{"id":19859,"date":"2021-07-19T13:24:36","date_gmt":"2021-07-19T11:24:36","guid":{"rendered":"https:\/\/orcharhino.com\/interesting-selinux-issue-with-post-install-script-in-spec-file-2\/"},"modified":"2026-07-27T15:45:06","modified_gmt":"2026-07-27T13:45:06","slug":"interesting-selinux-issue-with-post-install-script-in-spec-file","status":"publish","type":"post","link":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/","title":{"rendered":"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file"},"content":{"rendered":"\n

My task was pretty straightforward: allow users to download the orcharhino documentation from their orcharhino server.
Right now, we\u2019re providing the documentation on each instance at FQDN\/or_doc.
As we\u2019ve dropped the .pdf support, we want to provide a .zip archive of the html version documentation at FQDN\/pub\/orcharhino_documentation.zip for users to download.<\/p>\n\n\n\n

Easy.
Let\u2019s amend the .spec file as follows:<\/p>\n\n\n\n

%post              <\/code>
mkdir -p \/var\/www\/html\/pub\/<\/code>
pushd \/usr\/share\/doc\/%{name}\/html\/<\/code>
zip --recurse-paths \/var\/www\/html\/pub\/orcharhino_documentation.zip .<\/code>
popd<\/code>
<\/code><\/code><\/pre>\n\n\n\n
\n
<\/div>\n\n\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"img_whitepaper_digital_sovereignty\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Who controls your IT – you or your dependencies?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Read the free white paper to find out how to identify critical dependencies, make your infrastructure resilient and regain full control over operations, updates and automation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Download whitepaper now<\/strong><\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n\n\n\n
<\/div>\n<\/div>\n\n\n\n
Side note: the pushd and popd is necessary because zip does not play nicely with \u2013recurse-paths and \u2013junk-paths together to prevent having the directory structure \/usr\/share\/doc\/%{name}\/html in the zip archive.
mkdir and rm are necessary as I don\u2019t know at which stage of the orcharhino installation process the documentation RPM package is actually installed and to make it upgrade safe.<\/p>\n\n\n\n
This will work, surely.
But does it?<\/p>\n\n\n\n
Navigating to my test deployment, I see there is no orcharhino_documentation.zip in \/pub.
I ssh into the orcharhino server, cd to \/var\/www\/html\/pub which is symlinked to \/pub , run ls -l et voil\u00e0:<\/p>\n\n\n\n
-rw-r--r--. 1 apache apache 104091 Mar 1 08:49 bootstrap.py<\/code>
-rw-r--r--. 2 apache apache 93821 Mar 1 08:49 bootstrap.pyc           <\/code>
-rw-r--r--. 2 apache apache 93821 Mar 1 08:49 bootstrap.pyo<\/code>
lrwxrwxrwx. 1 root root 74 Mar 1 11:47 katello-ca-consumer-latest.noarch.rpm -> \/var\/<\/code>
-rw-r--r--. 1 root root 8873 Mar 1 11:47 katello-ca-consumer- <\/code><\/code>                                                                                             orcharhino.example.com-1.0-1.noarch.rpm<\/code>
-rw-r--r--. 1 root root 9324 Mar 1 11:47 katello-ca-consumer-                                                                                               orcharhino.example.com-1.0-1.src.rpm<\/code>
-rwxr-xr-x. 1 root root 21761 Mar 1 11:47 katello-rhsm-consumer<\/code>
-rw-r--r--. 1 root root 8123 Mar 1 11:45 katello-server-ca.crt<\/code>
-rw-r--r--. 1 root root 32720742 Mar 1 15:55 orcharhino_documentation.zip<\/code>
-rw-r--r--. 1 root root 1670 Mar 1 12:10 pulp_deb_signing.key<\/code><\/code><\/pre>\n\n\n\n
To my surprise, the file is<\/em> there.<\/p>\n\n\n\n
I stare at the ls output for a good 20 minutes.
How can I see this file here, but neither in the browser nor using wget?<\/p>\n\n\n\n
I ask a colleague and we stare at it some more, probably longer than we\u2019re both comfortable to admit.
My colleague searches the httpd config files, I reload the page in my browser over and over and tail -f the various httpd log files.<\/p>\n\n\n\n
tail -f \/var\/log\/httpd\/foreman_error.log finally brings some light into the darkness:<\/p>\n\n\n\n
[Mon Mar 01 16:29:06.561442 2021] [core:error] [pid 16455] (13)Permission denied: [client<\/code>
12.34.56.78:52509] AH00035: access to \/pub\/orcharhino_documentation.zip denied (filesystem path '\/<\/code>
var\/www\/html\/pub\/orcharhino_documentation.zip') because search permissions are missing on a<\/code>
component of the path<\/code><\/code><\/pre>\n\n\n\n
something something BECAUSE PERMISSIONS<\/p>\n\n\n\n
Using my favourite search engine, I quickly discover that it\u2019s an SELinux issue.
From what I understand, SELinux limited access to the \/var\/www\/html\/pub\/orcharhino_documentation.zip  archive due to a missing SELinux context.
Running a simple restorecon orcharhino_documentation.zip restores the SELinux context and fixes my problem.<\/p>\n\n\n\n
I add this to the .spec file and restart the test deployment.<\/p>\n\n\n\n
hashtag surprises during \u201etrivial\u201c tickets and orcharhino development<\/p>\n","protected":false},"excerpt":{"rendered":"
My task was pretty straightforward: allow users to download the orcharhino documentation from their orcharhino server.Right now, we\u2019re providing the documentation on each instance at FQDN\/or_doc.As we\u2019ve dropped the .pdf support, we want to provide a .zip archive of the html version documentation at FQDN\/pub\/orcharhino_documentation.zip for users to download. Easy.Let\u2019s amend the .spec file as follows: Side note: the pushd and popd is necessary because zip does not play nicely with \u2013recurse-paths and \u2013junk-paths together to prevent having […]<\/p>\n","protected":false},"author":1095,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[104],"tags":[],"pillars":[],"rolle":[],"use-case-kategorie":[],"class_list":["post-19859","post","type-post","status-publish","format-standard","hentry","category-blog-en"],"acf":[],"yoast_head":"\nSELinux Permission Denied in RPM %post Script - orcharhino<\/title>\n<meta name=\"description\" content=\"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file\" \/>\n<meta property=\"og:description\" content=\"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/\" \/>\n<meta property=\"og:site_name\" content=\"orcharhino\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ATIXDE\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-19T11:24:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-27T13:45:06+00:00\" \/>\n<meta name=\"author\" content=\"Dev Medienstuermer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@orcharhino\" \/>\n<meta name=\"twitter:site\" content=\"@orcharhino\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dev Medienstuermer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/\"},\"author\":{\"name\":\"Dev Medienstuermer\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#\\\/schema\\\/person\\\/7d02c0c1f109e932aec93630ecf98238\"},\"headline\":\"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file\",\"datePublished\":\"2021-07-19T11:24:36+00:00\",\"dateModified\":\"2026-07-27T13:45:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/\"},\"wordCount\":417,\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/\",\"name\":\"SELinux Permission Denied in RPM %post Script - orcharhino\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#website\"},\"datePublished\":\"2021-07-19T11:24:36+00:00\",\"dateModified\":\"2026-07-27T13:45:06+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#\\\/schema\\\/person\\\/7d02c0c1f109e932aec93630ecf98238\"},\"description\":\"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/resources\\\/blog\\\/interesting-selinux-issue-with-post-install-script-in-spec-file\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Start\",\"item\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/\",\"name\":\"orcharhino\",\"description\":\"one tool to rule them all\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/#\\\/schema\\\/person\\\/7d02c0c1f109e932aec93630ecf98238\",\"name\":\"Dev Medienstuermer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g\",\"caption\":\"Dev Medienstuermer\"},\"url\":\"https:\\\/\\\/orcharhino.com\\\/en\\\/ressourcen\\\/blog\\\/author\\\/dev\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SELinux Permission Denied in RPM %post Script - orcharhino","description":"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/","og_locale":"en_US","og_type":"article","og_title":"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file","og_description":"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.","og_url":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/","og_site_name":"orcharhino","article_publisher":"https:\/\/www.facebook.com\/ATIXDE\/","article_published_time":"2021-07-19T11:24:36+00:00","article_modified_time":"2026-07-27T13:45:06+00:00","author":"Dev Medienstuermer","twitter_card":"summary_large_image","twitter_creator":"@orcharhino","twitter_site":"@orcharhino","twitter_misc":{"Written by":"Dev Medienstuermer","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/#article","isPartOf":{"@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/"},"author":{"name":"Dev Medienstuermer","@id":"https:\/\/orcharhino.com\/en\/#\/schema\/person\/7d02c0c1f109e932aec93630ecf98238"},"headline":"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file","datePublished":"2021-07-19T11:24:36+00:00","dateModified":"2026-07-27T13:45:06+00:00","mainEntityOfPage":{"@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/"},"wordCount":417,"articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/","url":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/","name":"SELinux Permission Denied in RPM %post Script - orcharhino","isPartOf":{"@id":"https:\/\/orcharhino.com\/en\/#website"},"datePublished":"2021-07-19T11:24:36+00:00","dateModified":"2026-07-27T13:45:06+00:00","author":{"@id":"https:\/\/orcharhino.com\/en\/#\/schema\/person\/7d02c0c1f109e932aec93630ecf98238"},"description":"An RPM %post script created the file, but Apache still returned Permission denied. See how a missing SELinux context caused it and how restorecon fixes it.","breadcrumb":{"@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/orcharhino.com\/en\/resources\/blog\/interesting-selinux-issue-with-post-install-script-in-spec-file\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Start","item":"https:\/\/orcharhino.com\/en\/"},{"@type":"ListItem","position":2,"name":"\u201einteresting\u201c SELinux issue with post install script in \u2018.spec\u2019 file"}]},{"@type":"WebSite","@id":"https:\/\/orcharhino.com\/en\/#website","url":"https:\/\/orcharhino.com\/en\/","name":"orcharhino","description":"one tool to rule them all","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/orcharhino.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/orcharhino.com\/en\/#\/schema\/person\/7d02c0c1f109e932aec93630ecf98238","name":"Dev Medienstuermer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a23619ea28283064311a0d1fe283044ac4eecabc19235c5c77dc62e2c5565de4?s=96&d=blank&r=g","caption":"Dev Medienstuermer"},"url":"https:\/\/orcharhino.com\/en\/ressourcen\/blog\/author\/dev\/"}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/posts\/19859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/users\/1095"}],"replies":[{"embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/comments?post=19859"}],"version-history":[{"count":3,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/posts\/19859\/revisions"}],"predecessor-version":[{"id":30328,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/posts\/19859\/revisions\/30328"}],"wp:attachment":[{"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/media?parent=19859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/categories?post=19859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/tags?post=19859"},{"taxonomy":"pillars","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/pillars?post=19859"},{"taxonomy":"rolle","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/rolle?post=19859"},{"taxonomy":"use-case-kategorie","embeddable":true,"href":"https:\/\/orcharhino.com\/en\/wp-json\/wp\/v2\/use-case-kategorie?post=19859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}