Automation can help increase efficiency, save time and improve consistency, which is why Red Hat Enterprise Linux (RHEL) includes features that help automate many tasks.RHEL system roles are a collection of Ansible content that helps provide more consistent workflows and streamline the execution of many manual tasks.
Fapolicyd is a security-focused feature that can control which applications may be executed in a RHEL environment, as well as verify the integrity of applications prior to execution. This functionality helps prevent untrusted applications from being executed on a RHEL system. For more information on fapolicyd, refer to theBlocking and allowing applications by using fapolicyd documentation.
The recently introduced fapolicyd system role can help automate the process of installing and configuring fapolicyd, as well as manage the list of files that fapolicyd trusts.
Environment overview
In my lab environment, I have a control node system namedrhel9-controlnode.example.com and two managed nodes:rhel9-server1.example.com andrhel9-server2.example.com.
Therhel9-controlenode.example.com system, as my control node, has theansible-core andrhel-system-roles packages installed, and has SSH key authentication setup with therhel9-server1.example.com andrhel9-server2.example.com managed nodes. For more information on getting started with RHEL system roles, refer to theIntroduction to RHEL system roles article.
I’d like to use the fapolicyd system role to install and start fapolicyd on the two managed nodes. In addition, I’d like to have fapolicyd configured with thesha256 integrity option, which will perform an integrity check prior to allowing applications to execute.
Create the inventory file
I’ll create an inventory file namedinventory.ymlon therhel9-controlnode.example.com host. This file lists the two managed nodes, and sets thefapolicyd_setup_integrity variable tosha256 to instruct the fapolicyd role to configure the SHA-256 integrity option.
all: hosts: rhel9-server1.example.com: rhel9-server2.example.com: vars: fapolicyd_setup_integrity: sha256
If you're using Ansible automation controller as your control node, this Inventory can be imported intoRed Hat Ansible Automation Platform using anSCM project or using theawx-manage Utility, as specified in the documentation.
Create the playbook
Next, I’ll create a simple Ansible Playbook on therhel9-controlnode.example.com host, namedfapolicyd.yml, to call the fapolicyd system role:
- name: Run the fapolicyd system role hosts: all roles: - redhat.rhel_system_roles.fapolicyd
If you're using Ansible automation controller as your control node, you canimport this Ansible playbook into Red Hat Ansible Automation Platform. It's common to use Git repos to store Ansible Playbooks. Ansible Automation Platform stores automation inunits called job templates, which contain the playbook, credentials and inventory.
Run the playbook
At this point, everything is in place. I’ll use theansible-playbook command to run thefapolicyd.yml playbook from therhel9-controlnode.example.com host (which already hasrhel-system-roles andansible-core packages installed). The-b flag prompts Ansible to escalate privileges, and the-i option providesinventory.yml as the Ansible inventory.
$ ansible-playbook -i inventory.yml -b fapolicyd.yml
If you're using Ansible automation controller as your control node, you can launch the job from the automation controller web interface.
I validated that the playbook completed successfully:
Validating the configuration
Next, I’ll validate that fapolicyd is working. I’ll login to each of the managed nodes, both of which have a Python script located at/usr/local/bin/python_script.py. When I attempt to run this script, fapolicyd prevents it from being executed, as it has not been marked as a trusted file:
[brian@rhel9-server1 ~]$ /usr/local/bin/python_script.py-bash: /usr/local/bin/python_script.py: Operation not permitted
If I would like fapolicyd to allow this script to be run, I can update theinventory.yml on the control node, and specify that this a trusted file by listing it under thefapolciyd_add_trusted_file variable:
all: hosts: rhel9-server1.example.com: rhel9-server2.example.com: vars: fapolicyd_setup_integrity: sha256 fapolicyd_add_trusted_file: - /usr/local/bin/python_script.py
After running thefapolicyd.yml playbook again with the updatedinventory.yml, I’ll again try to execute the script from one of the managed nodes, and fapolicyd now allows the script to be executed:
[brian@rhel9-server1 ~]$ /usr/local/bin/python_script.pyHello world
However, if the script is modified, the fapolicyd SHA-256 integrity checking will cause fapolicyd to detect that the file was modified and prevent it from being executed.
[brian@rhel9-server1 ~]$ sudo sed -i 's/Hello world/Hello World!/' /usr/local/bin/python_script.py [brian@rhel9-server1 ~]$ /usr/local/bin/python_script.py -bash: /usr/local/bin/python_script.py: Operation not permitted
In this example, I modified the script to output slightly different text. When attempting to run the script, fapolicyd detects that the SHA-256 checksum of the file doesn’t match the file that was previously trusted, which results in fapolicyd preventing the Python script from being run. If I’d like to allow this updated script to run, I could run the system role again, which would add the updated scripts SHA-256 checksum to the list of trusted files, allowing the updated script to be executed.
Wrap up
The fapolicyd system role helps you automate the configuration of fapolicyd across your RHEL environment, more consistently and at scale. To explore additional system roles, review thelist of available RHEL system roles and start managing your RHEL servers in a more efficient, consistent and automated manner today.
Want to learn more about the Red Hat Ansible Automation Platform? Check out our e-bookthe automation architect's handbook.
