rpms/fapolicyd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS fapolicyd-2.0-1.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-24 09:01:21 -04:00
parent 13fee7b5b1
commit 2dd4c1333c
15 changed files with 572 additions and 369 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.fapolicyd.metadata
View File

@ -1,3 +1,3 @@
1a4a68f063262ca09c23d5bb617c8e036460c907 SOURCES/fapolicyd-1.4.3.tar.gz
7738046b00e2fde870ee483ff8ccb8235ecfcee1 SOURCES/fapolicyd-selinux-1.1.tar.gz
21dfb07821d454452f3873b50779ab5a170713e3 SOURCES/fapolicyd-2.0.tar.gz
7d5bc037e5c9140b9e7eb4ca12745961bfffb491 SOURCES/fapolicyd-selinux-1.2.tar.gz
fbafa356359ace80787ce6634d84425b40d90907 SOURCES/uthash-2.3.0.tar.gz

4
.gitignore vendored
View File

@ -1,3 +1,3 @@
SOURCES/fapolicyd-1.4.3.tar.gz
SOURCES/fapolicyd-selinux-1.1.tar.gz
SOURCES/fapolicyd-2.0.tar.gz
SOURCES/fapolicyd-selinux-1.2.tar.gz
SOURCES/uthash-2.3.0.tar.gz

495
SOURCES/0002-Fix-large-file-support-on-32-bit-builds.patch Normal file
View File

@ -0,0 +1,495 @@
From 3e851ff5518cd0e4d7e95654b45159056e7f13f4 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Thu, 23 Jul 2026 11:24:22 -0400
Subject: [PATCH] Fix large-file support on 32-bit builds
Content-type: text/plain
The build did not request a large-file ABI, and several translation units did not include the generated config header before system headers. On i686 this left off_t at 32 bits and exposed an incorrect trustdb_lmdb_test assumption that bulk import parses record sizes.
Enable AC_SYS_LARGEFILE and consistently include config.h first so configure-selected feature macros apply to every C translation unit. Update the LMDB regression to import the ABI-independent record first, then verify that size-integrity lookup accepts the 4 GiB value with wide off_t and rejects it with narrow off_t.
The database wire representation is unchanged, so existing LMDB files do not require migration and 64-bit builds retain their existing large-file ABI.
---
configure.ac | 1 +
src/library/attr-sets.c | 2 ++
src/library/avl.c | 3 ++-
src/library/deb-backend.c | 2 ++
src/library/llist.c | 2 ++
src/library/stack.c | 2 ++
src/library/string-util.c | 2 ++
src/perf-test/fapolicyd-perf-test.c | 4 ++--
src/tests/attr_sets_test.c | 2 ++
src/tests/avl_test.c | 3 ++-
src/tests/cli_privilege_test.c | 2 ++
src/tests/decision_defer_test.c | 2 ++
src/tests/decision_timing_report_test.c | 2 ++
src/tests/elf_file_test.c | 3 +++
src/tests/escape_test.c | 3 ++-
src/tests/event_test.c | 2 ++
src/tests/failure_action_test.c | 2 ++
src/tests/fd_fgets_test.c | 2 ++
src/tests/file_filter_test.c | 2 ++
src/tests/filter_test.c | 2 ++
src/tests/gid_proc_test.c | 2 ++
src/tests/ignore_mounts_risk_test.c | 2 ++
src/tests/lru_test.c | 2 ++
src/tests/policy_concurrent_test.c | 2 ++
src/tests/policy_reload_test.c | 2 ++
src/tests/queue_test.c | 2 ++
src/tests/test-stubs.c | 2 ++
src/tests/trustdb_format_test.c | 2 ++
src/tests/trustdb_lmdb_test.c | 32 ++++++++++++++++++-------
src/tests/uid_proc_test.c | 2 ++
30 files changed, 81 insertions(+), 14 deletions(-)
diff --git a/configure.ac b/configure.ac
index b2e9f0e6ef65..5e5395e88ee0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5,6 +5,7 @@ AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4])
AC_USE_SYSTEM_EXTENSIONS
+AC_SYS_LARGEFILE
AC_CANONICAL_TARGET
AM_INIT_AUTOMAKE(foreign subdir-objects)
diff --git a/src/library/attr-sets.c b/src/library/attr-sets.c
index b71e602b647c..80e238357c83 100644
--- a/src/library/attr-sets.c
+++ b/src/library/attr-sets.c
@@ -43,6 +43,8 @@
* released directly by attr_set_destroy().
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/library/avl.c b/src/library/avl.c
index 72807df63ac7..f2f69ef6bd69 100644
--- a/src/library/avl.c
+++ b/src/library/avl.c
@@ -7,7 +7,8 @@
* Public License (LGPL). See the provenance note below.
*/
-//#include "config.h"
+#include "config.h"
+
#include <stddef.h> // for NULL
#include "avl.h"
diff --git a/src/library/deb-backend.c b/src/library/deb-backend.c
index 40e17f4349fd..b83fd3ffe490 100644
--- a/src/library/deb-backend.c
+++ b/src/library/deb-backend.c
@@ -19,6 +19,8 @@
* Boston, MA 02110-1335, USA.
*/
+#include "config.h"
+
#include <dpkg/db-ctrl.h>
#include <dpkg/db-fsys.h>
#include <dpkg/pkg-array.h>
diff --git a/src/library/llist.c b/src/library/llist.c
index 0eb1d99d55ab..2778d2e60b69 100644
--- a/src/library/llist.c
+++ b/src/library/llist.c
@@ -24,6 +24,8 @@
* Zoltan Fridrich <zfridric@redhat.com>
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/library/stack.c b/src/library/stack.c
index 1a270ed6235d..21f55978b39c 100644
--- a/src/library/stack.c
+++ b/src/library/stack.c
@@ -22,6 +22,8 @@
* Radovan Sroka <rsroka@redhat.com>
*/
+#include "config.h"
+
#include "stack.h"
#include <stddef.h>
diff --git a/src/library/string-util.c b/src/library/string-util.c
index 7429db0009bc..7052ee1bd75b 100644
--- a/src/library/string-util.c
+++ b/src/library/string-util.c
@@ -23,6 +23,8 @@
* Zoltan Fridrich <zfridric@redhat.com>
*/
+#include "config.h"
+
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
diff --git a/src/perf-test/fapolicyd-perf-test.c b/src/perf-test/fapolicyd-perf-test.c
index c846cbe085ee..2f2c861a0f67 100644
--- a/src/perf-test/fapolicyd-perf-test.c
+++ b/src/perf-test/fapolicyd-perf-test.c
@@ -23,6 +23,8 @@
* Ondrej Mosnacek <omosnace@redhat.com>
*/
+#include "config.h"
+
#include <stdlib.h>
#include <stdio.h>
#include <stdatomic.h>
@@ -31,8 +33,6 @@
#include <unistd.h>
#include <sys/time.h>
-#include "config.h"
-
#include "daemon-config.h"
#include "message.h"
#include "policy.h"
diff --git a/src/tests/attr_sets_test.c b/src/tests/attr_sets_test.c
index 42e048e7fbd6..6513bb1e9b64 100644
--- a/src/tests/attr_sets_test.c
+++ b/src/tests/attr_sets_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
diff --git a/src/tests/avl_test.c b/src/tests/avl_test.c
index b1de0c8d4c16..0aa0c659e759 100644
--- a/src/tests/avl_test.c
+++ b/src/tests/avl_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
@@ -271,4 +273,3 @@ int main(void)
return 0;
}
-
diff --git a/src/tests/cli_privilege_test.c b/src/tests/cli_privilege_test.c
index 7cf36c898667..f3fd77032ac7 100644
--- a/src/tests/cli_privilege_test.c
+++ b/src/tests/cli_privilege_test.c
@@ -2,6 +2,8 @@
* cli_privilege_test.c - verify fapolicyd-cli privilege policies
*/
+#include "config.h"
+
#include <error.h>
#include <stdbool.h>
#include <stdlib.h>
diff --git a/src/tests/decision_defer_test.c b/src/tests/decision_defer_test.c
index 228d46bbff83..42c819156630 100644
--- a/src/tests/decision_defer_test.c
+++ b/src/tests/decision_defer_test.c
@@ -1,6 +1,8 @@
/*
* decision_defer_test.c - unit tests for subject-slot decision deferral
*/
+#include "config.h"
+
#include <errno.h>
#include <pthread.h>
#include <stdio.h>
diff --git a/src/tests/decision_timing_report_test.c b/src/tests/decision_timing_report_test.c
index aebd9fe3323c..bc7d7ebe5479 100644
--- a/src/tests/decision_timing_report_test.c
+++ b/src/tests/decision_timing_report_test.c
@@ -1,6 +1,8 @@
/*
* decision_timing_report_test.c - timing report formatting tests
*/
+#include "config.h"
+
#include <error.h>
#include <stdarg.h>
#include <stdbool.h>
diff --git a/src/tests/elf_file_test.c b/src/tests/elf_file_test.c
index 11dd774191f2..423c5c640082 100644
--- a/src/tests/elf_file_test.c
+++ b/src/tests/elf_file_test.c
@@ -10,6 +10,9 @@
*/
#define _GNU_SOURCE
+
+#include "config.h"
+
#include <errno.h>
#include <error.h>
#include <fcntl.h>
diff --git a/src/tests/escape_test.c b/src/tests/escape_test.c
index f23762e4eb26..72ff2fd77046 100644
--- a/src/tests/escape_test.c
+++ b/src/tests/escape_test.c
@@ -2,8 +2,9 @@
* escape_test.c - tests for shell escaping helpers
*/
-#include "escape.h"
+#include "config.h"
+#include "escape.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/event_test.c b/src/tests/event_test.c
index c142448f1a6f..34c33a9b3a68 100644
--- a/src/tests/event_test.c
+++ b/src/tests/event_test.c
@@ -1,6 +1,8 @@
/*
* event_test.c - unit tests for new_event subject/object cache behavior
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/failure_action_test.c b/src/tests/failure_action_test.c
index 1a3dae01c0a1..8d9e19e994c1 100644
--- a/src/tests/failure_action_test.c
+++ b/src/tests/failure_action_test.c
@@ -1,6 +1,8 @@
/*
* failure_action_test.c - verify internal failure action accounting
*/
+#include "config.h"
+
#include <error.h>
#include <stdio.h>
#include <string.h>
diff --git a/src/tests/fd_fgets_test.c b/src/tests/fd_fgets_test.c
index 9167ae5d87ad..544fa28af7e1 100644
--- a/src/tests/fd_fgets_test.c
+++ b/src/tests/fd_fgets_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
diff --git a/src/tests/file_filter_test.c b/src/tests/file_filter_test.c
index e6851ce8973b..824a6360ad3f 100644
--- a/src/tests/file_filter_test.c
+++ b/src/tests/file_filter_test.c
@@ -2,6 +2,8 @@
* file_filter_test.c - ensure filter_prune_list handles basic lists
*/
+#include "config.h"
+
#include "filter.h"
#include "llist.h"
diff --git a/src/tests/filter_test.c b/src/tests/filter_test.c
index 1e041cc80a50..39dd2d6f241c 100644
--- a/src/tests/filter_test.c
+++ b/src/tests/filter_test.c
@@ -1,6 +1,8 @@
/*
* filter_test.c - comprehensive tests for filter configuration
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/gid_proc_test.c b/src/tests/gid_proc_test.c
index be2a6b2e2738..8303f25e7d10 100644
--- a/src/tests/gid_proc_test.c
+++ b/src/tests/gid_proc_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
diff --git a/src/tests/ignore_mounts_risk_test.c b/src/tests/ignore_mounts_risk_test.c
index 6e64e7a24641..46d316a1524d 100644
--- a/src/tests/ignore_mounts_risk_test.c
+++ b/src/tests/ignore_mounts_risk_test.c
@@ -4,6 +4,8 @@
#define _GNU_SOURCE
+#include "config.h"
+
#include <error.h>
#include <stdbool.h>
#include <stdio.h>
diff --git a/src/tests/lru_test.c b/src/tests/lru_test.c
index ebeb4feea97a..717d0ca1a701 100644
--- a/src/tests/lru_test.c
+++ b/src/tests/lru_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <error.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/policy_concurrent_test.c b/src/tests/policy_concurrent_test.c
index 87c13a7e3f8e..fd53e8ae3b02 100644
--- a/src/tests/policy_concurrent_test.c
+++ b/src/tests/policy_concurrent_test.c
@@ -6,6 +6,8 @@
* decisions today, but read-side rule iteration must not depend on the
* mutable llist cursor before worker threads can be introduced.
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/policy_reload_test.c b/src/tests/policy_reload_test.c
index 2a6d7e964282..a3838e25ccb8 100644
--- a/src/tests/policy_reload_test.c
+++ b/src/tests/policy_reload_test.c
@@ -5,6 +5,8 @@
* syslog parsing and during syslog parsing. In both cases, the previously
* published policy and its syslog field list must remain active.
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/queue_test.c b/src/tests/queue_test.c
index cbfea60bc82f..82fc416e0ef9 100644
--- a/src/tests/queue_test.c
+++ b/src/tests/queue_test.c
@@ -1,6 +1,8 @@
/*
* queue_test.c - verify queue metric accounting
*/
+#include "config.h"
+
#include <errno.h>
#include <error.h>
#include <stdio.h>
diff --git a/src/tests/test-stubs.c b/src/tests/test-stubs.c
index b4da08d11ffe..42ec44af0b3b 100644
--- a/src/tests/test-stubs.c
+++ b/src/tests/test-stubs.c
@@ -6,6 +6,8 @@
* or CLI entry points.
*/
+#include "config.h"
+
#include <stdatomic.h>
#include "conf.h"
diff --git a/src/tests/trustdb_format_test.c b/src/tests/trustdb_format_test.c
index 617e109e5965..3e29085474dc 100644
--- a/src/tests/trustdb_format_test.c
+++ b/src/tests/trustdb_format_test.c
@@ -1,6 +1,8 @@
// Copyright 2024 Red Hat
// SPDX-License-Identifier: GPL-2.0-or-later
+#include "config.h"
+
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
diff --git a/src/tests/trustdb_lmdb_test.c b/src/tests/trustdb_lmdb_test.c
index a0cc92b16134..5e54589cc6d1 100644
--- a/src/tests/trustdb_lmdb_test.c
+++ b/src/tests/trustdb_lmdb_test.c
@@ -2,6 +2,9 @@
// SPDX-License-Identifier: GPL-2.0-or-later
#define _GNU_SOURCE
+
+#include "config.h"
+
#include <stdatomic.h>
#include <errno.h>
#include <fcntl.h>
@@ -638,8 +641,9 @@ static int test_data_format_round_trip(void)
* test_lmdb_large_size_import - verify the stored size is not tied to size_t.
*
* A 32-bit build with large-file support has a 64-bit off_t but a 32-bit
- * size_t. Import must retain the 4 GiB value on that ABI. A genuinely
- * narrow off_t cannot compare such a record, so the parser must reject it.
+ * size_t. Import must retain the 4 GiB value on that ABI. The bulk importer
+ * stores the ABI-independent wire record without parsing its size, so a
+ * genuinely narrow off_t must reject it during an integrity lookup.
*
* Returns 0 on success or a test-specific error code.
*/
@@ -648,8 +652,10 @@ static int test_lmdb_large_size_import(void)
conf_t cfg;
char dir[128];
char payload[256];
+ struct file_info info = { 0 };
long entries = 0;
int rc;
+ const trustdb_size_t large_size = UINT64_C(4294967296);
const char *path = "/usr/bin/large-size";
const char *digest =
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff";
@@ -657,19 +663,27 @@ static int test_lmdb_large_size_import(void)
rc = with_temp_db(dir, sizeof(dir), &cfg);
CHECK(rc == 0, 13, "[ERROR:13] failed to open large-size LMDB");
+ cfg.integrity = IN_SIZE;
+ rc = decision_config_publish(&cfg);
+ CHECK(rc == 0, 14,
+ "[ERROR:14] failed to publish size integrity config");
+
snprintf(payload, sizeof(payload), "%s " DATA_FORMAT "\n", path,
- SRC_FILE_DB, UINT64_C(4294967296), digest);
+ SRC_FILE_DB, large_size, digest);
rc = import_records(payload, &entries);
+ CHECK(rc == 0 && entries == 1, 15,
+ "[ERROR:15] large-size record import failed");
+
if (sizeof(off_t) >= sizeof(trustdb_size_t)) {
- CHECK(rc == 0 && entries == 1, 14,
- "[ERROR:14] large-size record import failed");
- CHECK(check_trust_database(path, NULL, -1) == 1, 15,
- "[ERROR:15] large-size record lookup failed");
+ info.size = (off_t)large_size;
+ CHECK(check_trust_database(path, &info, -1) == 1, 16,
+ "[ERROR:16] large-size record lookup failed");
} else {
- CHECK(rc != 0, 16,
- "[ERROR:16] narrow off_t accepted large-size record");
+ CHECK(check_trust_database(path, &info, -1) == -1, 16,
+ "[ERROR:16] narrow off_t parsed large-size record");
}
+ decision_config_destroy();
database_close_for_tests();
database_set_location(NULL, NULL);
CHECK(remove_lmdb_files(dir) == 0, 17,
diff --git a/src/tests/uid_proc_test.c b/src/tests/uid_proc_test.c
index 13ad11139af9..7655f42090d7 100644
--- a/src/tests/uid_proc_test.c
+++ b/src/tests/uid_proc_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
--
2.55.0

61
SOURCES/0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch
View File

@ -1,61 +0,0 @@
From a2ea4efcae9ff6c7af47058d8b61aa88f269cf66 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Mon, 19 Jan 2026 16:27:54 -0500
Subject: [PATCH] If less than 16 chars were read, allow shebang test (corner
case)
Content-type: text/plain
---
src/library/file.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/src/library/file.c b/src/library/file.c
index 30571890071b..6491733c0042 100644
--- a/src/library/file.c
+++ b/src/library/file.c
@@ -1253,12 +1253,9 @@ int get_ima_hash(int fd, file_hash_alg_t *alg, char *sha)
static unsigned char e_ident[EI_NIDENT];
-static int read_preliminary_header(int fd)
+static inline ssize_t read_preliminary_header(int fd)
{
- ssize_t rc = safe_read(fd, (char *)e_ident, EI_NIDENT);
- if (rc == EI_NIDENT)
- return 0;
- return 1;
+ return safe_read(fd, (char *)e_ident, EI_NIDENT);
}
@@ -1356,8 +1353,10 @@ static int looks_like_text_script(int fd)
uint32_t gather_elf(int fd, off_t size)
{
uint32_t info = 0;
+ ssize_t rc;
- if (read_preliminary_header(fd))
+ rc = read_preliminary_header(fd);
+ if (rc < 2)
goto rewind_out;
/* Detect scripts via shebang before ELF check */
@@ -1366,6 +1365,10 @@ uint32_t gather_elf(int fd, off_t size)
goto rewind_out;
}
+ /* Make sure we have the full preliminary header */
+ if (rc < EI_NIDENT)
+ goto rewind_out;
+
/* Check ELF magic */
if (strncmp((char *)e_ident, ELFMAG, 4)) {
// Not ELF - see if it might be text script
@@ -1688,4 +1691,3 @@ rewind_out:
rewind_fd(fd);
return info;
}
-
--
2.52.0

39
SOURCES/0003-Fix-binary-path-of-rpm-loader.patch
View File

@ -1,39 +0,0 @@
From ee5ab7e537a922855e5e5f5905071adb1fc2eb25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Wed, 3 Dec 2025 16:36:54 +0100
Subject: [PATCH] Fix binary path of rpm-loader
Content-type: text/plain
---
src/Makefile.am | 1 +
src/library/rpm-backend.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index cab58ee130bd..8a356805b5ab 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -84,6 +84,7 @@ bin_PROGRAMS = fapolicyd-rpm-loader
fapolicyd_rpm_loader_SOURCES = \
handler/fapolicyd-rpm-loader.c
+fapolicyd_CFLAGS += -DBINARYDIR='"$(bindir)"'
fapolicyd_rpm_loader_CFLAGS = $(fapolicyd_CFLAGS)
fapolicyd_rpm_loader_LDFLAGS = $(fapolicyd_LDFLAGS)
fapolicyd_rpm_loader_LDADD = libfapolicyd.la
diff --git a/src/library/rpm-backend.c b/src/library/rpm-backend.c
index fab8e5345d40..5b24c9589040 100644
--- a/src/library/rpm-backend.c
+++ b/src/library/rpm-backend.c
@@ -238,7 +238,7 @@ static int rpm_load_list(const conf_t *conf)
char *custom_env[] = { "FAPO_SOCK_FD=3", NULL };
pid_t pid = -1;
- int status = posix_spawn(&pid, "/usr/bin/fapolicyd-rpm-loader",
+ int status = posix_spawn(&pid, BINARYDIR "/fapolicyd-rpm-loader",
&actions, NULL, argv, custom_env);
close(sv[1]); // Parent doesn't write
--
2.52.0

48
SOURCES/0004-Map-file-with-MAP_SHARED-instead-of-MAP_PRIVATE.patch
View File

@ -1,48 +0,0 @@
From d6956ef82051a9c805b02431e6c0083754549edd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Wed, 21 Jan 2026 11:30:58 +0100
Subject: [PATCH] Map file with MAP_SHARED instead of MAP_PRIVATE
Content-type: text/plain
When setting up a user probe using ebpf or systemtap on a file,
fapolicyd computes a different checksum, causing (usually) denial to
occur.
eBPF is used by Microsoft's MDATP, in particular for monitoring
/usr/lib64/libpam.so.0 function calls. Through setting a user probe,
mdatp and fapolicyd cannot be used concurrently.
The reason for computing a different checksum is using mmap(MAP_PRIVATE)
which makes the hooks set by ebpf and/or systemtap be visible:
~~~
1140 char *get_hash_from_fd2(int fd, size_t size, file_hash_alg_t alg)
1141 {
:
1165 mapped = mmap(0, size, PROT_READ, MAP_PRIVATE|MAP_POPULATE, fd, 0);
1166 if (mapped != MAP_FAILED) {
:
~~~
A solution consists in using MAP_SHARED instead of MAP_PRIVATE.
Fixes RHEL-142628.
---
src/library/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/library/file.c b/src/library/file.c
index 6491733c0042..802a89cc028a 100644
--- a/src/library/file.c
+++ b/src/library/file.c
@@ -1162,7 +1162,7 @@ char *get_hash_from_fd2(int fd, size_t size, file_hash_alg_t alg)
if (digest_length == 0)
return NULL;
- mapped = mmap(0, size, PROT_READ, MAP_PRIVATE|MAP_POPULATE, fd, 0);
+ mapped = mmap(0, size, PROT_READ, MAP_SHARED|MAP_POPULATE, fd, 0);
if (mapped != MAP_FAILED) {
unsigned char hptr[SHA512_DIGEST_LENGTH];
int computed = 0;
--
2.52.0

72
SOURCES/0005-Fix-segfault-when-interrupting-fapolicyd-startup.patch
View File

@ -1,72 +0,0 @@
From 67620805316e85b4edf6133a106181a4b4c8afac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
Date: Thu, 22 Jan 2026 10:55:45 +0100
Subject: [PATCH] Fix segfault when interrupting fapolicyd startup
Content-type: text/plain
In non-daemon mode, hitting Ctrl-C while fapolicyd initializes leads to
getting 2 segfaults:
- first one in term_handler() because 'q' is not initialized yet
- then one in coredump_handler() because 'm' is not initialized yet
Reproducer:
~~~
# fapolicyd --debug
[...]
01/22/26 10:48:37 [ INFO ]: Loading rpmdb backend
^CSegmentation fault (core dumped)
~~~
GDB shows:
~~~
(gdb) bt
#0 mlist_first (m=m@entry=0x0) at daemon/mounts.c:86 <<<<< SECOND SEGFAULT
#1 0x00005627e02de9ec in unmark_fanotify (m=0x0) at daemon/notify.c:258
#2 0x00005627e02dda13 in coredump_handler (sig=11) at daemon/fapolicyd.c:336
#3 coredump_handler (sig=11) at daemon/fapolicyd.c:333
#4 <signal handler called>
#5 __new_sem_post (sem=0x20) at sem_post.c:36 <<<<< FIRST SEGFAULT
#6 <signal handler called>
#7 __recvmsg_syscall (flags=0, msg=0x7ffe93e00350, fd=6) at ../sysdeps/unix/sysv/linux/recvmsg.c:27
#8 __libc_recvmsg (fd=6, msg=msg@entry=0x7ffe93e00350, flags=flags@entry=0)
at ../sysdeps/unix/sysv/linux/recvmsg.c:41
#9 0x00005627e02eef82 in rpm_load_list (conf=<optimized out>) at library/rpm-backend.c:260
#10 0x00005627e02ecc02 in backend_load (conf=conf@entry=0x5627e02fa0e0 <config>) at library/backend-manager.c:152
#11 0x00005627e02e21c0 in init_database (config=config@entry=0x5627e02fa0e0 <config>) at library/database.c:1440
#12 0x00005627e02db599 in main (argc=<optimized out>, argv=<optimized out>) at daemon/fapolicyd.c:1053
~~~
---
src/daemon/notify.c | 3 +++
src/library/queue.c | 3 ++-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/daemon/notify.c b/src/daemon/notify.c
index 8e1e778cb8c8..db6fb72e01ac 100644
--- a/src/daemon/notify.c
+++ b/src/daemon/notify.c
@@ -255,6 +255,9 @@ void fanotify_update(mlist *m)
void unmark_fanotify(mlist *m)
{
+ if (m == NULL)
+ return;
+
const char *path = mlist_first(m);
// Stop the flow of events
diff --git a/src/library/queue.c b/src/library/queue.c
index c82026439923..6236d0096c80 100644
--- a/src/library/queue.c
+++ b/src/library/queue.c
@@ -236,6 +236,7 @@ int q_timed_dequeue(struct queue *q, struct fanotify_event_metadata *data,
void q_shutdown(struct queue *q)
{
+ if (q == NULL)
+ return;
sem_post(&q->sem);
}
-
--
2.52.0

30
SOURCES/0006-Potential-memory-leak-on-early-return-in-file_append.patch
View File

@ -1,30 +0,0 @@
From 49d824ef1fdeca5ea5bb28ea6e68a24d21a96756 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Wed, 28 Jan 2026 21:29:17 -0500
Subject: [PATCH] Potential memory leak on early-return in file_append
Content-type: text/plain
If add_list_load_path(path) returns failure after adding items to add_list, the function returns without calling list_empty, which can leak any accumulated entries. Call list_empty before returning an error.
---
src/cli/file-cli.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c
index 7e02e939fdb0..b07d42ee070c 100644
--- a/src/cli/file-cli.c
+++ b/src/cli/file-cli.c
@@ -130,8 +130,10 @@ int file_append(const char *path, const char *fname, bool use_filter)
list_init(&add_list);
rc = add_list_load_path(path);
- if (rc)
+ if (rc) {
+ list_empty(&add_list); // could be partially populated by nftw
return rc;
+ }
if (use_filter && filter_prune_list(&add_list, NULL)) {
list_empty(&add_list);
--
2.53.0

26
SOURCES/0007-whitespace-fix.patch
View File

@ -1,26 +0,0 @@
From b91b460b943185a1585cbbfe331eac38527b64cb Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Wed, 28 Jan 2026 22:07:10 -0500
Subject: [PATCH] whitespace fix
Content-type: text/plain
---
src/library/rpm-backend.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/library/rpm-backend.c b/src/library/rpm-backend.c
index 5b24c9589040..c4a90cd1c9f1 100644
--- a/src/library/rpm-backend.c
+++ b/src/library/rpm-backend.c
@@ -443,7 +443,7 @@ out:
// cleaning up
struct _hash_record *item, *tmp;
HASH_ITER( hh, hashtable, item, tmp) {
- HASH_DEL( hashtable, item );
+ HASH_DEL( hashtable, item );
free((void*)item->key);
free((void*)item);
}
--
2.53.0

42
SOURCES/0008-Fix-32-bit-ELF-dynamic-section-parsing.patch
View File

@ -1,42 +0,0 @@
From f87d54e6eede34a6ef4b77df56ec1df9e313822d Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <lautrbach@redhat.com>
Date: Fri, 6 Feb 2026 14:31:52 +0100
Subject: [PATCH] Fix 32-bit ELF dynamic section parsing
Content-type: text/plain
Use Elf32_Dyn instead of Elf64_Dyn when parsing PT_DYNAMIC segments in
32-bit ELF files. The incorrect type could cause a segfault on special
32 bit libraries.
Fixes: https://issues.redhat.com/browse/RHEL-1357
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
---
src/library/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/library/file.c b/src/library/file.c
index 802a89cc028a..2dffaaceea1e 100644
--- a/src/library/file.c
+++ b/src/library/file.c
@@ -1485,7 +1485,7 @@ uint32_t gather_elf(int fd, off_t size)
if (ph_tbl[i].p_filesz > size)
goto err_out32;
- Elf64_Dyn *dyn_tbl = malloc(ph_tbl[i].p_filesz);
+ Elf32_Dyn *dyn_tbl = malloc(ph_tbl[i].p_filesz);
if((unsigned int)lseek(fd, ph_tbl[i].p_offset,
SEEK_SET) !=
@@ -1494,7 +1494,7 @@ uint32_t gather_elf(int fd, off_t size)
goto err_out32;
}
- num = ph_tbl[i].p_filesz / sizeof(Elf64_Dyn);
+ num = ph_tbl[i].p_filesz / sizeof(Elf32_Dyn);
if (num > 1000) {
free(dyn_tbl);
goto err_out32;
--
2.53.0

16
SOURCES/fapolicyd-1.4.3.tar.gz.asc
View File

@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmlkvqUACgkQzcroySfG
vjFJRg//STH9OAKct2RoxkIhLFyiF3ua0mgCLb+xYxsPY+/ix0xhenPD1eVsi3x1
wt+bsustW/gpRKYg+bgKxx4TEatwBTd6S5lJB9m56KnlPks8v/yljPFqWK7Nbnvc
ZSatcXbF0XOe+3mlyHf2IW6wXiKfPYCmbFQbADpNR6oYKM/p6Sn6ph3bP6yCKq3J
IwdabBF+iKsh1a/kOlBbpY49JmXsb+02nWFPnDMlO3k9SEVPpNGGQWnJv98KMHN/
Pf61sVw413jE22T+smy1NdxauMwr2AZ9lK1512HNC++rQ7RO3ChchF8lH0aewNcB
8R5ve1ojJQPEeaePrfrIDoyJbEfjoQPcsFGRQjrNeAj1Qq3mAkk+q2VUz+qWNRjQ
XXp0ut3P5RVgVJN2ysqKlpNG9LfkpZ7JgAK5eDkFVYGlZERVj8zu7yxi0zk9M0FY
arXHHxqCCnvUS4Ysj1IUFSoPZGeHO5AqDYpv4cGNEk1MAZlDJeimvreRVGFIZ4lL
GO1zbXvXP9zFgJJH4puZzq0JmfiH19vnhjXVbjzkQnDQ5boFp2XxQKHS4ljEQAkD
AUGibmycRpnpJm8jBgRjq/icJwghbyqcvxQYCsBSRNoDywgvW7xCdrGJr0hfJW6i
535CMh7NnEY5H/27jl24aPgRV5VM3UUp533urRIk/Y85PzprWnY=
=Cf+E
-----END PGP SIGNATURE-----

16
SOURCES/fapolicyd-2.0.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmph0mIACgkQzcroySfG
vjHHMw//Xise+51Pfmvrjn1bjBOKuwqb+lZFaKhCnnZvbjh61iL7hm3vshAFDEc6
QM+28yJBRDScsNHLpJMGV4gy0THgdFW6yFa1BlM4HRf0fyEKe99zNT3z3Bnsk099
MuPKDlR6lv34kJ3naUQSVJ1wRE133JlWdGOMqUCeUZEpqPJv1m3F+HNRQtQ2CHHe
2EDJbvN40Si50ohsWnaXRN4OWGHJNGSemdtwNo5Ju2p7A7Ks99kVdI/SkqmJHGvd
Yq0j7s3aG6rebGuG5Vq7DHXIK+mKBUsoFHpJtCwei5UnVlhVk3VSNWBalHBboO8B
BdGZtjLFeM5q1C5stQ2JtxqAAJucqvxXgRhQWpIoPoLePhBZx3Yln+IFQECCBU3b
s4Tjoa4OGKZhXrqqdon0SKdDFgVM8zuOI78fTu2HCgjzT9M7+6t1Ol9IdhjIoNET
/fH7lObo3UeSD21D4q/YSof4SKl5FTLB61Q3B9VQpd5KGYSuUXSpfIdPEEk2iQA1
d62fxtX/Pxkh5/XJ7zWr3KEOpQ0maKU07EGYvGjGEEjDnfujph4csaSvYX3PYvdg
cDqe7DF74M9ViRF1oQap2MkM8IzW3Ji17ITL/orcCzswz2dqAKpYOoaojS1va73h
1p+ZZdUlh/CzEi/v9p5Njczne1PpG786x3sJln97VMe520BwZuk=
=rdS0
-----END PGP SIGNATURE-----

16
SOURCES/fapolicyd-selinux-1.1.tar.gz.asc
View File

@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmlmAo4ACgkQzcroySfG
vjGK4w//eaZET4l52F5pZWq6R59X1pC4/9vqD82hFTwum96fznDjJsqApOUzJcvX
b1u+EkkFkvGsvNZVzCTnaCnJmh2EceerlOy9KwwtLFXCMQWe3ZX4fQLiUt70CGfE
dsbr58+pd5BoaZcXwTuHoh66q2RPqxI7sA9zeVYuAUsqa63mM3YGNfkUp57klT1Z
Mbvw9TIoO/oXuahHtEucWCmQDtNKGz3QBrBOxSeL3eGGduFKDnya4GWh7c/QYpJO
/2Sbzx04JD7jJJ2DuqySy2JV+MNitwjvbjc3ffDBNpvuqqzEjkMRbSSRZyWJcgAa
GWF4zx0DOMltOrWJ05qxcXwqRqoVWNXRe1wH32c7wp/l/zstQ6v1+R2HsNXyLMR9
kbvAPpTXjRtKGmUY9Gq1vibpC943U2PjQlENS/yCJlSK5dKx7KPwmHn5rEwoSsJr
DUzik3+NIraiqF3os4c5D/Fc8Of8/U4X/G3P+sfQma8BAYSu+D09rdEFX+XOea5f
0XKoFF7uDZ6iBmPw7f/JoSDOJk25bDf+QGbQsk/h/ao5AUVy0BXsy6+Uof2+7Qr0
bDY8nE8hmgo5A9ssdnnXTg71i4g1+/berFpGv3soW9FTeBsLmhJeNo+lzSUj9KUE
uKoiDaaZSNMJfvCJpJqjz0hNjIfnbXAnVNs/QgXvBbjnRatKqcI=
=HP8O
-----END PGP SIGNATURE-----

16
SOURCES/fapolicyd-selinux-1.2.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmoOBKkACgkQzcroySfG
vjHHtQ/+I8PXC7lwVmP1ABQrkTJdf0qacRr7G1tE6dyxnBT7VQGLp7s+s2KzbvVe
xodMCMtQ1omCM2UxpMl1XJ/V6vpF5t2yGu8y9rQhhxA1kqoSpVNuKevpRSQe2VW9
j6FUbLWwchTeKm/9yFOfP0x40uRtZg5Hb/qRP5bdNJQ4WtyRrM7tthkS2/hy1XTP
hDRl08tIGaGru097tdbiNFxnkvSwucKghJWUHhknmceh3PMq0s4Ur8YhK2TzZTwc
imb+CtjOnOf6a1fbK0xynIQS0p8F1muoksOJ0yJYYI9O34lqQ/1THBYbrDh0drmw
060VE3FhyiuHIkuejblK/eo2iYeA9ia5sJ1oP9KzfZaoMJKk2XPk32zAAW0zmv6j
TBh89wBDuX8KH/t8rUYeE1kJwoG/8iOpKIDqtStHgF2ft4tx+nrxXJPzQVeBwe4g
3ppZdeGo7B5Ubyw19LRqA4AL/37N+fq6X5G8Wkvv9Q7FWR4AioIJffvJbFI5+WSC
t9xPsfnfcZY3OcsJ3dNj876ZnQC+Ab/p13Fo3otfk+NHKxNcEao+XJD5n6H5WqIM
hh9vshX+RmRelwcKZLrjc2BPigRACwU68XcQLndWsdmkOGQgWp/gng0iqNZtOXze
WgeSRTS4Myz+Xg4mbv0LP32o6hzIcPrL+W2qPYlihzJYqRdfKx8=
=dVpm
-----END PGP SIGNATURE-----

56
SPECS/fapolicyd.spec
View File

@ -1,11 +1,11 @@
%global selinuxtype targeted
%global moduletype distributed
%define semodule_version 1.1
%define semodule_version 1.2
Summary: Application Whitelisting Daemon
Name: fapolicyd
Version: 1.4.3
Release: 3%{?dist}
Version: 2.0
Release: 1%{?dist}
License: GPL-3.0-or-later
URL: https://github.com/linux-application-whitelisting/fapolicyd
Source0: https://github.com/linux-application-whitelisting/fapolicyd/releases/download/v%{version}/fapolicyd-%{version}.tar.gz
@ -18,18 +18,13 @@ Source11: https://github.com/linux-application-whitelisting/%{name}-selinux/rele
Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#/uthash-2.3.0.tar.gz
# https://github.com/linux-application-whitelisting/fapolicyd
# $ git format-patch -N v1.4.3
# $ git format-patch -N v2.0
# https://github.com/linux-application-whitelisting/fapolicyd-selinux
# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.1/ --dst-prefix=b/fapolicyd-selinux-1.1/ v1.1
# $ for j in [0-9]*.patch; do printf "Patch: %s\n" $j; done
# Patch list start
Patch: 0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch
Patch: 0003-Fix-binary-path-of-rpm-loader.patch
Patch: 0004-Map-file-with-MAP_SHARED-instead-of-MAP_PRIVATE.patch
Patch: 0005-Fix-segfault-when-interrupting-fapolicyd-startup.patch
Patch: 0006-Potential-memory-leak-on-early-return-in-file_append.patch
Patch: 0007-whitespace-fix.patch
Patch: 0008-Fix-32-bit-ELF-dynamic-section-parsing.patch
Patch: 0002-Fix-large-file-support-on-32-bit-builds.patch
# Patch: 0003-update-changelog.patch
# Patch list end
BuildRequires: gcc
@ -49,6 +44,7 @@ BuildRequires: uthash-devel
%endif
Requires: rpm-plugin-fapolicyd
Requires: lmdb-libs > 0.9.29
Recommends: %{name}-selinux
Requires(pre): shadow-utils
Requires(post): systemd-units
@ -124,7 +120,7 @@ make
popd
%check
make check
make check VERBOSE=yes
# selinux
%pre selinux
@ -253,16 +249,18 @@ fi
%attr(644,root,root) %{_unitdir}/%{name}.service
%attr(644,root,root) %{_tmpfilesdir}/%{name}.conf
%attr(644,root,root) %{_sysusersdir}/%{name}.conf
%attr(755,root,root) %{_bindir}/%{name}-rpm-loader
%attr(755,root,root) %{_sbindir}/%{name}
%attr(755,root,root) %{_sbindir}/%{name}-cli
%attr(755,root,root) %{_sbindir}/fagenrules
%attr(755,root,root) %{_libexecdir}/%{name}-rpm-loader
%attr(644,root,root) %{_mandir}/man8/*
%attr(644,root,root) %{_mandir}/man5/*
%ghost %attr(440,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/log/%{name}-access.log
%attr(770,root,%{name}) %dir %{_localstatedir}/lib/%{name}
%attr(770,root,%{name}) %dir /run/%{name}
%ghost %attr(660,root,%{name}) /run/%{name}/%{name}.fifo
%ghost %attr(770,root,%{name}) %dir %{_rundir}/%{name}
%ghost %attr(660,root,%{name}) %{_rundir}/%{name}/%{name}.fifo
%ghost %attr(600,root,root) %verify(not md5 size mtime) %{_rundir}/%{name}/%{name}.pid
%ghost %attr(640,%{name},%{name}) %verify(not md5 size mtime) %{_rundir}/%{name}/%{name}.state
%ghost %attr(660,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/lib/%{name}/data.mdb
%ghost %attr(660,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/lib/%{name}/lock.mdb
@ -284,6 +282,34 @@ fi
%selinux_relabel_post -s %{selinuxtype}
%changelog
* Thu Jul 23 2026 Petr Lautrbach <lautrbach@redhat.com> - 2.0-1
- fapolicyd-2.0
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v2.0
* Wed Jul 08 2026 Vit Mojzis <vmojzis@redhat.com> - 1.6-2
- Add dependency on the latest version of lmdb-libs
* Thu Jun 11 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.6-1
- fapolicyd-1.6
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.6
* Wed May 20 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.5-1
- fapolicyd-1.5
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.5
* Wed Apr 22 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.4.5-2
- fagenrules: Validate new compiled rules
- Add fapolicyd-cli --check-rules option
- Bump maximum length of a configuration file line
* Mon Mar 30 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.4.5-1.1
- fapolicyd-1.4.5
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.5
* Thu Mar 19 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.4.4-1
- fapolicyd-1.4.4
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.4
* Fri Feb 06 2026 Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-3
- Fix 32-bit ELF dynamic section parsing