xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-07-31 18:19:40 +00:00
Code Issues Releases Wiki Activity

build(spec): activate the hardened Apache headers on SUSE

Browse Source 
The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).

Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.

Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
This commit is contained in:
Vinícius Ferrão
2026-07-23 17:50:58 -03:00
parent 9261a765bd
commit f6ba29ef80
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT/xCAT.spec
+7
View File
@@ -225,6 +225,13 @@ then
cp /etc/%httpconfigdir/conf.orig/xcat.conf.apach24 /etc/apache2/conf.d/xcat.conf
fi
# On SUSE apache2, mod_headers is not loaded by default; enable it so the
# security response headers in xcat.conf take effect (a no-op where a2enmod
# is absent, e.g. httpd on EL where mod_headers is already loaded).
if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then
a2enmod headers >/dev/null 2>&1 || :
fi
# Let rsyslogd perform close of any open files
if [ -e /var/run/rsyslogd.pid ]; then
kill -HUP $(</var/run/rsyslogd.pid) >/dev/null 2>&1 || :
xCATsn/xCATsn.spec
+7
View File
@@ -169,6 +169,13 @@ if [ -n "$version" ]; then
fi
fi
# On SUSE apache2, mod_headers is not loaded by default; enable it so the
# security response headers in xcat.conf take effect (a no-op where a2enmod
# is absent, e.g. httpd on EL where mod_headers is already loaded).
if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then
a2enmod headers >/dev/null 2>&1 || :
fi
# Let rsyslogd perform close of any open files
if [ -e /var/run/rsyslogd.pid ]; then