolicyd with a default-deny security posture. The goal here is to restrict access to critical system functions, limiting actions like package management to the root user, while still allowing essential binaries and specific applications like httpd, docker, and python3.9 to function properly.

Why Use Default-Deny Mode?

The default-deny mode ensures that no unauthorized binaries or scripts are executed unless explicitly allowed. This strengthens the overall security, especially in environments where multiple users have access. We make sure that only the root user can perform critical tasks such as system updates, and we whitelist essential binaries and applications so the system remains functional.

Installing and Setting Up fapolicyd

1. Install fapolicyd: On RHEL, CentOS, or AlmaLinux systems, you can install fapolicyd via the package manager.

yum update -y

sudo dnf install fapolicyd -y (or) yum install fapolicyd -y

2. Enable and Start the Service: After installation, enable and start the fapolicyd service:

sudo systemctl enable fapolicyd…