Red Hat Bugzilla – Bug 829025
Example config in mod_jk does not work / is non-standard
Last modified: 2016-10-30 18:57:43 EDT
Description of problem:
mod_jk package by default includes an example configuration file (mod_jk.conf.sample) which specifies cache should be stored in /var/log. This is not ideal (use /var/cache ?) and does not work with a SELinux enforcing policy.
Version-Release number of selected component (if applicable):
RHEL 6.2 with mod_jk-ap20-1.2.31-1.1.2
Install the default package.
No config file is supplied.
The example config file is supplied with improper/non-standard values.
Steps to Reproduce:
1. yum install mod_jk
2. cp /usr/share/doc/mod_jk-ap20-1.2.31/mod_jk.conf.sample /etc/httpd/conf.d/mod_jk.conf
3. service restart httpd
SELinux denials if default (enforcing) policy is set, cache is written to /var/log/httpd.
SELinux labels/attributes are properly set on packaged content, cache is written to a non-log directory (eg /var/cache/mod_jk/ perhaps ?) and we deploy a working & tested example config.
Example config fix:
Deploy config as /etc/httpd/conf.d/mod_jk.conf
Label JkShmFile parent directory (/var/cache/mod_jk in example) as httpd_cache_t (?)
QA Ack granted, really small change
@Risar I think SELinux is supported for EWS 2.x only, not aware of any promise for EAP 6.x
Setting proper components and resetting owner and and contact
John, do we support SELinux in EAP? If so, who is our contact?
We'll need some expertise to set up SELinux policy file besides changing that location of the file.
We have not created am SELinux policy for EAP. Users are free to create a policy but they own the policy. GSS can assist them with creation of the policy. If we're going to change the default configuration, we should not do it in a minor release.
1. mod_jk.conf.sample should stay as sample
2. I'm fine with changing default location for jk.shm file
Users usually use .sample conf as a base for their config, changing what they
think needs to be changed leaving everything else intact so enforcing a new default shm file location is probably a good thing.
I'm going to update the setting for JkShmFile in the sample to /var/cache/mod_jk/jk.shm, and create the /var/cache/mod_jk in the rpm, but keeping the sample as it is, not deployed by default. This change will only be applied to RHEL RPMs as there's no SELinux on other platform.
mod_jk-1.2.37-4.redhat_3.ep6.el5 and mod_jk-1.2.37-4.redhat_3.ep6.el6 are built, jboss-eap-native-webserver-connectors updated on RHEL as well.
Will be in ER7.
Marking this as ON_QA as this is fixed in ER7.
Cool in EAP 6.2.0.ER7 rpms :-)