Automation can help increase efficiency, save time and improve consistency, which is why Red Hat Enterprise Linux (RHEL) includes features that help automate many tasks. RHEL system roles are a collection of Ansible content that helps provide more consistent workflows and streamline the execution of many manual tasks.
Fapolicyd is a security-focused feature that can control which applications may be executed in a RHEL environment, as well as verify the integrity of applications prior to execution. This functionality helps prevent untrusted applications from being executed on a RHEL system. For more information on fapolicyd, refer to the Blocking and allowing applications by using fapolicyd documentation.
The recently introduced fapolicyd system role can help automate the process of installing and configuring fapolicyd, as well as manage the list of files that fapolicyd trusts.
Environment overview
In my lab environment, I have a control node system named rhel9-controlnode.example.com and two managed nodes: rhel9-server1.example.com and rhel9-server2.example.com.
The rhel9-controlenode.example.com system, as my control node, has the ansible-core and rhel-system-roles packages installed, and has SSH key authentication setup with the rhel9-server1.example.com and rhel9-server2.example.com managed nodes. For more information on getting started with RHEL system roles, refer to the Introduction to RHEL system roles article.
I’d like to use the fapolicyd system role to install and start fapolicyd on the two managed nodes. In addition, I’d like to have fapolicyd configured with the sha256 integrity option, which will perform an integrity check prior to allowing applications to execute.
Create the inventory file
I’ll create an inventory file named inventory.yml on the rhel9-controlnode.example.com host. This file lists the two managed nodes, and sets the fapolicyd_setup_integrity variable to sha256 to instruct the fapolicyd role to configure the SHA-256 integrity option.
all: hosts: rhel9-server1.example.com: rhel9-server2.example.com: vars: fapolicyd_setup_integrity: sha256
If you're using Ansible automation controller as your control node, this Inventory can be imported into Red Hat Ansible Automation Platform using an SCM project or using the awx-manage Utility, as specified in the documentation.
Create the playbook
Next, I’ll create a simple Ansible Playbook on the rhel9-controlnode.example.com host, named fapolicyd.yml, to call the fapolicyd system role:
- name: Run the fapolicyd system role hosts: all roles: - redhat.rhel_system_roles.fapolicyd
If you're using Ansible automation controller as your control node, you can import this Ansible playbook into Red Hat Ansible Automation Platform. It's common to use Git repos to store Ansible Playbooks. Ansible Automation Platform stores automation in units called job templates, which contain the playbook, credentials and inventory.
Run the playbook
At this point, everything is in place. I’ll use the ansible-playbook command to run the fapolicyd.yml playbook from the rhel9-controlnode.example.com host (which already has rhel-system-roles and ansible-core packages installed). The -b flag prompts Ansible to escalate privileges, and the -i option provides inventory.yml as the Ansible inventory.
$ ansible-playbook -i inventory.yml -b fapolicyd.yml
If you're using Ansible automation controller as your control node, you can launch the job from the automation controller web interface.
I validated that the playbook completed successfully:
Validating the configuration
Next, I’ll validate that fapolicyd is working. I’ll login to each of the managed nodes, both of which have a Python script located at /usr/local/bin/python_script.py. When I attempt to run this script, fapolicyd prevents it from being executed, as it has not been marked as a trusted file:
[brian@rhel9-server1 ~]$ /usr/local/bin/python_script.py -bash: /usr/local/bin/python_script.py: Operation not permitted
If I would like fapolicyd to allow this script to be run, I can update the inventory.yml on the control node, and specify that this a trusted file by listing it under the fapolciyd_add_trusted_file variable:
all: hosts: rhel9-server1.example.com: rhel9-server2.example.com: vars: fapolicyd_setup_integrity: sha256 fapolicyd_add_trusted_file: - /usr/local/bin/python_script.py
After running the fapolicyd.yml playbook again with the updated inventory.yml, I’ll again try to execute the script from one of the managed nodes, and fapolicyd now allows the script to be executed:
[brian@rhel9-server1 ~]$ /usr/local/bin/python_script.py Hello world
However, if the script is modified, the fapolicyd SHA-256 integrity checking will cause fapolicyd to detect that the file was modified and prevent it from being executed.
[brian@rhel9-server1 ~]$ sudo sed -i 's/Hello world/Hello World!/' /usr/local/bin/python_script.py [brian@rhel9-server1 ~]$ /usr/local/bin/python_script.py -bash: /usr/local/bin/python_script.py: Operation not permitted
In this example, I modified the script to output slightly different text. When attempting to run the script, fapolicyd detects that the SHA-256 checksum of the file doesn’t match the file that was previously trusted, which results in fapolicyd preventing the Python script from being run. If I’d like to allow this updated script to run, I could run the system role again, which would add the updated scripts SHA-256 checksum to the list of trusted files, allowing the updated script to be executed.
Wrap up
The fapolicyd system role helps you automate the configuration of fapolicyd across your RHEL environment, more consistently and at scale. To explore additional system roles, review the list of available RHEL system roles and start managing your RHEL servers in a more efficient, consistent and automated manner today.
Want to learn more about the Red Hat Ansible Automation Platform? Check out our e-book the automation architect's handbook.
About the author
Brian Smith is a Product Manager at Red Hat focused on RHEL automation and management. He has been at Red Hat since 2018, previously working with Public Sector customers as a Technical Account Manager (TAM).
More like this
Browse by channel
Automation
The latest on IT automation for tech, teams, and environments
Artificial intelligence
Updates on the platforms that free customers to run AI workloads anywhere
Open hybrid cloud
Explore how we build a more flexible future with hybrid cloud
Security
The latest on how we reduce risks across environments and technologies
Edge computing
Updates on the platforms that simplify operations at the edge
Infrastructure
The latest on the world’s leading enterprise Linux platform
Applications
Inside our solutions to the toughest application challenges
Original shows
Entertaining stories from the makers and leaders in enterprise tech
Products
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Cloud services
- See all products
Tools
- Training and certification
- My account
- Customer support
- Developer resources
- Find a partner
- Red Hat Ecosystem Catalog
- Red Hat value calculator
- Documentation
Try, buy, & sell
Communicate
About Red Hat
We’re the world’s leading provider of enterprise open source solutions—including Linux, cloud, container, and Kubernetes. We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.
Select a language
Red Hat legal and privacy links
- About Red Hat
- Jobs
- Events
- Locations
- Contact Red Hat
- Red Hat Blog
- Diversity, equity, and inclusion
- Cool Stuff Store
- Red Hat Summit