Description of problem:

IMHO the rules added to enable dracut execution are too loose (/etc/fapolicyd/rules.d/20-dracut.rules):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
allow perm=any uid=0 : dir=/var/tmp/
allow perm=any uid=0 trust=1 : all
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

I think there are 2 issues:

1. the "allow perm=any uid=0 : dir=/var/tmp/" rule is not needed at all, dracut executes fine (at least with default command "dracut -f") with just second rule

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

1. cat /etc/fapolicyd/rules.d/20-dracut.rules
2. Carve out an exception for dracut's initramfs building

#allow perm=any uid=0 : dir=/var/tmp/
allow perm=any uid=0 trust=1 : all

1. systemctl restart fapolicyd
2. dracut /tmp/initrd.img $(uname -r)
   • • • • • • • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

2. the "allow perm=any uid=0 trust=1 : all" rule allows root user to execute any crafted program

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

1. cat > hello.c << EOF
   #include <stdio.h>
   int main(int argc, char *argv[]) { printf("Hello!\n"); return 0; }

   EOF

1. gcc -o hello hello.c

1. ./hello
   Hello!
   • • • • • • • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

I think if there is no other choice but this second rule, then a comment in the rules file should clearly mention that this opens the world for root user a lot more than just dracut.

Version-Release number of selected component (if applicable):

fapolicyd-1.1.3-8.el8_7.1.x86_64

How reproducible:

Always, see above.