pool/cups
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 925363 from home:jsegitz:branches:systemdhardening:Printing

Browse Source 
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/925363
OBS-URL: https://build.opensuse.org/package/show/Printing/cups?expand=0&rev=379
This commit is contained in:
Johannes Meixner 2021-11-24 10:41:59 +00:00 committed by Git OBS Bridge
parent bb08f7c7ef
commit e8ec02bc9d
3 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cups.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Fri Oct 15 07:31:10 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_cups.service.patch
-------------------------------------------------------------------
Mon Jun 7 13:23:25 CEST 2021 - jsmeix@suse.de

2
cups.spec
View File

@ -85,6 +85,7 @@ Patch103: cups-1.4-do_not_strip_recommended_from_PPDs.patch
Patch104: cups-config-libs.patch
# Patch106 Fixes web UI Kerberos authentication (bsc#1175960)
Patch106: fix-negotiate-authentication-between-CGIs-and-scheduler.patch
Patch107: harden_cups.service.patch
# Build Requirements:
BuildRequires: dbus-1-devel
BuildRequires: fdupes
@ -309,6 +310,7 @@ printer drivers for CUPS.
%patch104 -b cups-config-libs.orig
# Patch106 Fixes web UI Kerberos authentication (bsc#1175960)
%patch106 -p1
%patch107 -p1
%build
# Remove ".SILENT" rule for verbose build output

22
harden_cups.service.patch Normal file
View File

@ -0,0 +1,22 @@
Index: cups-2.3.3op2/scheduler/cups.service.in
===================================================================
--- cups-2.3.3op2.orig/scheduler/cups.service.in
+++ cups-2.3.3op2/scheduler/cups.service.in
@@ -5,6 +5,17 @@ After=network.target sssd.service ypbind
Requires=cups.socket
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
ExecStart=@sbindir@/cupsd -l
Type=notify
Restart=on-failure