-
Bug
-
Resolution: Done
-
Major
-
None
-
None
I noticed two things about the mod_cluster-native selinux configuration:
1) The command (semanage fcontext -a -t httpd_cache_t '/var/cache/mod_cluster(/.*)?') is redundant in that it is covered by the system's policy for httpd. On a default system we can see the mod_* is defined like the following:
# semanage fcontext -l | grep /var/cache/mod | head -n1 /var/cache/mod_.* all files system_u:object_r:httpd_cache_t:s0
This means that a simple restorecon on the directory at install time would correctly set the context.
2) After fixing JBCS-167, I noticed that removing the mod_cluster policy does not reset the /opt/rh/jbcs-httpd24/root/var/cache/mod_cluster directory's context because it was manually added. Adding the fcontext setting to a mod_cluster.fc file and generating a policy based on it would fix that, then we could remove the fcontext addition from the spec.