Enable the File Access Policy Service

Description

The File Access Policy service should be enabled. The fapolicyd service can be enabled with the following manifest:

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-fapolicyd-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: fapolicyd.service
        enabled: true

This will enable the fapolicyd service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

Rationale

The fapolicyd service (File Access Policy Daemon) implements application whitelisting to decide file access rights.