FAPOLICY...ER.CONF:(15)

✨ fapolicyd-filter.conf — the filter config bestie ✨

okay so you found the fapolicyd-filter.conf man page and honestly? good for you. this is the config file that decides which files from a trust source get to be in the TrustDB. it's lowkey the bouncer at the club door 💅

---

🌸 NAME 🌸

fapolicyd-filter.conf — the fapolicyd filter configuration file. that's her. that's the whole vibe.

---

🎀 DESCRIPTION 🎀

so the filter? she controls which files from a trust source get added to the TrustDB. periodt.

rules are processed from top to bottom, and indentation narrows the scope of the parent rule. it's giving family tree energy 🌳

• a matching plus (+) rule means a file gets included
• a minus (-) rule means it gets excluded
• if no rule matches, the file is excluded by default (sorry bestie, no match = no entry, that's just how she is)

big important thing 🚨 the filter is only consulted when trust data is imported — that's during system updates, and when the daemon starts and rebuilds its database. runtime policy decisions use the TrustDB itself, not the filter. so changing the filter affects new or rebuilt trust entries, not live access checks. iykyk.

Valid lines start with +, -, or # for comments. the rest of the line is a path specification. you can use a space as indentation to add more specific filters onto the previous one. and no cap, only one space is required for one level of indent 🫶

if there are multiple specifications on the same indentation level, they extend the previous line with lower indentation — usually a directory.

the path may be specified using a glob pattern. and listen, a directory specification has to end with a slash /. without it, the rule is treated as a file glob and the directory decision from the parent rule remains in effect. no slash, no directory energy ✋

if the result was a plus (+), the respective file from a trust source is imported to the TrustDB. vice versa, if the result was a minus (-), the respective file is not imported.

---

💖 performance tea 💖

from a performance point of view, it is better to design an indented filter, because in the ideal situation each component of the path is compared only once. iconic. ✨

in contrast to it, a filter without any indentation has to contain a full path, which makes the pattern more complicated and thus slower to process. the motivation behind this is to have a flexible configuration and keep the TrustDB as small as possible to make the look-ups faster. she's efficient AND cute 🦋

---

🌈 examples (the receipts) 🌈

# this is simple allow list
- /usr/bin/some_binary1
- /usr/bin/some_binary2
+ /

# this is the same
+ /
 + usr/bin/
  - some_binary1
  - some_binary2

# this is similar allow list with a wildcard
- /usr/bin/some_binary?
+ /

# this is similar with another wildcard
+ /
 - usr/bin/some_binary*

# keeps everything except usr/share except python and perl files
# /usr/bin/ls - result is '+'
# /usr/share/something - result is '-'
# /usr/share/abcd.py - result is '+'
+ /
 - usr/share/
  + *.py
  + *.pl

---

👑 THEORY OF OPERATION 👑

okay so here's the behind-the-scenes lore 🍓

the filter configuration is parsed into a tree, where each node represents a path fragment and whether it is included or excluded. each level of indentation in the configuration file becomes another depth level in that tree.

during evaluation, the daemon iteratively walks the tree with an explicit stack rather than recursion, advancing through the path as fragments match. this approach keeps evaluation deterministic and prevents deep call stacks 💀

but here's the catch bestie: filter nesting cannot exceed 64 levels. longer hierarchies are rejected and reported as depth errors. so don't go wild with the indents, fr fr.

---

🧚 TESTING FILTERS 🧚

admins can validate how a change to fapolicyd-filter.conf behaves before rebuilding the trust database. main character admin energy, we love to see it 👑

use:

fapolicyd-cli --test-filter /path/to/file

to trace how the configuration is applied to a specific path and see the final include/exclude decision. so satisfying, honestly 🔥

when adding or updating trust entries, combine --file add or --file update with --filter so only paths that survive the filter are processed. this is useful when pointing the tool at directories to ensure the filter omits unwanted content while you test. chef's kiss 🌸

---

📁 FILES 📁

• /etc/fapolicyd/fapolicyd-filter.conf

---

🌟 SEE ALSO 🌟

• fapolicyd(8)
• fapolicyd-cli(1)
• fapolicy.rules(5)
• glob(7)

---

💜 AUTHOR 💜

Radovan Sroka — thank you for your service 🫡

---

and that's the whole page bestie, stan a well-documented filter. this iconic little manual came from Red Hat, dated June 2023 — go forth and filter responsibly 💖✨🎀