fapolicyd with Mattermost

repro.md

Summary

This will guide you in setting up fapolicyd to work with the mattermost binary, and how to setup a system with fapolicyd enabled.

You can find the official RHEL guide here under chapter 15.4.

Repro Steps

1. Install Mattermost on a rhel 8 box
2. Install fapolicyd with sudo yum install fapolicyd. Then start it with systemctl start fapolicyd
3. Add a rules file for Mattermost
   • sudo touch /etc/fapolicyd/rules.d/80-mattermost.rules
   • sudo nano /etc/fapolicyd/rules.d/80-mattermost.rules
4. Add some rules for Mattermost.

   allow perm=execute exe=/user/bin/sudo trust=1 : dir=/opt/mattermost/ all trust=0
   allow perm=execute exe=/user/lib/systemd/systemd trust=1 : dir=/opt/mattermost/ all trust=0
   

5. Check the rules took and add them

   sudo fagenrules --check
   /usr/sbin/fagenrules: Rules have changed and should be updated
   sudo fagenrules --load
   

6. At this stage you should be able to start Mattermost like normal, the plugins will fail.

Setup guide.md

Summary

You are trying to use Mattermost and have fapolicyd enabled and want them to play nicely.

Steps

1. Create a rule file The naming convention for your rule is really important here. It must come before the rule that's denying Mattermost. If you're using a stock fapolicyd then 80 works fine. You can check the deny rule with the troubleshooting steps.

sudo touch /etc/fapolicyd/rules.d/80-mattermost.rules

2. Add the permissions into to the rule file.

sudo vi /etc/fapolicyd/rules.d/80-mattermost.rules

Rule File:

allow perm=execute exe=/user/bin/sudo trust=1 : dir=/opt/mattermost/ all trust=0
allow perm=execute exe=/opt/mattermost/bin/mattermost : dir=/opt/mattermost all trust=0
allow perm=execute exe=/user/lib/systemd/systemd trust=1 : dir=/opt/mattermost/ all trust=0

3. Check the rules will be applied

This command should say Ruels have changed and should be updated

sudo fagenrules --check

4. Update the rules

sudo fagenrules --load

5. Now restart mattermost.

troubleshooting.md

Summary

If Mattermost or the plugin binaries cannot start, you can troubleshoot this with the below steps.

Additional troubleshooting steps can be found on the RHEL docs here

Troubleshooting

1. Stop fapolicyd

   sudo systemctl stop fapolicyd
   

2. Test your issue with Mattermost right now. Was it fixed? Then continue onward.
3. Run the debug command

   sudo fapolicyd --debug
   

4. Look for any denies. You can store the above in a file, but it kept yelling at me so i didn't.

   rule=15 dec=deny_audit perm=execute auid=-1 pid=19735 exe=/opt/mattermost/bin/mattermost : path=/opt/mattermost/plugins/focalboard/server/dist/plugin-linux-amd64 ftype=application/x-executable trust=0