FAPOLICYD.TRUST:(5)

💖 FAPOLICYD.TRUST:(5) 💖

okay bestie, pull up a chair because we're talking about fapolicyd.trust — literally the file of trust for fapolicyd, the application whitelisting daemon. yes, this is a section 5 manual page, and yes, it ate. let's go 🫶

---

✨ NAME ✨

fapolicyd.trust — fapolicyd's file of trust 👑

---

🌸 DESCRIPTION 🌸

so the file /etc/fapolicyd/fapolicyd.trust holds the list of trusted files/binaries for the application whitelisting daemon. that's its whole job. iconic.

you can drop comments in there whenever the vibe calls for it — just start the line with a # character and the daemon will simply not care about it. 💅

every non-comment line is exactly three things, in order:

1. a full path
2. the size in bytes
3. a valid SHA256 hash

and like, the order matters, okay?

Version 3 trust files write paths without escaping and find the size and hash by splitting at the final two spaces. which means — and this is the slay part — a path may therefore contain spaces. 🦋

now, listen, the fapolicyd-cli --file commands receive ordinary shell arguments, so if your path has a space in it you gotta quote it in the shell, like:

fapolicyd-cli --file add "/tmp/first last/"

and heads up bestie: in a version 3 trust file, %20 is a literal percent sign followed by 20, not a space. do not get it twisted. 🙈

the size field is an unsigned 64-bit byte count written in decimal. this fixed representation is intentionally independent of the native C off_t and size_t types, so trust records retain the same syntax on 32-bit and 64-bit builds. no cap. and a record whose size cannot be represented by the native file-size type used for a filesystem comparison is rejected — so yeah, it has to fit, periodt. 💀

---

Version 2 trust files are accepted for compatibility and use their legacy percent escaping, including %20 for a space. but newly rewritten trust files use version 3, so do not use version-2 percent escapes in new entries. okay? okay. ✨

---

now for the multi-file era: the directory /etc/fapolicyd/trust.d can be used to store multiple trust files. this way a privileged user can split the trust database into multiple files and manage them separately through fapolicyd-cli. functionally, the fapolicy daemon will behave the same way as if the whole trust database has been defined inside the fapolicyd.trust file. same energy, different filing system. 🎀

syntax and semantics of trust files inside the trust.d directory are the same as for the fapolicyd.trust file (described above, bestie, scroll up). trust files can either be created manually inside trust.d directory or via fapolicyd-cli — and the latter option is recommended. do it the cool way. 💅

---

🌈 EXAMPLE 🌈

[root@Desktop ~]# cat /etc/fapolicyd/fapolicyd.trust
/home/user/my-ls 157984 61a9960bf7d255a85811f4afcac51067b8f2e4c75e21cf4f2af95319d4ed1b87
/home/user/my-ls2 5555 61a9960bf7d255a85811f4afcac51067b8f2e4c75e21cf4f2af95319d4ed1b87

look at that. path, size, hash. chef's kiss. 🔥

---

🎀 FILES 🎀

• /etc/fapolicyd/fapolicyd.trust — list of trusted files/binaries

---

💜 SEE ALSO 💜

fapolicyd(8), fapolicyd-cli(8) fapolicy.rules(5) and fapolicy.conf(5).

go read those too, iykyk 🧚

---

⭐ AUTHOR ⭐

Radovan Sroka

---

and that's the whole page, bestie!! brought to you by Red Hat, from January 2020 — yeah it's vintage but it's still serving 💖✨🦋🌸💅🫶👑🌈⭐