Sync from SUSE:SLFO:Main rpcbind revision 72ecfcb67887aea17bc4c4d0ebae1202
This commit is contained in:
parent
ce1408666c
commit
2b8a7299a4
39
0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
Normal file
39
0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
Normal file
@ -0,0 +1,39 @@
|
||||
From 913dc9e39032cf8d06c8f3260ef7fcca636a9ebb Mon Sep 17 00:00:00 2001
|
||||
From: Johannes Segitz <jsegitz@suse.com>
|
||||
Date: Fri, 23 Aug 2024 00:51:43 +0200
|
||||
Subject: [PATCH] systemd/rpcbind.service: Add hardening (bsc#1181400)
|
||||
|
||||
Signed-off-by: Johannes Segitz <jsegitz@suse.com>
|
||||
[ pvorel: Rebased for 1.2.7 ]
|
||||
Signed-off-by: Petr Vorel <pvorel@suse.cz>
|
||||
---
|
||||
systemd/rpcbind.service.in | 13 +++++++++++++
|
||||
1 file changed, 13 insertions(+)
|
||||
|
||||
diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
|
||||
index 97207e0..b03409b 100644
|
||||
--- a/systemd/rpcbind.service.in
|
||||
+++ b/systemd/rpcbind.service.in
|
||||
@@ -11,6 +11,19 @@ Wants=rpcbind.target
|
||||
After=sysinit.target
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectSystem=full
|
||||
+ProtectHome=true
|
||||
+PrivateDevices=true
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=notify
|
||||
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
|
||||
EnvironmentFile=-/etc/sysconfig/rpcbind
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@ -0,0 +1,40 @@
|
||||
From e400274134c1401359ef38df34fc300e0fba2fba Mon Sep 17 00:00:00 2001
|
||||
From: Thomas Blume <thomas.blume@suse.com>
|
||||
Date: Thu, 22 Aug 2024 22:36:49 +0200
|
||||
Subject: [PATCH] systemd/rpcbind.service: Fix ordering, add
|
||||
/etc/sysconfig/rpcbind
|
||||
|
||||
* Add ordering dependency to rpcbind.service (bsc#1117217)
|
||||
* Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service.in
|
||||
(bsc#824621)
|
||||
|
||||
Link: https://bugzilla.suse.com/show_bug.cgi?id=1117217
|
||||
Link: https://bugzilla.suse.com/show_bug.cgi?id=824621
|
||||
Reviewed-by: Petr Vorel <pvorel@suse.cz>
|
||||
Signed-off-by: Thomas Blume <thomas.blume@suse.com>
|
||||
[ pvorel: rebased for 1.2.7 ]
|
||||
Signed-off-by: Petr Vorel <pvorel@suse.cz>
|
||||
---
|
||||
systemd/rpcbind.service.in | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/systemd/rpcbind.service.in b/systemd/rpcbind.service.in
|
||||
index c892ca8..97207e0 100644
|
||||
--- a/systemd/rpcbind.service.in
|
||||
+++ b/systemd/rpcbind.service.in
|
||||
@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
|
||||
# rpcbind.socket, no matter how this unit is started.
|
||||
Requires=rpcbind.socket
|
||||
Wants=rpcbind.target
|
||||
+After=sysinit.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
|
||||
+EnvironmentFile=-/etc/sysconfig/rpcbind
|
||||
ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS @warmstarts_opt@ -f
|
||||
|
||||
[Install]
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@ -1,27 +0,0 @@
|
||||
From 9c5efb3a0973d57b79e4fc7a96debe0e6ce2d000 Mon Sep 17 00:00:00 2001
|
||||
From: Thomas Blume <thomas.blume@suse.com>
|
||||
Date: Thu, 25 Oct 2018 11:14:32 +0200
|
||||
Subject: [PATCH] systemd unit files
|
||||
|
||||
Add EnvironmentFile=-/etc/sysconfig/rpcbind to rpcbind.service
|
||||
---
|
||||
systemd/rpcbind.service.in | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
Index: rpcbind-1.2.5/systemd/rpcbind.service.in
|
||||
===================================================================
|
||||
--- rpcbind-1.2.5.orig/systemd/rpcbind.service.in
|
||||
+++ rpcbind-1.2.5/systemd/rpcbind.service.in
|
||||
@@ -8,10 +8,12 @@ RequiresMountsFor=@statedir@
|
||||
# rpcbind.socket, no matter how this unit is started.
|
||||
Requires=rpcbind.socket
|
||||
Wants=rpcbind.target
|
||||
+After=sysinit.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
|
||||
+EnvironmentFile=-/etc/sysconfig/rpcbind
|
||||
ExecStart=@_sbindir@/rpcbind $RPCBIND_OPTIONS -w -f
|
||||
|
||||
[Install]
|
||||
@ -1,24 +0,0 @@
|
||||
Index: rpcbind-1.2.6/systemd/rpcbind.service.in
|
||||
===================================================================
|
||||
--- rpcbind-1.2.6.orig/systemd/rpcbind.service.in
|
||||
+++ rpcbind-1.2.6/systemd/rpcbind.service.in
|
||||
@@ -11,6 +11,19 @@ Wants=rpcbind.target
|
||||
After=sysinit.target
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectSystem=full
|
||||
+ProtectHome=true
|
||||
+PrivateDevices=true
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=notify
|
||||
# distro can provide a drop-in adding EnvironmentFile=-/??? if needed.
|
||||
EnvironmentFile=-/etc/sysconfig/rpcbind
|
||||
BIN
rpcbind-1.2.6.tar.bz2
(Stored with Git LFS)
BIN
rpcbind-1.2.6.tar.bz2
(Stored with Git LFS)
Binary file not shown.
BIN
rpcbind-1.2.7.tar.bz2
(Stored with Git LFS)
Normal file
BIN
rpcbind-1.2.7.tar.bz2
(Stored with Git LFS)
Normal file
Binary file not shown.
@ -1,3 +1,18 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Feb 17 08:51:10 UTC 2025 - Thomas Blume <thomas.blume@suse.com>
|
||||
|
||||
- Require system-user-nobody for as the rpc user relies on `nobody`
|
||||
from this package
|
||||
|
||||
- Update to rpcbind 1.2.7
|
||||
* rpcinfo: try connecting using abstract address
|
||||
* Listen on an AF_UNIX abstract address if supported
|
||||
* autotools/systemd: call rpcbind with -w only on enabled warm starts
|
||||
* rpcbind: fix double free in init_transport
|
||||
- Refresh and rename patches (while turning them into git patches)
|
||||
* 0001-systemd-unit-files.patch -> 0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
|
||||
* harden_rpcbind.service.patch -> 0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 25 14:53:11 UTC 2023 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
|
||||
10
rpcbind.spec
10
rpcbind.spec
@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package rpcbind
|
||||
#
|
||||
# Copyright (c) 2023 SUSE LLC
|
||||
# Copyright (c) 2024 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@ -21,7 +21,7 @@
|
||||
%define _fillupdir %{_localstatedir}/adm/fillup-templates
|
||||
%endif
|
||||
Name: rpcbind
|
||||
Version: 1.2.6
|
||||
Version: 1.2.7
|
||||
Release: 0
|
||||
Summary: Transport independent RPC portmapper
|
||||
# Git-Web: http://git.linux-nfs.org/?p=steved/rpcbind.git;a=summary
|
||||
@ -31,9 +31,9 @@ URL: http://rpcbind.sourceforge.net
|
||||
Source: https://downloads.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.bz2
|
||||
Source2: sysconfig.rpcbind
|
||||
Source5: rpc-user.conf
|
||||
Patch1: 0001-systemd-unit-files.patch
|
||||
Patch1: 0001-systemd-rpcbind.service-Fix-ordering-add-etc-sysconf.patch
|
||||
Patch2: 0001-change-lockingdir-to-run.patch
|
||||
Patch3: harden_rpcbind.service.patch
|
||||
Patch3: 0001-systemd-rpcbind.service-Add-hardening-bsc-1181400.patch
|
||||
BuildRequires: libtirpc-devel >= 1.0.1
|
||||
BuildRequires: libtool
|
||||
BuildRequires: pkgconfig
|
||||
@ -41,6 +41,8 @@ BuildRequires: sysuser-shadow
|
||||
BuildRequires: sysuser-tools
|
||||
BuildRequires: tcpd-devel
|
||||
BuildRequires: pkgconfig(libsystemd)
|
||||
# The rpc user relies on the group `nobody`
|
||||
Requires: system-user-nobody
|
||||
Requires(post): %fillup_prereq
|
||||
Provides: portmap
|
||||
%{?systemd_ordering}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user