0a062cd664
By default, SELinux prevents HAProxy context (haproxy_t) to execute
shell context (shell_exec_t) for security reasons.
This prevents HAProxy to actually reload properly, since SELinux will
deny its call to a shell to save its state to a file.
In order to avoid opening a potential security hole in the load-balancer
image, the best way is to generate the state file before the actual
reload.
There are more details about the SELinux denials in the associated Red
Hat Bugzilla.
Resolves: rhbz#2073491
Change-Id: I6b9a5e1e3bafe77ad9f9506b8c0995d8c2a00081
(cherry picked from commit 21d74c373b)
7 lines
190 B
YAML
7 lines
190 B
YAML
---
|
|
issues:
|
|
- |
|
|
When using a distribution with a recent SELinux release such as CentOS 8
|
|
Stream, PING health-monitor does not work as shell_exec_t calls are denied
|
|
by SELinux.
|