fapolicyd-hardening: do not block sigkill

bachradsusi · bachradsusi · commit 4c2726089b69 · 2025-11-07T15:15:09.000+01:00
SIGKILL does not cause the system hang.

SIGKILL can't be blocked or ignored by fapolicyd. Also SIGKILL is used
by systemd to forcibly terminate service when they don't stop after
timeout.

Signed-off-by: Petr Lautrbach &lt;lautrbach@redhat.com&gt;
diff --git a/fapolicyd-hardening.cil b/fapolicyd-hardening.cil
@@ -1,4 +1,4 @@
 (optional fapolicyd_hardening_optional
     (typeattributeset cil_gen_require fapolicyd_t)
-    (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )
+    (deny domain fapolicyd_t ( process ( ptrace sigstop ) ) )
 )

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`	`1`	`(optional fapolicyd_hardening_optional`
`2`	`2`	`(typeattributeset cil_gen_require fapolicyd_t)`
`3`		`- (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )`
	`3`	`+ (deny domain fapolicyd_t ( process ( ptrace sigstop ) ) )`
`4`	`4`	`)`