From 4c82e02a7bce820b38d0f1a10c3f58cce5c610ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 27 Jul 2026 16:45:52 -0300
Subject: [PATCH] fix(httpd): reload hardened config after RPM upgrades

---
 xCAT/xCAT.spec | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec
index 93fc46571..4e563a876 100644
--- a/xCAT/xCAT.spec
+++ b/xCAT/xCAT.spec
@@ -265,6 +265,26 @@ fi
 mkdir -p /var/log/xcat
 date >> /var/log/xcat/upgrade.log
 $RPM_INSTALL_PREFIX0/sbin/xcatconfig -u -V >> /var/log/xcat/upgrade.log 2>&1
+
+# The package replaces xcat.conf before this upgrade path runs.  Reload an
+# active web server so the new security headers and ServerTokens setting take
+# effect immediately, but do not try to manage services while building an
+# image in a chroot.
+if [ -f "/proc/cmdline" ] && [ "x$(stat -c '%i %d' /)" == "x$(stat -c '%i %d' /proc/1/root/. 2>/dev/null)" ]; then
+    if [ -e "/etc/redhat-release" ]; then
+        apachedaemon='httpd'
+    else
+        apachedaemon='apache2'
+    fi
+
+    if command -v systemctl >/dev/null 2>&1; then
+        if systemctl is-active --quiet "$apachedaemon"; then
+            systemctl reload "$apachedaemon" >/dev/null 2>&1 || :
+        fi
+    elif [ -x "/etc/init.d/$apachedaemon" ]; then
+        /etc/init.d/$apachedaemon reload >/dev/null 2>&1 || :
+    fi
+fi
 fi
 exit 0