Description of problem:

When file is deleted from fapolicyd.trust file, the operation is still permitted. 



Version-Release number of selected component (if applicable):
fapolicyd-1.0-3.el8.x86_64

How reproducible:

1. Add the rule 

2. Check operation if it works

3. Delete the rule

4. Check operation if it works, this should fail, but this works. 

Steps to Reproduce:

1. When copied binary to /tmp, it failed without rule. 

$ /tmp/pwd
-bash: /tmp/pwd: Operation not permitted

2. Then added rule to allow this file

# fapolicyd-cli --file add /tmp/pwd

Then it was allowed to be executed

# su - ravindra
$ /tmp/pwd
/home/ravindra

3. However, even after removing the rule, the command execution was allowed. 

# fapolicyd-cli --file delete /tmp/pwd

The rule was removed from the trust file. 

# cat /etc/fapolicyd/fapolicyd.trust 
# This file contains a list of trusted files
#
#  FULL PATH        SIZE                             SHA256
# /home/user/my-ls 157984 61a9960bf7d255a85811f4afcac51067b8f2e4c75e21cf4f2af95319d4ed1b87
/tmp/ls 143368 b97ce5f98f000af846d298a103daca75eddd5a2681a728d83a3dc0392e649707
/tmp/scp 105416 3a436895da8a2f20fe9688fd25ed8068cf86ef3902481f9d5fa93816022a9952

But still the execution was permitted. Restart of the service did not help. 

# su - ravindra

$ /tmp/pwd
/home/ravindra

This should have failed, as the respective rule has been removed from the file or deleted through fapolicyd-cli command. 

Actual results:

Operation is permitted even after deleting the rule. 

# fapolicyd-cli --file delete /tmp/pwd

Expected results:

Operation should not be permitted

$ /tmp/pwd
-bash: /tmp/pwd: Operation not permitted

Additional info:

Red Hat documentation link 

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_blocking-and-allowing-applications-using-fapolicyd_security-hardening#introduction-to-fapolicyd_assembly_blocking-and-allowing-applications-using-fapolicyd