jengelh/sssd
SHA256
1
0
Fork 1
forked from pool/sssd
Code Pull Requests Activity

Accepting request 933479 from home:jsegitz:branches:systemdhardening:network:ldap

Browse Source 
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/933479
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=253
This commit is contained in:
Jan Engelhardt 2021-11-25 12:04:46 +00:00 committed by Git OBS Bridge
parent 3ee2d1b0f0
commit 46bf221fbf
4 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
harden_sssd-ifp.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: sssd-2.5.2/src/sysv/systemd/sssd-ifp.service.in
===================================================================
--- sssd-2.5.2.orig/src/sysv/systemd/sssd-ifp.service.in
+++ sssd-2.5.2/src/sysv/systemd/sssd-ifp.service.in
@@ -5,6 +5,19 @@ After=sssd.service
BindsTo=sssd.service
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Environment=DEBUG_LOGGER=--logger=files
EnvironmentFile=-@environment_file@
Type=dbus

24
harden_sssd-kcm.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: sssd-2.5.2/src/sysv/systemd/sssd-kcm.service.in
===================================================================
--- sssd-2.5.2.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.5.2/src/sysv/systemd/sssd-kcm.service.in
@@ -8,6 +8,19 @@ After=sssd-kcm.socket
Also=sssd-kcm.socket
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Environment=DEBUG_LOGGER=--logger=files
ExecStartPre=-@sbindir@/sssd --genconf-section=kcm
ExecStart=@libexecdir@/sssd/sssd_kcm --uid 0 --gid 0 ${DEBUG_LOGGER}

7
sssd.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue Nov 23 16:11:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_sssd-ifp.service.patch
* harden_sssd-kcm.service.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Nov 9 15:35:58 UTC 2021 - Jan Engelhardt <jengelh@inai.de> Tue Nov 9 15:35:58 UTC 2021 - Jan Engelhardt <jengelh@inai.de>

2
sssd.spec
View File

@ -29,6 +29,8 @@ Source2: https://github.com/SSSD/sssd/releases/download/%version/%name-%v
Source3: baselibs.conf Source3: baselibs.conf
Source5: %name.keyring Source5: %name.keyring
Patch1: krb-noversion.diff Patch1: krb-noversion.diff
Patch2: harden_sssd-ifp.service.patch
Patch3: harden_sssd-kcm.service.patch
BuildRequires: autoconf >= 2.59 BuildRequires: autoconf >= 2.59
BuildRequires: automake BuildRequires: automake
BuildRequires: bind-utils BuildRequires: bind-utils