Fapolicyd System Role

This role is only supported on RHEL8.1+/CentOS8.1+ and Fedora distributions. Consider reading fapolicyd documentation before setting it up.

If you want to manage rpm-ostree systems with this role, you will need to install additional collections. Please run the following command line to install the collection.

ansible-galaxy collection install -vv -r meta/collection-requirements.yml

Default true - if set to false the variable makes the service stopped and disabled.

Default rpmdb,file - there can be list of sources for trust option file, rpmdb or deb(if compiled with debian support). The option specifies which sources of trust a loaded and in which order.

Default none - there are four supported types of integrity. No integrity none, defined by size of the file, defined by hash of the file sha256 and defined by hashes of files but generated from ima kernel subsystem. Note that IMA needs to be set up separately and this system role does not cover it.

Default false - if set to true deploys the daemon in permissive mode.

Default [] - it can take list of files that will be marked as trusted.

---
- name: Example fapolicyd role invocation
  hosts: all
  vars:
    fapolicyd_setup_enable_service: true
    fapolicyd_setup_integrity: sha256
    fapolicyd_setup_trust: rpmdb,file
    fapolicyd_add_trusted_file:
      - /etc/passwd
      - /etc/fapolicyd/fapolicyd.conf
      - /etc/krb5.conf
  roles:
    - fapolicyd

See README-ostree.md

MIT

Radovan Sroka @rsroka

Marko Myllynen @myllynen