documentation_complete: true


title: 'Enable the File Access Policy Service'

description: |-
    The File Access Policy service should be enabled.
    {{{ describe_service_enable(service="fapolicyd") }}}

rationale: |-
    The <tt>fapolicyd</tt> service (File Access Policy Daemon)
    implements application whitelisting to decide file access rights.

severity: medium

identifiers:
    cce@rhcos4: CCE-82534-9
    cce@rhel8: CCE-82249-4
    cce@rhel9: CCE-84227-8
    cce@rhel10: CCE-88147-4

references:
    nist: CM-6(a),SI-4(22)
    ospp: FMT_SMF_EXT.1
    srg: SRG-OS-000370-GPOS-00155,SRG-OS-000368-GPOS-00154,SRG-OS-000480-GPOS-00230
    stigid@ol8: OL08-00-040136

ocil_clause: 'the service is not enabled'

ocil: |-
    {{{ ocil_service_enabled(service="fapolicyd") }}}

fixtext: |-
    {{{ fixtext_service_enabled("fapolicyd") }}}

srg_requirement: '{{{ srg_requirement_service_enabled(service="fapolicyd") }}}'

template:
    name: service_enabled
    vars:
        servicename: fapolicyd
