diff -urp fapolicyd-0.9.5.orig/doc/fapolicyd.conf.5 fapolicyd-0.9.5/doc/fapolicyd.conf.5

--- fapolicyd-0.9.5.orig/doc/fapolicyd.conf.5	2020-05-22 10:03:14.000000000 -0400

+++ fapolicyd-0.9.5/doc/fapolicyd.conf.5	2020-05-22 10:04:32.583100229 -0400

@@ -55,26 +55,6 @@ This is a comma separated list of file s

 This is a comma separated list of trust back-ends. If this is not configured, rpmdb is default. Fapolicyd supports \fBfile\fP back-end that reads content of /etc/fapolicyd/fapolicyd.trust and use it as a list of trusted files. The second option is \fBrpmdb\fP backend that generates list of trusted files from rpmdb.

 .TP

-.B integrity

-This option tells fapolicyd which integrity strategy it should use. It can be one of 4 values:

-.RS

-.TP 12

-.B none

-This is the

-.IR default

-and does no integrity checking.

-.TP

-.B size

-Selecting this option will compare the size of the file with what it was knows to be. This is better than nothing and very fast since fapolicyd already collects size information during normal processing. However, an attacker could replace the file and as long as the size matches, it will not be detected.

-.TP

-.B ima

-Selecting this option will use a SHA256 hash that the IMA subsystem places in a file's extended attributes in addition to the size check. This means that all file systems holding executable code must support extended attributes.

-.RE

-.TP

-.B sha256

-Selecting this option will calculate a SHA256 hash by cryptographic means. A size check will also be performed.

-

-.TP

 .B syslog_format

 This option controls how the output from the access decision is formatted. The format is a comma separated list of subject and object names from the rules. It does not allow the keyword "all". It also allows for rule, dec, and perm. The format must include a semi-colon to deliniate subject from object keywords. The typical use is to place information about the access decision, then subject information, a colon, and the object information. Also note that the more things being logged, the more it will impact system performance. Also, the event written is limited to 512 bytes.

diff -urp fapolicyd-0.9.5.orig/init/fapolicyd.conf fapolicyd-0.9.5/init/fapolicyd.conf

--- fapolicyd-0.9.5.orig/init/fapolicyd.conf	2020-05-22 10:03:14.000000000 -0400

+++ fapolicyd-0.9.5/init/fapolicyd.conf	2020-05-22 10:04:46.801098703 -0400

@@ -15,5 +15,4 @@ subj_cache_size = 1549

 obj_cache_size = 8191

 watch_fs = ext2,ext3,ext4,tmpfs,xfs,vfat,iso9660

 trust = rpmdb,file

-integrity = none

 syslog_format = rule,dec,perm,auid,pid,exe,:,path,ftype

diff -urp fapolicyd-0.9.5.orig/src/daemon/daemon-config.c fapolicyd-0.9.5/src/daemon/daemon-config.c

--- fapolicyd-0.9.5.orig/src/daemon/daemon-config.c	2020-05-22 10:03:14.000000000 -0400

+++ fapolicyd-0.9.5/src/daemon/daemon-config.c	2020-05-22 10:05:35.103093520 -0400

@@ -538,9 +538,9 @@ static int trust_parser(const struct nv_

 static const struct nv_list integrity_schemes[] =

 {

   {"none",   IN_NONE   },

-  {"size",   IN_SIZE   },

+/*  {"size",   IN_SIZE   },

   {"ima",    IN_IMA    },

-  {"sha256", IN_SHA256 },

+  {"sha256", IN_SHA256 }, */

   { NULL,  0 }

 };