rpms/fapolicyd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fapolicyd-2.0

Browse Source 
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v2.0

Resolves: RHEL-212483
Resolves: RHEL-216963
Resolves: RHEL-214042
Resolves: RHEL-186511
Resolves: RHEL-216964
Resolves: RHEL-216973
This commit is contained in:
Petr Lautrbach 2026-07-23 11:56:13 +02:00
parent 1bb9ec884a
commit 3069b7b09b
5 changed files with 532 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -49,3 +49,5 @@
/fapolicyd-selinux-1.2.tar.gz.asc
/fapolicyd-1.6.tar.gz
/fapolicyd-1.6.tar.gz.asc
/fapolicyd-2.0.tar.gz
/fapolicyd-2.0.tar.gz.asc

495
0002-Fix-large-file-support-on-32-bit-builds.patch Normal file
View File

@ -0,0 +1,495 @@
From 3e851ff5518cd0e4d7e95654b45159056e7f13f4 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Thu, 23 Jul 2026 11:24:22 -0400
Subject: [PATCH] Fix large-file support on 32-bit builds
Content-type: text/plain
The build did not request a large-file ABI, and several translation units did not include the generated config header before system headers. On i686 this left off_t at 32 bits and exposed an incorrect trustdb_lmdb_test assumption that bulk import parses record sizes.
Enable AC_SYS_LARGEFILE and consistently include config.h first so configure-selected feature macros apply to every C translation unit. Update the LMDB regression to import the ABI-independent record first, then verify that size-integrity lookup accepts the 4 GiB value with wide off_t and rejects it with narrow off_t.
The database wire representation is unchanged, so existing LMDB files do not require migration and 64-bit builds retain their existing large-file ABI.
---
configure.ac | 1 +
src/library/attr-sets.c | 2 ++
src/library/avl.c | 3 ++-
src/library/deb-backend.c | 2 ++
src/library/llist.c | 2 ++
src/library/stack.c | 2 ++
src/library/string-util.c | 2 ++
src/perf-test/fapolicyd-perf-test.c | 4 ++--
src/tests/attr_sets_test.c | 2 ++
src/tests/avl_test.c | 3 ++-
src/tests/cli_privilege_test.c | 2 ++
src/tests/decision_defer_test.c | 2 ++
src/tests/decision_timing_report_test.c | 2 ++
src/tests/elf_file_test.c | 3 +++
src/tests/escape_test.c | 3 ++-
src/tests/event_test.c | 2 ++
src/tests/failure_action_test.c | 2 ++
src/tests/fd_fgets_test.c | 2 ++
src/tests/file_filter_test.c | 2 ++
src/tests/filter_test.c | 2 ++
src/tests/gid_proc_test.c | 2 ++
src/tests/ignore_mounts_risk_test.c | 2 ++
src/tests/lru_test.c | 2 ++
src/tests/policy_concurrent_test.c | 2 ++
src/tests/policy_reload_test.c | 2 ++
src/tests/queue_test.c | 2 ++
src/tests/test-stubs.c | 2 ++
src/tests/trustdb_format_test.c | 2 ++
src/tests/trustdb_lmdb_test.c | 32 ++++++++++++++++++-------
src/tests/uid_proc_test.c | 2 ++
30 files changed, 81 insertions(+), 14 deletions(-)
diff --git a/configure.ac b/configure.ac
index b2e9f0e6ef65..5e5395e88ee0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5,6 +5,7 @@ AC_CONFIG_HEADERS([config.h])
AC_CONFIG_MACRO_DIR([m4])
AC_USE_SYSTEM_EXTENSIONS
+AC_SYS_LARGEFILE
AC_CANONICAL_TARGET
AM_INIT_AUTOMAKE(foreign subdir-objects)
diff --git a/src/library/attr-sets.c b/src/library/attr-sets.c
index b71e602b647c..80e238357c83 100644
--- a/src/library/attr-sets.c
+++ b/src/library/attr-sets.c
@@ -43,6 +43,8 @@
* released directly by attr_set_destroy().
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/library/avl.c b/src/library/avl.c
index 72807df63ac7..f2f69ef6bd69 100644
--- a/src/library/avl.c
+++ b/src/library/avl.c
@@ -7,7 +7,8 @@
* Public License (LGPL). See the provenance note below.
*/
-//#include "config.h"
+#include "config.h"
+
#include <stddef.h> // for NULL
#include "avl.h"
diff --git a/src/library/deb-backend.c b/src/library/deb-backend.c
index 40e17f4349fd..b83fd3ffe490 100644
--- a/src/library/deb-backend.c
+++ b/src/library/deb-backend.c
@@ -19,6 +19,8 @@
* Boston, MA 02110-1335, USA.
*/
+#include "config.h"
+
#include <dpkg/db-ctrl.h>
#include <dpkg/db-fsys.h>
#include <dpkg/pkg-array.h>
diff --git a/src/library/llist.c b/src/library/llist.c
index 0eb1d99d55ab..2778d2e60b69 100644
--- a/src/library/llist.c
+++ b/src/library/llist.c
@@ -24,6 +24,8 @@
* Zoltan Fridrich <zfridric@redhat.com>
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/library/stack.c b/src/library/stack.c
index 1a270ed6235d..21f55978b39c 100644
--- a/src/library/stack.c
+++ b/src/library/stack.c
@@ -22,6 +22,8 @@
* Radovan Sroka <rsroka@redhat.com>
*/
+#include "config.h"
+
#include "stack.h"
#include <stddef.h>
diff --git a/src/library/string-util.c b/src/library/string-util.c
index 7429db0009bc..7052ee1bd75b 100644
--- a/src/library/string-util.c
+++ b/src/library/string-util.c
@@ -23,6 +23,8 @@
* Zoltan Fridrich <zfridric@redhat.com>
*/
+#include "config.h"
+
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
diff --git a/src/perf-test/fapolicyd-perf-test.c b/src/perf-test/fapolicyd-perf-test.c
index c846cbe085ee..2f2c861a0f67 100644
--- a/src/perf-test/fapolicyd-perf-test.c
+++ b/src/perf-test/fapolicyd-perf-test.c
@@ -23,6 +23,8 @@
* Ondrej Mosnacek <omosnace@redhat.com>
*/
+#include "config.h"
+
#include <stdlib.h>
#include <stdio.h>
#include <stdatomic.h>
@@ -31,8 +33,6 @@
#include <unistd.h>
#include <sys/time.h>
-#include "config.h"
-
#include "daemon-config.h"
#include "message.h"
#include "policy.h"
diff --git a/src/tests/attr_sets_test.c b/src/tests/attr_sets_test.c
index 42e048e7fbd6..6513bb1e9b64 100644
--- a/src/tests/attr_sets_test.c
+++ b/src/tests/attr_sets_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
diff --git a/src/tests/avl_test.c b/src/tests/avl_test.c
index b1de0c8d4c16..0aa0c659e759 100644
--- a/src/tests/avl_test.c
+++ b/src/tests/avl_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
@@ -271,4 +273,3 @@ int main(void)
return 0;
}
-
diff --git a/src/tests/cli_privilege_test.c b/src/tests/cli_privilege_test.c
index 7cf36c898667..f3fd77032ac7 100644
--- a/src/tests/cli_privilege_test.c
+++ b/src/tests/cli_privilege_test.c
@@ -2,6 +2,8 @@
* cli_privilege_test.c - verify fapolicyd-cli privilege policies
*/
+#include "config.h"
+
#include <error.h>
#include <stdbool.h>
#include <stdlib.h>
diff --git a/src/tests/decision_defer_test.c b/src/tests/decision_defer_test.c
index 228d46bbff83..42c819156630 100644
--- a/src/tests/decision_defer_test.c
+++ b/src/tests/decision_defer_test.c
@@ -1,6 +1,8 @@
/*
* decision_defer_test.c - unit tests for subject-slot decision deferral
*/
+#include "config.h"
+
#include <errno.h>
#include <pthread.h>
#include <stdio.h>
diff --git a/src/tests/decision_timing_report_test.c b/src/tests/decision_timing_report_test.c
index aebd9fe3323c..bc7d7ebe5479 100644
--- a/src/tests/decision_timing_report_test.c
+++ b/src/tests/decision_timing_report_test.c
@@ -1,6 +1,8 @@
/*
* decision_timing_report_test.c - timing report formatting tests
*/
+#include "config.h"
+
#include <error.h>
#include <stdarg.h>
#include <stdbool.h>
diff --git a/src/tests/elf_file_test.c b/src/tests/elf_file_test.c
index 11dd774191f2..423c5c640082 100644
--- a/src/tests/elf_file_test.c
+++ b/src/tests/elf_file_test.c
@@ -10,6 +10,9 @@
*/
#define _GNU_SOURCE
+
+#include "config.h"
+
#include <errno.h>
#include <error.h>
#include <fcntl.h>
diff --git a/src/tests/escape_test.c b/src/tests/escape_test.c
index f23762e4eb26..72ff2fd77046 100644
--- a/src/tests/escape_test.c
+++ b/src/tests/escape_test.c
@@ -2,8 +2,9 @@
* escape_test.c - tests for shell escaping helpers
*/
-#include "escape.h"
+#include "config.h"
+#include "escape.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/event_test.c b/src/tests/event_test.c
index c142448f1a6f..34c33a9b3a68 100644
--- a/src/tests/event_test.c
+++ b/src/tests/event_test.c
@@ -1,6 +1,8 @@
/*
* event_test.c - unit tests for new_event subject/object cache behavior
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/failure_action_test.c b/src/tests/failure_action_test.c
index 1a3dae01c0a1..8d9e19e994c1 100644
--- a/src/tests/failure_action_test.c
+++ b/src/tests/failure_action_test.c
@@ -1,6 +1,8 @@
/*
* failure_action_test.c - verify internal failure action accounting
*/
+#include "config.h"
+
#include <error.h>
#include <stdio.h>
#include <string.h>
diff --git a/src/tests/fd_fgets_test.c b/src/tests/fd_fgets_test.c
index 9167ae5d87ad..544fa28af7e1 100644
--- a/src/tests/fd_fgets_test.c
+++ b/src/tests/fd_fgets_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
diff --git a/src/tests/file_filter_test.c b/src/tests/file_filter_test.c
index e6851ce8973b..824a6360ad3f 100644
--- a/src/tests/file_filter_test.c
+++ b/src/tests/file_filter_test.c
@@ -2,6 +2,8 @@
* file_filter_test.c - ensure filter_prune_list handles basic lists
*/
+#include "config.h"
+
#include "filter.h"
#include "llist.h"
diff --git a/src/tests/filter_test.c b/src/tests/filter_test.c
index 1e041cc80a50..39dd2d6f241c 100644
--- a/src/tests/filter_test.c
+++ b/src/tests/filter_test.c
@@ -1,6 +1,8 @@
/*
* filter_test.c - comprehensive tests for filter configuration
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/gid_proc_test.c b/src/tests/gid_proc_test.c
index be2a6b2e2738..8303f25e7d10 100644
--- a/src/tests/gid_proc_test.c
+++ b/src/tests/gid_proc_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
diff --git a/src/tests/ignore_mounts_risk_test.c b/src/tests/ignore_mounts_risk_test.c
index 6e64e7a24641..46d316a1524d 100644
--- a/src/tests/ignore_mounts_risk_test.c
+++ b/src/tests/ignore_mounts_risk_test.c
@@ -4,6 +4,8 @@
#define _GNU_SOURCE
+#include "config.h"
+
#include <error.h>
#include <stdbool.h>
#include <stdio.h>
diff --git a/src/tests/lru_test.c b/src/tests/lru_test.c
index ebeb4feea97a..717d0ca1a701 100644
--- a/src/tests/lru_test.c
+++ b/src/tests/lru_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <error.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/policy_concurrent_test.c b/src/tests/policy_concurrent_test.c
index 87c13a7e3f8e..fd53e8ae3b02 100644
--- a/src/tests/policy_concurrent_test.c
+++ b/src/tests/policy_concurrent_test.c
@@ -6,6 +6,8 @@
* decisions today, but read-side rule iteration must not depend on the
* mutable llist cursor before worker threads can be introduced.
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/policy_reload_test.c b/src/tests/policy_reload_test.c
index 2a6d7e964282..a3838e25ccb8 100644
--- a/src/tests/policy_reload_test.c
+++ b/src/tests/policy_reload_test.c
@@ -5,6 +5,8 @@
* syslog parsing and during syslog parsing. In both cases, the previously
* published policy and its syslog field list must remain active.
*/
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
diff --git a/src/tests/queue_test.c b/src/tests/queue_test.c
index cbfea60bc82f..82fc416e0ef9 100644
--- a/src/tests/queue_test.c
+++ b/src/tests/queue_test.c
@@ -1,6 +1,8 @@
/*
* queue_test.c - verify queue metric accounting
*/
+#include "config.h"
+
#include <errno.h>
#include <error.h>
#include <stdio.h>
diff --git a/src/tests/test-stubs.c b/src/tests/test-stubs.c
index b4da08d11ffe..42ec44af0b3b 100644
--- a/src/tests/test-stubs.c
+++ b/src/tests/test-stubs.c
@@ -6,6 +6,8 @@
* or CLI entry points.
*/
+#include "config.h"
+
#include <stdatomic.h>
#include "conf.h"
diff --git a/src/tests/trustdb_format_test.c b/src/tests/trustdb_format_test.c
index 617e109e5965..3e29085474dc 100644
--- a/src/tests/trustdb_format_test.c
+++ b/src/tests/trustdb_format_test.c
@@ -1,6 +1,8 @@
// Copyright 2024 Red Hat
// SPDX-License-Identifier: GPL-2.0-or-later
+#include "config.h"
+
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
diff --git a/src/tests/trustdb_lmdb_test.c b/src/tests/trustdb_lmdb_test.c
index a0cc92b16134..5e54589cc6d1 100644
--- a/src/tests/trustdb_lmdb_test.c
+++ b/src/tests/trustdb_lmdb_test.c
@@ -2,6 +2,9 @@
// SPDX-License-Identifier: GPL-2.0-or-later
#define _GNU_SOURCE
+
+#include "config.h"
+
#include <stdatomic.h>
#include <errno.h>
#include <fcntl.h>
@@ -638,8 +641,9 @@ static int test_data_format_round_trip(void)
* test_lmdb_large_size_import - verify the stored size is not tied to size_t.
*
* A 32-bit build with large-file support has a 64-bit off_t but a 32-bit
- * size_t. Import must retain the 4 GiB value on that ABI. A genuinely
- * narrow off_t cannot compare such a record, so the parser must reject it.
+ * size_t. Import must retain the 4 GiB value on that ABI. The bulk importer
+ * stores the ABI-independent wire record without parsing its size, so a
+ * genuinely narrow off_t must reject it during an integrity lookup.
*
* Returns 0 on success or a test-specific error code.
*/
@@ -648,8 +652,10 @@ static int test_lmdb_large_size_import(void)
conf_t cfg;
char dir[128];
char payload[256];
+ struct file_info info = { 0 };
long entries = 0;
int rc;
+ const trustdb_size_t large_size = UINT64_C(4294967296);
const char *path = "/usr/bin/large-size";
const char *digest =
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff";
@@ -657,19 +663,27 @@ static int test_lmdb_large_size_import(void)
rc = with_temp_db(dir, sizeof(dir), &cfg);
CHECK(rc == 0, 13, "[ERROR:13] failed to open large-size LMDB");
+ cfg.integrity = IN_SIZE;
+ rc = decision_config_publish(&cfg);
+ CHECK(rc == 0, 14,
+ "[ERROR:14] failed to publish size integrity config");
+
snprintf(payload, sizeof(payload), "%s " DATA_FORMAT "\n", path,
- SRC_FILE_DB, UINT64_C(4294967296), digest);
+ SRC_FILE_DB, large_size, digest);
rc = import_records(payload, &entries);
+ CHECK(rc == 0 && entries == 1, 15,
+ "[ERROR:15] large-size record import failed");
+
if (sizeof(off_t) >= sizeof(trustdb_size_t)) {
- CHECK(rc == 0 && entries == 1, 14,
- "[ERROR:14] large-size record import failed");
- CHECK(check_trust_database(path, NULL, -1) == 1, 15,
- "[ERROR:15] large-size record lookup failed");
+ info.size = (off_t)large_size;
+ CHECK(check_trust_database(path, &info, -1) == 1, 16,
+ "[ERROR:16] large-size record lookup failed");
} else {
- CHECK(rc != 0, 16,
- "[ERROR:16] narrow off_t accepted large-size record");
+ CHECK(check_trust_database(path, &info, -1) == -1, 16,
+ "[ERROR:16] narrow off_t parsed large-size record");
}
+ decision_config_destroy();
database_close_for_tests();
database_set_location(NULL, NULL);
CHECK(remove_lmdb_files(dir) == 0, 17,
diff --git a/src/tests/uid_proc_test.c b/src/tests/uid_proc_test.c
index 13ad11139af9..7655f42090d7 100644
--- a/src/tests/uid_proc_test.c
+++ b/src/tests/uid_proc_test.c
@@ -1,3 +1,5 @@
+#include "config.h"
+
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
--
2.55.0

23
0003-update-changelog.patch Normal file
View File

@ -0,0 +1,23 @@
From ccf618b664230e0f5497345e6a4503e6f2c7bca9 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Thu, 23 Jul 2026 11:26:13 -0400
Subject: [PATCH] update changelog
Content-type: text/plain
---
ChangeLog | 1 +
1 file changed, 1 insertion(+)
diff --git a/ChangeLog b/ChangeLog
index d230c610c956..1c3ea75a1c4e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,5 @@
2.0.1
+- Enable large file support on 32-bit builds
2.0
- Add decision_threads configuration to fapolicyd.conf
--
2.55.0

14
fapolicyd.spec
View File

@ -4,8 +4,8 @@
Summary: Application Whitelisting Daemon
Name: fapolicyd
Version: 1.6
Release: 2%{?dist}
Version: 2.0
Release: 1%{?dist}
License: GPL-3.0-or-later
URL: https://github.com/linux-application-whitelisting/fapolicyd
Source0: https://github.com/linux-application-whitelisting/fapolicyd/releases/download/v%{version}/fapolicyd-%{version}.tar.gz
@ -18,11 +18,13 @@ Source11: https://github.com/linux-application-whitelisting/%{name}-selinux/rele
Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#/uthash-2.3.0.tar.gz
# https://github.com/linux-application-whitelisting/fapolicyd
# $ git format-patch -N v1.4.5
# $ git format-patch -N v2.0
# https://github.com/linux-application-whitelisting/fapolicyd-selinux
# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.1/ --dst-prefix=b/fapolicyd-selinux-1.1/ v1.1
# $ for j in [0-9]*.patch; do printf "Patch: %s\n" $j; done
# Patch list start
Patch: 0002-Fix-large-file-support-on-32-bit-builds.patch
# Patch: 0003-update-changelog.patch
# Patch list end
BuildRequires: gcc
@ -247,10 +249,10 @@ fi
%attr(644,root,root) %{_unitdir}/%{name}.service
%attr(644,root,root) %{_tmpfilesdir}/%{name}.conf
%attr(644,root,root) %{_sysusersdir}/%{name}.conf
%attr(755,root,root) %{_bindir}/%{name}-rpm-loader
%attr(755,root,root) %{_sbindir}/%{name}
%attr(755,root,root) %{_sbindir}/%{name}-cli
%attr(755,root,root) %{_sbindir}/fagenrules
%attr(755,root,root) %{_libexecdir}/%{name}-rpm-loader
%attr(644,root,root) %{_mandir}/man8/*
%attr(644,root,root) %{_mandir}/man5/*
%ghost %attr(440,%{name},%{name}) %verify(not md5 size mtime) %{_localstatedir}/log/%{name}-access.log
@ -278,6 +280,10 @@ fi
%selinux_relabel_post -s %{selinuxtype}
%changelog
* Thu Jul 23 2026 Petr Lautrbach <lautrbach@redhat.com> - 2.0-1
- fapolicyd-2.0
https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v2.0
* Wed Jul 08 2026 Vit Mojzis <vmojzis@redhat.com> - 1.6-2
- Add dependency on the latest version of lmdb-libs

4
sources
View File

@ -1,5 +1,5 @@
SHA512 (fapolicyd-1.6.tar.gz) = 6d1d2e4d3570a270e60010adcc32d12a8b85995525ff0e1c35f17d938b210ad392b485098e6e39eb5809b155c49ae8427b8ff9b04db9ae8d677155dae980579d
SHA512 (fapolicyd-1.6.tar.gz.asc) = b0fc5b54c09050eda907f238142aaa1a5aed4c11f1df0b2df8755c5eb29b5e3462d45b30b232d09b083d2233a4f2e5941808d4cd64344ba2d3d1cd604d8852db
SHA512 (fapolicyd-2.0.tar.gz) = e88cf14c6c8893d28a3959b45a6cd7dcf6a88ce057cb8a01992b395d6b849e2faad7de60efee9efca2265a8b758465e98293f210ac76745a8761c8f15ede5a09
SHA512 (fapolicyd-2.0.tar.gz.asc) = e154117b0efebce743d65b5b3b9b33902afdd1a7d5ff1febd2fbbf25dd500901362ca10829adab065c225857063282a0a543691a95a403f1faf15b19e2aa5235
SHA512 (fapolicyd-selinux-1.2.tar.gz) = 7ec54e0c45328e280a1f56aad5987abd6dc40906c715bfdb2c4860bf65061b1206a97064d2f37c5e16d9913e2a529c915c48d5137c24cff85c133372fe363a2c
SHA512 (fapolicyd-selinux-1.2.tar.gz.asc) = c539ddcf7dda61a3ae1f845e431042cdb7bbd6e9295e0b745eff51f2451a7a2abbd66ccf1794fb699fdf6498161be33da5303b01330fb992d09d48b8ae9e5a60
SHA512 (uthash-2.3.0.tar.gz) = 3b01f1074790fb242900411cb16eb82c1a9afcf58e3196a0f4611d9d7ef94690ad38c0a500e7783d3efa20328aa8d6ab14f246be63b3b3d385502ba2b6b2a294