Compile HTTPD so it's SELinux Aware

[Phil Meyer]

On 07/11/2010 07:21 PM, Jafaruddin Lie wrote:
> Hi guys
> We're thinking of compiling our own version of jailed Apache's httpd
> on CENTOS 5.
> Currently we don't have SELinux turned on, but we are building a new
> server and would like to implement it.
> I am familiar enough with setting the policies for the RPM version of
> httpd, so my question is for the ones that we are going to compile,
> what do I need to do on the compile to make it SELinux aware, and how
> do I apply the policies to that particular instance?
>
> There would be several different versions of jailed httpd instances
> running on different ports.
>
>    

It may be easiest to:

$ yumdownloader --source httpd
$ rpm -ihv httpd*.rpm
$ cd ~/rpmbuild/SPECS
$ vim httpd.spec
     %% modify to suit, or
$ rpmbuild -bp httpd.spec
$ cd ../BUILD/httpd*
     %% modify to suit, create patches, and place patches in 
~/rpmbuild/SOURCES
$ cd ~/rpmbuild/SPECS
$ vim httpd.spec
      %% add your patches to the list
$ rpmbuild -ba httpd.spec

Now you can distribute your version of the rpm to the hosts that need it.

This is much cleaner than doing a make install, because you can easily 
update the rpm, and you can play games with the versioning such that it 
may or may not update with yum.

There may come a time when the Centos distributed rpm now contains the 
mods you were after in the first place.

Also, you may submit your patches upstream.  Who knows, maybe lots of 
people want your mods as well.

Good Luck!