From 138347db68bed1f13b08ce639fbed65245fe6f2cac034c6a2dccdd0f4ce4c3f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20V=C3=B6gl?= <christian.voegl@suse.com>
Date: Wed, 1 Sep 2021 09:02:20 +0000
Subject: [PATCH] Accepting request 915057 from
 home:jsegitz:branches:systemdhardening:server:monitoring

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/915057
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/collectd?expand=0&rev=172
---
 collectd.changes              |  6 ++++++
 collectd.spec                 |  2 ++
 harden_collectd.service.patch | 24 ++++++++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 harden_collectd.service.patch

diff --git a/collectd.changes b/collectd.changes
index 9c83c56..23e7ef4 100644
--- a/collectd.changes
+++ b/collectd.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Aug 30 08:09:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s). Added patch(es):
+  * harden_collectd.service.patch
+
 -------------------------------------------------------------------
 Mon Jun 28 13:17:32 UTC 2021 - Matwey Kornilov <matwey.kornilov@gmail.com>
 
diff --git a/collectd.spec b/collectd.spec
index 4c13dd9..59ceac0 100644
--- a/collectd.spec
+++ b/collectd.spec
@@ -64,6 +64,7 @@ Patch7:         collectd-fix_collectd_config_path_in_snmp_probe.patch
 Patch8:         9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
 # PATCH-FIX-OPENSUSE avoid-pg-config.patch avoid pg_config if possible
 Patch11:        avoid-pg-config.patch
+Patch12:        harden_collectd.service.patch
 # for /etc/apache2/... ownership (rpmlint):
 BuildRequires:  apache2
 BuildRequires:  autoconf
@@ -558,6 +559,7 @@ to write %{name} unixsock clients.
 %patch8 -p1
 %endif
 %patch11 -p1
+%patch12 -p1
 
 sed -i 's|@@VERSION@@|%{version}|g' configure.ac
 
diff --git a/harden_collectd.service.patch b/harden_collectd.service.patch
new file mode 100644
index 0000000..330d641
--- /dev/null
+++ b/harden_collectd.service.patch
@@ -0,0 +1,24 @@
+Index: collectd-5.12.0/contrib/systemd.collectd.service
+===================================================================
+--- collectd-5.12.0.orig/contrib/systemd.collectd.service
++++ collectd-5.12.0/contrib/systemd.collectd.service
+@@ -5,6 +5,19 @@ After=local-fs.target network-online.tar
+ Requires=local-fs.target network-online.target
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ ExecStart=/usr/sbin/collectd
+ EnvironmentFile=-/etc/sysconfig/collectd
+ EnvironmentFile=-/etc/default/collectd