Skip to content

docs: fix SELinux policy guidance and add CentOS EOL notices to LAMP/LEMP guides - #209

Open
somethingwithproof wants to merge 2 commits into
Cacti:developfrom
somethingwithproof:fix/selinux-apparmor-centos-eol
Open

docs: fix SELinux policy guidance and add CentOS EOL notices to LAMP/LEMP guides#209
somethingwithproof wants to merge 2 commits into
Cacti:developfrom
somethingwithproof:fix/selinux-apparmor-centos-eol

Conversation

@somethingwithproof

@somethingwithproof somethingwithproof commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

Closes #210
Refs #57

Summary

  • Replace the bare "disable SELinux temporarily" advice in the CentOS LAMP and LEMP install guides with actionable policy steps that let users run with SELinux enforcing:
    • setsebool -P httpd_can_network_connect 1 and httpd_can_network_connect_db 1 (required for DB access and SNMP polling)
    • semanage fcontext / restorecon commands for non-default install paths
  • Fix broken/malformed URL: https:////wiki.centos.org/es/HowTos/SELinux → current RHEL 9 SELinux docs
  • Add CentOS EOL banners to both guides: CentOS 7 EOL June 2024, CentOS 8 EOL December 2021; point users to Rocky Linux / AlmaLinux
  • Rename Install-Under-CentOS_{LAMP,LEMP}.md → Install-Under-RHEL-Compatible_{LAMP,LEMP}.md; update README ToC
  • Replace yum with dnf throughout (yum deprecated in RHEL 8+)
  • Fix Spine build: add missing package install step for RHEL 8+; distinguish powertools (RHEL/Rocky 8) vs crb (RHEL/Rocky 9)
  • Remove innodb_file_format, innodb_large_prefix, innodb_additional_mem_pool_size (removed MySQL 8.0)
  • LEMP nginx: remove TLS 1.0/1.1 (RFC 8996); remove DH+3DES (Sweet32, CVE-2016-2183); add TLS 1.3; enable ssl_prefer_server_ciphers
  • LEMP nginx: uncomment HTTP→HTTPS redirect (was silently a no-op)
  • LEMP: fix cacti.sql import path and poller.php cron path to use /usr/share/nginx/html

Test plan

  • Verify setsebool commands are correct for RHEL 8/9, Rocky 8/9, AlmaLinux 8/9
  • Verify RHEL docs URL resolves
  • Verify EOL dates against https://endoflife.date/centos
  • Verify nginx TLS config is valid for nginx 1.20+

Copilot AI review requested due to automatic review settings March 9, 2026 09:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the CentOS-based LAMP/LEMP installation docs to reflect CentOS Linux EOL status and to provide actionable SELinux steps that allow running Cacti with SELinux enforcing.

Changes:

  • Added CentOS 7/8 EOL notices and guidance to use Rocky Linux/AlmaLinux.
  • Replaced “disable SELinux” guidance with SELinux booleans + file-context (semanage/restorecon) steps and updated the SELinux docs link.
  • Standardized the LEMP SELinux section structure and updated the non-default install-path note to reference the new steps.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
Install-Under-CentOS_LEMP.md Adds EOL banner and replaces SELinux section with enforcing-friendly booleans + fcontext/restorecon guidance.
Install-Under-CentOS_LAMP.md Adds EOL banner, updates SELinux guidance similarly, and links the non-default path note back to the SELinux steps.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread Install-Under-RHEL-Compatible_LEMP.md
Comment thread Install-Under-RHEL-Compatible_LAMP.md
somethingwithproof added a commit to somethingwithproof/documentation that referenced this pull request Mar 10, 2026
Refs Cacti#209

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
@somethingwithproof
somethingwithproof force-pushed the fix/selinux-apparmor-centos-eol branch from 1206ada to 6bd07da Compare March 10, 2026 20:56
Refs Cacti#209

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
@somethingwithproof
somethingwithproof force-pushed the fix/selinux-apparmor-centos-eol branch from 6bd07da to dee6a8f Compare March 15, 2026 05:20
Ubuntu and Debian enable AppArmor but ship no Apache profile by default, so
Apache runs unconfined and the reload commands error out on a stock system.
Gate the section on an Apache profile being present before applying overrides.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
@somethingwithproof

Copy link
Copy Markdown
Contributor Author

Both LAMP and LEMP guides already include the policycoreutils-python-utils prerequisite (dnf install -y policycoreutils-python-utils) before the semanage fcontext step. No further changes needed; resolving.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CentOS LAMP/LEMP guides: SELinux policy incomplete and CentOS is EOL

2 participants