From f6ba29ef80173f8d7a3bfc2a9d00fe71b9197590 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?= <2031761+viniciusferrao@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:50:58 -0300 Subject: [PATCH] build(spec): activate the hardened Apache headers on SUSE The security response headers added to xcat.conf are wrapped in , so they only take effect where mod_headers is loaded. EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE apache2 does not load it by default, so the headers stayed inactive there. Enable it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where a2enmod is absent and mod_headers is already loaded). Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened config still starts, and after a2enmod the served response carries all four security headers. The need to load mod_headers on SUSE was identified in the lenovobuild branch (660df81379ce / xcat.conf.apach24.sles), here done via a2enmod rather than a separate config file. Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com> --- xCAT/xCAT.spec | 7 +++++++ xCATsn/xCATsn.spec | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec index 57031a8b5..93fc46571 100644 --- a/xCAT/xCAT.spec +++ b/xCAT/xCAT.spec @@ -225,6 +225,13 @@ then cp /etc/%httpconfigdir/conf.orig/xcat.conf.apach24 /etc/apache2/conf.d/xcat.conf fi +# On SUSE apache2, mod_headers is not loaded by default; enable it so the +# security response headers in xcat.conf take effect (a no-op where a2enmod +# is absent, e.g. httpd on EL where mod_headers is already loaded). +if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then + a2enmod headers >/dev/null 2>&1 || : +fi + # Let rsyslogd perform close of any open files if [ -e /var/run/rsyslogd.pid ]; then kill -HUP $(/dev/null 2>&1 || : diff --git a/xCATsn/xCATsn.spec b/xCATsn/xCATsn.spec index c69e43643..9735e958c 100644 --- a/xCATsn/xCATsn.spec +++ b/xCATsn/xCATsn.spec @@ -169,6 +169,13 @@ if [ -n "$version" ]; then fi fi +# On SUSE apache2, mod_headers is not loaded by default; enable it so the +# security response headers in xcat.conf take effect (a no-op where a2enmod +# is absent, e.g. httpd on EL where mod_headers is already loaded). +if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then + a2enmod headers >/dev/null 2>&1 || : +fi + # Let rsyslogd perform close of any open files if [ -e /var/run/rsyslogd.pid ]; then