From 127262ecccd932e4e55093f5d62d0a02bf2a56e02a3c4febef6f439e3653c2a7 Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meissner@suse.com>
Date: Mon, 16 Aug 2021 13:21:17 +0000
Subject: [PATCH 1/2] Accepting request 911452 from
 home:jsegitz:branches:systemdhardening:security

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/911452
OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=127
---
 audit-secondary.spec        |  2 ++
 harden_auditd.service.patch | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 harden_auditd.service.patch

diff --git a/audit-secondary.spec b/audit-secondary.spec
index 65a6efe..f1366ed 100644
--- a/audit-secondary.spec
+++ b/audit-secondary.spec
@@ -36,6 +36,7 @@ Patch3:         audit-allow-manual-stop.patch
 Patch4:         audit-ausearch-do-not-require-tclass.patch
 Patch5:         change-default-log_group.patch
 Patch6:         libev-werror.patch
+Patch7:         harden_auditd.service.patch
 BuildRequires:  audit-devel = %{version}
 BuildRequires:  autoconf >= 2.12
 BuildRequires:  gcc-c++
@@ -127,6 +128,7 @@ rm -rf audisp/plugins/prelude
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch7 -p1
 
 %if %{without python2} && %{with python3}
 # Fix python env call in tests if we only have Python3.
diff --git a/harden_auditd.service.patch b/harden_auditd.service.patch
new file mode 100644
index 0000000..fb927fd
--- /dev/null
+++ b/harden_auditd.service.patch
@@ -0,0 +1,20 @@
+Index: audit-3.0.3/init.d/auditd.service
+===================================================================
+--- audit-3.0.3.orig/init.d/auditd.service
++++ audit-3.0.3/init.d/auditd.service
+@@ -35,6 +35,15 @@ ProtectControlGroups=true
+ ProtectKernelModules=true
+ ProtectHome=true
+ RestrictRealtime=true
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelLogs=true
++# end of automatic additions 
+ 
+ [Install]
+ WantedBy=multi-user.target

From 0e616b416505266feb57e4b28b7b80151e8f3a79934097f13074355a350d21a8 Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meissner@suse.com>
Date: Mon, 16 Aug 2021 13:36:30 +0000
Subject: [PATCH 2/2] - harden_auditd.service.patch: automatic hardening
 applied to systemd   services

OBS-URL: https://build.opensuse.org/package/show/security/audit?expand=0&rev=128
---
 audit-secondary.changes | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/audit-secondary.changes b/audit-secondary.changes
index a4585c9..d9d143f 100644
--- a/audit-secondary.changes
+++ b/audit-secondary.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Aug 16 13:29:21 UTC 2021 - Marcus Meissner <meissner@suse.com>
+
+- harden_auditd.service.patch: automatic hardening applied to systemd
+  services
+
 -------------------------------------------------------------------
 Fri Jul 30 18:14:14 CEST 2021 - Enzo Matsumiya <ematsumiya@suse.com>