Basically, I want to implement an app whitelisting solution for my client.
The requirement is to allow all applications currently installed on the system, so the app will deny everything else. My choice was fapolicyd but I encounter some issues…
Literally seconds after I installed and turned on fapolicyd it blocked client’s Java software. I’ve added the whole catalogue to trusted files using fapolicyd-cli. It’s working, but soon there will be Java update and the files inside the catalogue for sure will change names… My questions are:
- Will fapolicyd know that the files inside the /opt/mule directory are new and then block them?
- If yes, how can I configure fapolicyd to allow customer’s apps and files?
What I did:
I’ve added /opt/mule to trusted files using:
fapolicyd-cli –file add /opt/mule –trust-file mule
I’ve tried to create a new rule with number 80 but it didn’t work as the client’s app was still blocked… Some previous rule denies all access to files but I don’t know why.
I’ve tried debug mode to know which rule blocked an access and I still don’t know anything 😀
Of course I’ve checked all web documentations and helps. Maybe some of You guys have better knowledge.
Łukasz Piątkowski is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.