FAPOLICYD(8)

💖 FAPOLICYD 💖

okay bestie, welcome to the fapolicyd page — that's the File Access Policy Daemon, section 8 of the System Administration Utilities manual, and yes she is that girl. 🎀

---

✨ NAME ✨

fapolicyd — the File Access Policy Daemon. that's it, that's the name, she's literally the whole vibe 💅

---

🌸 SYNOPSIS 🌸

fapolicyd [--debug|--debug-deny|--foreground] [--permissive] [--no-details] [--mounts=PATH] [--version]

---

🦋 DESCRIPTION 🦋

so like. fapolicyd is a userspace daemon that decides who gets access to which files, based on a trust database plus the attributes of the file or the process asking. and she can run it two ways, bestie: blacklist file access and execution, or whitelist it. pick your fighter. ✨

configuring her? that's all happening in the files inside /etc/fapolicyd/. there are three of them and they each do their own little job:

• compiled.rules — this one holds the access policy 👑
• fapolicyd.conf — this one decides the daemon's configuration ⚙️
• fapolicyd.trust — this one lets the admin define trusted files by hand 🫶

the default rules will generate audit events whenever there's a denial. NOTE: you must have at least 1 audit rule loaded for the audit system to create the full FANOTIFY event. doesn't matter which rule is loaded, literally any of them. and to see if you've got any denials, run this:

ausearch --start today -m fanotify -i

or instead of -i, you can add --format text to get an easier to read audit event. iconic. 🌈

---

💅 OPTIONS 💅

• --debug — run the daemon in the foreground and write event information to stderr so you can actually see the policy decisions happening. it's giving voyeur but make it sysadmin 🔥
• --debug-deny — same foreground situation, but she only writes deny decisions to stderr. no noise, just the drama 💀
• --foreground — run in the foreground without enabling debug output. this one's for service managers using readiness or watchdog supervision, so like, babysitters basically 🍼
• --permissive — allow file access even when the policy would deny it. super useful when you're validating rules before you actually enforce them. test run era, no cap 🧚
• --mounts=PATH — in debug mode only, read mount information from the regular file at PATH instead of /proc/mounts. the file has to use the same format as /proc/mounts. great for reproducing mount-related issues with a captured or filtered mount list 🗂️
• --no-details — suppress process and file names in the shutdown usage report while keeping the aggregate statistics. names redacted, receipts kept 🙈
• --version — display version information and exit. short, sweet, slay ⭐

---

🔔 SIGNALS 🔔

• SIGTERM — causes fapolicyd to discontinue processing events, write it's performance report, and exit. she's logging off, respectfully 💜
• SIGHUP — causes fapolicyd to reload the trust database. refresh, refresh, refresh 🦋
• SIGUSR1 — causes fapolicyd to dump the requested report to /run/fapolicyd/fapolicyd.state or /run/fapolicyd/fapolicyd.metrics. see fapolicyd.state(5) and fapolicyd.metrics(5). 📊
  • when reset_strategy=manual is configured, a SIGUSR1 report that carries reset intent (only possible programmatically) also resets runtime metric counters after the report is written. plain SIGUSR1 reports do not reset counters. ⚠️
  • SIGUSR1 can also carry timing start and stop intents. those intents are honored only for privileged senders when timing_collection=manual is active; stopped timing runs are written to /run/fapolicyd/fapolicyd.timing. ⏱️

---

👑 NOTES 👑

okay bestie this first one is a whole BIG DEAL so pay attention:

whatever you do, DO NOT TRY TO ATTACH WITH PTRACE. ptrace attachment sends a SIGSTOP which cannot be blocked. since your whole system depends on fapolicyd approving access to glibc and various critical libraries, that approval will not happen until SIGCONT is sent. the system can deadlock if the continue signal is not sent. fr fr, do not do this. 😭

to get audit events, you must have auditing enabled and at least one systemcall rule loaded. otherwise you will not get any events. periodt. 💀

if the rpmdb is set as a trust source, you should minimize the number of 32 bit packages on the system. in such cases, there may be a 32 bit and 64 file with the same pathname. obviously only one can exist on the disk. so, this will always cause database miscompares and cause a delay in the daemon being operational. 🙈

the compiled.rules file is the resulting merge of component rules in /etc/fapolicyd/rules.d/. see the fagenrules man page for more information. 🧚

when built with systemd watchdog support, the packaged service uses Type=notify and starts fapolicyd with --foreground. see systemd-watchdog.md in the documentation directory for watchdog timeout and drop-in examples. 🔥

and if you're running in debug mode and you wish to compare rule numbers reported in the output with which rule is actually triggering, you can see the rules with the corresponding number by running:

fapolicyd-cli --list

✨ iykyk ✨

---

🍓 FILES 🍓

• /etc/fapolicyd/fapolicyd.conf — daemon configuration ⚙️
• /etc/fapolicyd/compiled.rules — access control rules 👑
• /etc/fapolicyd/fapolicyd.trust — admin defined trusted files 🫶
• /var/log/fapolicyd-access.log — information about what was being accessed. 👀
• /run/fapolicyd/fapolicyd.state — daemon state report. see fapolicyd.state(5). 📋
• /run/fapolicyd/fapolicyd.metrics — runtime metrics report. see fapolicyd.metrics(5). 📊
• /run/fapolicyd/fapolicyd.timing — manual decision timing report. see fapolicyd.timing(5). ⏱️

---

🌈 SEE ALSO 🌈

fapolicyd-cli(8), fapolicyd.rules(5), fapolicyd.state(5), fapolicyd.metrics(5), fapolicyd.timing(5), fapolicyd.trust(5), fapolicyd-filter.conf(5), fagenrules(8), and fapolicyd.conf(5)

go read the whole friend group, they're all bangers 💖

---

💜 AUTHOR 💜

Steve Grubb — thank you for your service king 👑

---

okay that's the whole page bestie!! this one's from Red Hat, dated March 2026, and it lives at FAPOLICYD(8). now go enforce some policy, you absolute icon 💅✨🎀