why can't I see fapolicyd rke2 rules? Are there any measures taken to protect nodes by default in Rke2? If so, how can I check these measures?

[cengizhanR]

There is a file called rke2-uninstall.sh fapolicyd, but this file is not available in my rke2 cluster. Some rules are mentioned there, such as 80-rke2.rules. Is it because there's something wrong with my installation that I can't see this file?
Are there any measures taken to protect nodes by default in Rke2? If so, how can I check these measures?

uninstall_remove_files()
{

    if [ -r /etc/redhat-release ] || [ -r /etc/centos-release ] || [ -r /etc/oracle-release ] || [ -r /etc/amazon-linux-release ]; then
        yum remove -y "rke2-*"

        rm -f /etc/yum.repos.d/rancher-rke2*.repo
    fi

    if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
         if rpm -q rke2-common >/dev/null 2>&1; then
            # rke2 rpm detected
            uninstall_cmd="zypper remove -y rke2-server rke2-agent rke2-common rke2-selinux"
            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
                uninstall_cmd="transactional-update -c --no-selfupdate -d run $uninstall_cmd"
            fi
            $uninstall_cmd
            rm -f /etc/zypp/repos.d/rancher-rke2*.repo
         fi
    fi

    $transactional_update find "${INSTALL_RKE2_ROOT}/lib/systemd/system" -name rke2-*.service -type f -delete
    $transactional_update find "${INSTALL_RKE2_ROOT}/lib/systemd/system" -name rke2-*.env -type f -delete
    find /etc/systemd/system -name rke2-*.service -type f -delete
    $transactional_update rm -f "${INSTALL_RKE2_ROOT}/bin/rke2"
    $transactional_update rm -f "${INSTALL_RKE2_ROOT}/bin/rke2-killall.sh"
    $transactional_update rm -rf "${INSTALL_RKE2_ROOT}/share/rke2"
    rm -rf /etc/rancher/rke2
    rm -rf /etc/rancher/node
    rm -d /etc/rancher || true
    rm -rf /etc/cni
    rm -rf /opt/cni/bin
    rm -rf /var/lib/kubelet || true
    rm -rf /var/lib/rancher/rke2
    rm -d /var/lib/rancher || true

    **if type fapolicyd >/dev/null 2>&1; then
        if [ -f /etc/fapolicyd/rules.d/80-rke2.rules ]; then
            rm -f /etc/fapolicyd/rules.d/80-rke2.rules
        fi
        fagenrules --load
        systemctl restart fapolicyd
    fi**
}

[brandond]

There is a file called rke2-uninstall.sh fapolicyd

You should have a copy of the uninstall script (rke2-uninstall.sh) on your host. If you don't, then I'm not sure how you installed RKE2 - as it should be provided by both the tarball and RPM installs.

If you installed RKE2 recently, the install script would have created /etc/fapolicyd/rules.d/80-rke2.rules for you as well. If you're missing the uninstall script then I'm not surprised you're missing other files as well. Its also possible you installed RKE2 before we added fapolicyd support.

[cengizhanR]

@brandond Should I install sudo yum install fapolicyd -y ?

#4803

[cengizhanR]

This is my Rhel packets for RKE2.

yum install -y iptables container-selinux libnetfilter_conntrack libnfnetlink libnftnl policycoreutils-python-utils cryptsetup
yum install -y nfs-utils iscsi-initiator-utils; yum install -y zip zstd tree jq
### Modify Settings
echo "InitiatorName=$(/sbin/iscsi-iname)" > /etc/iscsi/initiatorname.iscsi && systemctl enable --now iscsid
systemctl stop firewalld; systemctl disable firewalld; systemctl stop nm-cloud-setup; systemctl disable nm-cloud-setup; systemctl stop nm-cloud-setup.timer; systemctl disable nm-cloud-setup.timer
echo -e "[keyfile]\nunmanaged-devices=interface-name:cali*;interface-name:flannel*" > /etc/NetworkManager/conf.d/rke2-canal.conf

[cengizhanR]

This is for master config.yaml

[root@rke21 kubelet]# cat /etc/rancher/rke2/config.yaml

system-default-registry: 10.0.0.10:5000
secrets-encryption: true
token: fuzzybunnyslippers
tls-san:
  - rancher.exemple.com
node-ip: "10.0.0.2"
etcd-expose-metrics: true
write-kubeconfig-mode: "0600"
use-service-account-credentials: true
kube-controller-manager-arg:
- bind-address=127.0.0.1
- use-service-account-credentials=true
- tls-min-version=VersionTLS12
- tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
kube-scheduler-arg:
- tls-min-version=VersionTLS12
- tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
kube-apiserver-arg:
- tls-min-version=VersionTLS12
- tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- authorization-mode=RBAC,Node
- anonymous-auth=false
- audit-policy-file=/etc/rancher/rke2/audit-policy.yaml
- audit-log-mode=blocking-strict
- audit-log-maxage=30
- audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log
kubelet-arg:
- protect-kernel-defaults=true
- read-only-port=0
- authorization-mode=Webhook
- streaming-connection-idle-timeout=5m
- minimum-container-ttl-duration=10s
- maximum-dead-containers-per-container=2
- maximum-dead-containers=240
- image-gc-high-threshold=85
- image-gc-low-threshold=80

[brandond]

Did you run the install script after #4249 was merged? Do you have the fapolicyd and fagenrules executables, and is the fapolicyd service is running? If the answer to any of those questions is no, then you won't have the rules.

[cengizhanR]

Thank you so much.