Install fapolicyd Package
Ensures the fapolicyd application-control daemon is installed so the system can enforce execution whitelisting.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
fapolicyd (File Access Policy Daemon) implements application whitelisting to decide which binaries and libraries a process may execute. Without it, any executable dropped on disk, by an attacker, a compromised update, or an unprivileged user, can be run freely, so the system has no defence against unknown or untrusted code. Application control is a core mitigation against malware and living-off-the-land techniques, which is why it is mandated by hardening baselines.
What Pavois checks
Pavois asks the package database directly via package('fapolicyd') rather than guessing from a config file, so it reports the effective install state, what is actually present on the running system. A file-based scanner could be fooled by stale config fragments referencing a daemon that was never installed; querying the package manager cannot.
describe package('fapolicyd') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q fapolicyd. The package is present when it prints a versioned name such as fapolicyd-1.1.3-x.elx.x86_64; package fapolicyd is not installed means the rule fails. Optionally confirm it is active with systemctl is-active fapolicyd.
Inspect & investigate
Check install state with rpm -q fapolicyd. Once running, fapolicyd logs allowed/denied executions to its dnf/syslog channel and to journalctl -u fapolicyd; decision events also appear in /var/log/audit/audit.log (type FANOTIFY).
Remediation
Pavois's harden plan installs the fapolicyd package (resource package, action install) when you run pavois harden apply. Note that installing the package does not by itself activate enforcement, you must still enable and start the service and review its policy before relying on it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | fapolicyd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without fapolicyd, the host has no execution allow-listing and any planted binary can run. Precaution before enabling enforcement: fapolicyd in enforcing mode can block legitimate binaries and break applications or admin tooling. Build and test the trust database (fapolicyd-cli --update) in permissive mode first, validate that your workloads still run, and only then switch to enforcing, otherwise you risk locking out services or even login shells. Not enabled by default: on a stock Alma/RHEL 8 install fapolicyd is not installed or running; Pavois installs and enables it, which is why it is flagged danger:. Failure mode & recovery: if the trust database is incomplete (the rpmdb backend did not populate, or a daemon needs an interpreter/binary outside the RPM set), fapolicyd denies those executions and the affected service will not start; the denial is logged in /var/log/fapolicyd-access.log (dec=deny), NOT in the service's own logs. Recover by rebuilding the trust DB: systemctl stop fapolicyd; rm -f /var/lib/fapolicyd/*.mdb; fapolicyd-cli --update; systemctl start fapolicyd (a healthy DB holds tens of thousands of entries, check with fapolicyd-cli --dump-db | wc -l). Trust an extra binary with fapolicyd-cli --file add /path && fapolicyd-cli --update. Always validate in permissive mode (permissive = 1 in /etc/fapolicyd/fapolicyd.conf) before enforcing.