[rpms/caddy] rawhide: Add SELinux file context httpd_log_t for Caddy log directory

[rpms/caddy] rawhide: Add SELinux file context httpd_log_t for Caddy log directory

[@ 2026-07-02 18:15 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/caddy
            Branch : rawhide
            Commit : 9ed1414f6036fe54d31af6286327b45929230deb
            Author : Rénich Bon Ćirić <renich@woralelandia.com>
            Date   : 2026-07-02T10:15:49-06:00
            Stats  : +3/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/caddy/c/9ed1414f6036fe54d31af6286327b45929230deb?branch=rawhide

            Log:
            Add SELinux file context httpd_log_t for Caddy log directory

When custom file-based logging is configured under /var/log/caddy, the caddy service fails to start with a permission denied error in SELinux-enforcing mode. This is because caddy runs in the httpd_t domain but the log directory defaults to the var_log_t label.

This patch registers the file context /var/log/caddy(/.*)? as httpd_log_t in the SELinux database upon package installation and removes it upon uninstall.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>
Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

---
diff --git a/caddy.spec b/caddy.spec
index c9a89eb..64fde99 100644
--- a/caddy.spec
+++ b/caddy.spec
@@ -127,7 +127,8 @@ if [ -x /usr/sbin/semanage -a -x /usr/sbin/restorecon ]; then
     semanage fcontext --add --type httpd_sys_content_t '%{_datadir}/caddy(/.*)?'        2> /dev/null || :
     semanage fcontext --add --type httpd_config_t      '%{_sysconfdir}/caddy(/.*)?'     2> /dev/null || :
     semanage fcontext --add --type httpd_var_lib_t     '%{_sharedstatedir}/caddy(/.*)?' 2> /dev/null || :
-    restorecon -r %{_bindir}/caddy %{_datadir}/caddy %{_sysconfdir}/caddy %{_sharedstatedir}/caddy || :
+    semanage fcontext --add --type httpd_log_t         '%{_localstatedir}/log/caddy(/.*)?' 2> /dev/null || :
+    restorecon -r %{_bindir}/caddy %{_datadir}/caddy %{_sysconfdir}/caddy %{_sharedstatedir}/caddy %{_localstatedir}/log/caddy || :
 fi
 if [ -x /usr/sbin/semanage ]; then
     # QUIC
@@ -156,6 +157,7 @@ if [ $1 -eq 0 ]; then
         semanage fcontext --delete --type httpd_sys_content_t '%{_datadir}/caddy(/.*)?'        2> /dev/null || :
         semanage fcontext --delete --type httpd_config_t      '%{_sysconfdir}/caddy(/.*)?'     2> /dev/null || :
         semanage fcontext --delete --type httpd_var_lib_t     '%{_sharedstatedir}/caddy(/.*)?' 2> /dev/null || :
+        semanage fcontext --delete --type httpd_log_t         '%{_localstatedir}/log/caddy(/.*)?' 2> /dev/null || :
         # QUIC
         semanage port     --delete --type http_port_t --proto udp 80   2> /dev/null || :
         semanage port     --delete --type http_port_t --proto udp 443  2> /dev/null || :