#1037547 fapolicyd: Installation of fapolicyd via apt caused everything to immediately become non-executable.

Package:
fapolicyd
Source:
fapolicyd
Description:
File Access Policy Daemon
Submitter:
Bill Hay
Date:
2025-07-17 23:39:02 UTC
Severity:
normal
Tags:
#1037547#5
Date:
2023-06-13 23:47:33 UTC
From:
To:
Dear Maintainer,

I wanted to try out fapolicyd.

I typed apt install fapolicyd on my recently upgraded bookworm system

While installing it complained about being unable to do something with man pages.
Immediately after installing no external executables were executable.  In order to
regain control of the system I had to stomp on the systemd file for fapolicyd via
redirection from my shell and power cycle my laptop.

I expected to still be able to run most normal binaries
#1037547#12
Date:
2023-06-14 06:22:32 UTC
From:
To:
pilgrim:/etc/fapolicyd/rules.d# ls
90-deny-execute.rules
pilgrim:/etc/fapolicyd/rules.d# cat 90-deny-execute.rules
# Deny execution for anything untrusted

deny_audit perm=execute all : all

pilgrim:/etc/fapolicyd# cat fapolicyd.conf
#
# This file controls the configuration of the file access policy daemon.
# See the fapolicyd.conf man page for explanation.
#

permissive = 0
nice_val = 14
q_size = 640
uid = fapolicyd
gid = fapolicyd
do_stat_report = 1
detailed_report = 1
db_max_size = 50
subj_cache_size = 1549
obj_cache_size = 8191
watch_fs = ext2,ext3,ext4,tmpfs,xfs,vfat,iso9660,btrfs
trust = rpmdb,file
integrity = none
syslog_format = rule,dec,perm,auid,pid,exe,:,path,ftype,trust
rpm_sha256_only = 0
allow_filesystem_mark = 0


Looks like the shipped policy is to deny all execute and with permissive=0 this is enforced.
#1037547#17
Date:
2023-06-14 07:55:09 UTC
From:
To:
The fapolicyd.conf file contains trust = rpmdb,file
Since debian doesn't, by default,  have an rpm database.
Even when you install rpm on debian the database doesn't include
most OS executables.
#1037547#22
Date:
2024-10-23 07:28:00 UTC
From:
To:
Hi

I failed to reproduce the issue after installing the package (version
1.3.2+20231212+git973a86d1b4-1) in a VM.

# grep ^trust /etc/fapolicyd/fapolicyd.conf
trust = debdb

Either this has been fixed in the mean time or you simply have a
outdated fapolicyd.conf.

Would be great if you can rerun your test with a current version.

Regards
Michael
#1037547#31
Date:
2025-07-17 23:29:39 UTC
From:
To:
On Wed, 23 Oct 2024 09:28:00 +0200 Michael Biebl <biebl@debian.org> wrote:

 >
 > Either this has been fixed in the mean time or you simply have a
 > outdated fapolicyd.conf.
 >
 > Would be great if you can rerun your test with a current version.


I've just run across on a fresh Bookworm install. It may be fine with
the versions currently in unstable/testing, but the policy shipped with
Bookworm is affected by this bug.

Would it be possible to get a fix into stable (or at least
stable-backports) for this?