Description of problem:

We have a customer hitting hangs of his processes, due to the processes waiting for reply from fapolicyd which never comes.
On the fapolicyd side, we could see some kind of "FD leak", but on fapolicyd side, the process was mostly idle, waiting for events.

Digging into the code, we could find that there is a bug when the event cannot be queued, leading to both FD leak and target process hanging:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
323 static void enqueue_event(const struct fanotify_event_metadata *metadata)
324

{ 325 if (q_append(q, metadata)) 326 msg(LOG_DEBUG, "enqueue error"); 327 else 328 set_ready(); 329 }

341 void handle_events(void)
342 {
:
374 if (metadata->fd >= 0) {
375 if (metadata->mask & mask)

{ 376 if (metadata->pid == our_pid) 377 approve_event(metadata); 378 else 379 enqueue_event(metadata); 380 }

381 // For now, prevent leaking descriptors
382 // in the near future we should do processing
383 // to update the cache.
384 else

{ 385 close(metadata->fd); 386 goto out; 387 }

388 }
:

106 /* add DATA to Q */
107 int q_append(struct queue *q, const struct fanotify_event_metadata *data)
108 {
:
112 if (q->queue_length == q->num_entries)

{ 113 errno = ENOSPC; 114 return -1; 115 }

:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Here above, when handle_events() enqueues an event (line 379), it's possible that the enqueuing fails, due to not having enough space or another issue (line 113 of q_append()).
In such case enqueue_event() logs are DEBUG level and returns immediately (line 326), causing the FD to never be closed, which creates a FD leak.
Additionally target process will hang forever since it never gets a reply, since event wasn't enqueued.

I can reproduce this through simulation using a systemtap script.

Version-Release number of selected component (if applicable):

fapolicyd-1.1.3-8.el8_7.1.x86_64

How reproducible:

Always using systemtap script below

Steps to Reproduce:
1. Start "hack_sha256sum.stp" stap script in attachment

The script will simulate a "queue full" when getting an event for "sha256sum" process

1. stap -v -g ./hack_sha256sum.stp

2. From a shell, execute "sha256sum" program

1. sha256sum

3. stap script shows fake "queue full" event

q_append(): Event for PID 2437 (sha256sum), FD 11: queue_len=0, num_entries=640
q_append(): returning -1
q_append(): restoring queue_length from 640 to 0

Actual results:

• sha256sum hangs forever and cannot be killed (even with SIGKILL signal):

1. cat /proc/2437/stack
   [<0>] fanotify_handle_event+0x306/0x360
   [<0>] fsnotify+0x253/0x580
   [<0>] do_dentry_open+0xce/0x340
   [<0>] path_openat+0x53e/0x14f0
   [<0>] do_filp_open+0x93/0x100
   [<0>] do_sys_open+0x184/0x220
   [<0>] do_syscall_64+0x5b/0x1a0
   [<0>] entry_SYSCALL_64_after_hwframe+0x65/0xca

1. kill -9 2437
   --> no effect

• fapolicyd leaks FD 11

1. ll /proc/1792/fd
   total 0
   lr-x------. 1 root root 64 Mar 24 08:51 0 -> /dev/null
   lrwx------. 1 root root 64 Mar 24 08:51 1 -> 'socket:[29169]'
   lrwx------. 1 root root 64 Mar 24 08:51 10 -> 'anon_inode:[fanotify]'
   lr-x------. 1 root root 64 Mar 24 08:51 11 -> /etc/ld.so.cache <<<<<<<<<< FD of "target process 2437"
   lrwx------. 1 root root 64 Mar 24 08:51 2 -> 'socket:[29169]'
   lrwx------. 1 root root 64 Mar 24 08:51 3 -> /run/fapolicyd/fapolicyd.fifo
   lr-x------. 1 root root 64 Mar 24 08:51 4 -> /var/lib/sss/mc/passwd
   lrwx------. 1 root root 64 Mar 24 08:51 5 -> 'socket:[29173]'
   lr-x------. 1 root root 64 Mar 24 08:51 6 -> /var/lib/sss/mc/group
   lrwx------. 1 root root 64 Mar 24 08:51 7 -> /var/lib/fapolicyd/lock.mdb
   lrwx------. 1 root root 64 Mar 24 08:51 8 -> /var/lib/fapolicyd/data.mdb
   lr-x------. 1 root root 64 Mar 24 08:51 9 -> /proc/1792/mounts

Expected results:

• sha256sum continues execution (or gets denied, I don't know, needs to be evaluated, in Permissive it should continue for sure)
• fapolicyd doesn't leak FD 11, fapolicyd "complains hard" and authorizes or denies target process execution (in Permissive it should authorize for sure)

Acceptance Criteria:

• patch is included and is applied
• patch review is done
• sanity tests for the component passes