Document link:

• RHEL 8 Security hardening
• RHEL 9 Security hardening
• RHEL 10 Security hardening

Section number and name:

• For RHEL 8: 12.2. Deploying fapolicyd
• For RHEL 9: 12.2. Deploying fapolicyd
• For RHEL 10: 10.2. Deploying fapolicyd

Describe the issue:

• Step 4. says "If you enabled permissive mode through /etc/fapolicyd/fapolicyd.conf: "
  • This suggests that you need to apply the following steps only if you have set the permissive mode
  • In fact, if you don't apply the following steps or make sure to have at least one audit rule enabled there will be no logging to `audit.log`

Impact of this issue:

• Access denied events from `fapolicyd` won't show up in `audit.log`
• This would increase the users effort for troubleshooting

Suggestions for improvement:

• Remove the condition of the enabled permissive mode
• The documentation should clearly state what steps are necessary to log 'access denied' events to `audit.log`
• Either include the steps from the solution "No FANOTIFY event seen in the audit log despite fapolicyd blocking operations" or reference it
• Reference the manpage `fapolicyd(8)` at the end of the section for more information