Description of problem:

When stracing fapolicyd or sending a SIGSTOP signal to fapolicyd, the system hangs and needs to be forcibly rebooted.

Assuming SELinux is enabled and in Enforcing (which is the default), it should be very easy to avoid such system hang by protecting the process with some new rule such as below:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
(neverallow domain fapolicyd_t (process (sigstop ptrace)))
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Version-Release number of selected component (if applicable):

fapolicyd-selinux-1.1.3-8.el8_7.1.noarch

How reproducible:

Always

Steps to Reproduce:
1. Send SIGSTOP as root/unconfined

Actual results:

System unusable until rebooted forcibly

Expected results:

Cannot send SIGSTOP

Additional info:

Unfortunately there seems to be something in SELinux that doesn't take "neverallow" rules into account.
If I add such rule, "sesearch --neverallow" still doesn't list anything, weird:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

1. bunzip2 -c /var/lib/selinux/targeted/active/modules/400/protect_fapolicyd/cil
   (neverallow domain fapolicyd_t (process (sigstop ptrace)))

--> rule is present and loaded in policy

1. sesearch --neverallow
   --> nothing
   • • • • • • • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------