Enable the File Access Policy Service
Ensures the application allow-listing daemon fapolicyd.service is enabled and running so only authorized executables can run.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The fapolicyd (File Access Policy Daemon) service implements application allow-listing: it decides which executables and libraries may run based on policy. Running it blocks the execution of untrusted or unauthorized binaries, a strong defense against malware and supply-chain tampering.
What Pavois checks
Pavois queries the resolved unit state with systemctl is-enabled / is-active for fapolicyd.service. Reading the effective state confirms the daemon is actually active now, not just installed or enabled in a unit file that could be masked or failing to start.
describe service('fapolicyd.service') do
it { should be_enabled }
it { should be_running }
endHow to verify it is applied
Run systemctl is-enabled fapolicyd.service (expected enabled) and systemctl is-active fapolicyd.service (expected active).
Inspect & investigate
Check systemctl show fapolicyd.service (fields UnitFileState, ActiveState) and journalctl -u fapolicyd.service; denied-execution events are logged to /var/log/fapolicyd-access.log and the audit log /var/log/audit/audit.log.
Remediation
Pavois's harden plan applies a service resource for fapolicyd with actions enable and start, so the allow-listing daemon starts now and persists across reboots. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | fapolicyd-cli --update 2>/dev/null; systemctl enable --now fapolicyd |
|---|---|
| name | enable-fapolicyd |
| not_if | systemctl is-active --quiet fapolicyd |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
fapolicyd enforces an allow-list: in enforcing mode it can block legitimate binaries not covered by policy (custom scripts, software installed outside dnf/rpm), breaking applications or even login. Precaution: before enabling, build/trust the rule set, run in permissive mode first to collect denials, and ensure the trust database (fapolicyd-cli --update) reflects your installed software, otherwise you risk locking yourself out of needed tools. Not enabled by default: on a stock Alma/RHEL 8 install fapolicyd is not installed or running; Pavois installs and enables it, which is why it is flagged danger:. Failure mode & recovery: if the trust database is incomplete (the rpmdb backend did not populate, or a daemon needs an interpreter/binary outside the RPM set), fapolicyd denies those executions and the affected service will not start; the denial is logged in /var/log/fapolicyd-access.log (dec=deny), NOT in the service's own logs. Recover by rebuilding the trust DB: systemctl stop fapolicyd; rm -f /var/lib/fapolicyd/*.mdb; fapolicyd-cli --update; systemctl start fapolicyd (a healthy DB holds tens of thousands of entries, check with fapolicyd-cli --dump-db | wc -l). Trust an extra binary with fapolicyd-cli --file add /path && fapolicyd-cli --update. Always validate in permissive mode (permissive = 1 in /etc/fapolicyd/fapolicyd.conf) before enforcing.