Use /etc/redis/sentinel for sentinel configuration

It is not possible to use file labels as redis-sentinel tries to create
temporary file in the same directory as sentinel.conf and since
/etc/redis does not have redis_conf_t label it is unable to create
this temporary file.

Author: Peter-Sh

configs/redis-sentinel.service

@@ -5,8 +5,6 @@ Documentation=http://redis.io/documentation
 
 [Service]
 Type=notify
-# Try to restore context for sentinel.conf* as sentinel needs to write into these files
-ExecStartPre=-/bin/sh -c "[ -x /sbin/restorecon ] && /sbin/restorecon '/etc/redis/sentinel.conf*'"
 ExecStart=/usr/bin/redis-sentinel /etc/redis/sentinel.conf
 TimeoutStopSec=0
 Restart=always
@@ -24,8 +22,6 @@ ReadOnlyDirectories=/
 ReadWriteDirectories=-/var/lib/redis
 ReadWriteDirectories=-/var/log/redis
 ReadWriteDirectories=-/run/sentinel
-# To run restorecon in ExecStartPre
-PermissionsStartOnly=yes
 
 NoNewPrivileges=true
 CapabilityBoundingSet=CAP_SYS_RESOURCE

scripts/postinstall.sh

@@ -10,10 +10,10 @@ if command -v checkmodule &> /dev/null && command -v semodule_package &> /dev/nu
     semodule -i /usr/share/selinux/packages/redis-ce.pp
 fi
 
-# Allow writing to /etc/redis/sentinel.conf* for redis-sentinel
+# Allow writing to /etc/redis/sentinel/ for redis-sentinel
 if command -v semanage &> /dev/null; then
-    semanage fcontext -a -t redis_conf_t '/etc/redis/sentinel.conf*'
-    restorecon '/etc/redis/sentinel.conf*'
+    semanage fcontext -a -t redis_conf_t '/etc/redis/sentinel'
+    restorecon '/etc/redis/sentinel'
 fi
 
 #

templates/nfpm.yaml.tpl

@@ -88,6 +88,12 @@ contents:
       mode: 0750
       owner: redis
       group: redis
+  - dst: /etc/redis/sentinel
+    type: dir
+    file_info:
+      mode: 0750
+      owner: redis
+      group: redis
   - src: ./configs/redis.conf
     dst: /etc/redis/redis.conf
     type: config|noreplace
@@ -96,7 +102,7 @@ contents:
       owner: redis
       group: redis
   - src: ./configs/sentinel.conf
-    dst: /etc/redis/sentinel.conf
+    dst: /etc/redis/sentinel/sentinel.conf
     type: config|noreplace
     file_info:
       mode: 0640