e2fsprogs/harden_e2scrub@.service.patch

Index: e2fsprogs-1.46.4/scrub/e2scrub@.service.in
===================================================================
--- e2fsprogs-1.46.4.orig/scrub/e2scrub@.service.in
+++ e2fsprogs-1.46.4/scrub/e2scrub@.service.in
@@ -10,6 +10,14 @@ PrivateNetwork=true
 ProtectSystem=true
 ProtectHome=read-only
 PrivateTmp=yes
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 AmbientCapabilities=CAP_SYS_ADMIN CAP_SYS_RAWIO
 NoNewPrivileges=yes
 User=root
- Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) Rev filesystems/143 Md5 69640eb8914151807bf629226ae87303 2021-09-17 16:27:04 jankara 919834 2021-09-17 18:27:04 +02:00			`Index: e2fsprogs-1.46.4/scrub/e2scrub@.service.in`
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort Rev filesystems/142 Md5 69bd64fbc6d1446b0f1394269a3eaf63 2021-09-15 09:02:50 jankara 918932 2021-09-15 11:02:50 +02:00			`===================================================================`
- Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) Rev filesystems/143 Md5 69640eb8914151807bf629226ae87303 2021-09-17 16:27:04 jankara 919834 2021-09-17 18:27:04 +02:00			`--- e2fsprogs-1.46.4.orig/scrub/e2scrub@.service.in`
			`+++ e2fsprogs-1.46.4/scrub/e2scrub@.service.in`
- Drop ProtectClock hardening, can cause issues if other device acceess is needed Rev filesystems/145 Md5 421d39e952eff089006ffbd2104d3c1f 2021-10-16 09:37:28 dirkmueller 925452 2021-10-16 11:37:28 +02:00			`@@ -10,6 +10,14 @@ PrivateNetwork=true`
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort Rev filesystems/142 Md5 69bd64fbc6d1446b0f1394269a3eaf63 2021-09-15 09:02:50 jankara 918932 2021-09-15 11:02:50 +02:00			`ProtectSystem=true`
			`ProtectHome=read-only`
			`PrivateTmp=yes`
			`+# added automatically, for details please see`
			`+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort`
			`+ProtectHostname=true`
			`+ProtectKernelTunables=true`
			`+ProtectKernelLogs=true`
			`+ProtectControlGroups=true`
			`+RestrictRealtime=true`
			`+# end of automatic additions`
			`AmbientCapabilities=CAP_SYS_ADMIN CAP_SYS_RAWIO`
			`NoNewPrivileges=yes`
			`User=root`