Accepting request 925363 from home:jsegitz:branches:systemdhardening:Printing

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/925363
OBS-URL: https://build.opensuse.org/package/show/Printing/cups?expand=0&rev=379

cups.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Oct 15 07:31:10 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_cups.service.patch
+
 -------------------------------------------------------------------
 Mon Jun  7 13:23:25 CEST 2021 - jsmeix@suse.de
 

cups.spec

@@ -85,6 +85,7 @@ Patch103:       cups-1.4-do_not_strip_recommended_from_PPDs.patch
 Patch104:       cups-config-libs.patch
 # Patch106 Fixes web UI Kerberos authentication (bsc#1175960)
 Patch106:       fix-negotiate-authentication-between-CGIs-and-scheduler.patch
+Patch107:	harden_cups.service.patch
 # Build Requirements:
 BuildRequires:  dbus-1-devel
 BuildRequires:  fdupes
@@ -309,6 +310,7 @@ printer drivers for CUPS.
 %patch104 -b cups-config-libs.orig
 # Patch106 Fixes web UI Kerberos authentication (bsc#1175960)
 %patch106 -p1
+%patch107 -p1
 
 %build
 # Remove ".SILENT" rule for verbose build output

harden_cups.service.patch

@@ -0,0 +1,22 @@
+Index: cups-2.3.3op2/scheduler/cups.service.in
+===================================================================
+--- cups-2.3.3op2.orig/scheduler/cups.service.in
++++ cups-2.3.3op2/scheduler/cups.service.in
+@@ -5,6 +5,17 @@ After=network.target sssd.service ypbind
+ Requires=cups.socket
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++ProtectHostname=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ ExecStart=@sbindir@/cupsd -l
+ Type=notify
+ Restart=on-failure