Accepting request 918936 from home:jsegitz:branches:systemdhardening:network

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/918936
OBS-URL: https://build.opensuse.org/package/show/network/dnsmasq?expand=0&rev=136

dnsmasq.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Sep 14 06:19:17 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_dnsmasq.service.patch
+  Modified:
+  * dnsmasq.service
+
 -------------------------------------------------------------------
 Sun Jun 13 13:28:49 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
 

dnsmasq.service

@@ -5,6 +5,18 @@ Wants=nss-lookup.target
 Before=nss-lookup.target
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=dbus
 BusName=uk.org.thekelleys.dnsmasq
 ExecStartPre=/usr/sbin/dnsmasq --test

dnsmasq.spec

@@ -37,6 +37,7 @@ Source5:        rc.dnsmasq-suse
 Source6:        system-user-dnsmasq.conf
 Source8:        %{name}-rpmlintrc
 Patch0:         dnsmasq-groups.patch
+Patch1:	harden_dnsmasq.service.patch
 BuildRequires:  dbus-1-devel
 BuildRequires:  dos2unix
 BuildRequires:  libidn2-devel
@@ -75,6 +76,7 @@ server's leases.
 %prep
 %setup -q
 %patch0
+%patch1 -p1
 
 # Remove the executable bit from python example files to
 # avoid unwanted automatic dependencies

harden_dnsmasq.service.patch

@@ -0,0 +1,24 @@
+Index: dnsmasq-2.85/contrib/systemd/dnsmasq.service
+===================================================================
+--- dnsmasq-2.85.orig/contrib/systemd/dnsmasq.service
++++ dnsmasq-2.85/contrib/systemd/dnsmasq.service
+@@ -5,6 +5,19 @@ Before=network-online.target nss-lookup.
+ Wants=nss-lookup.target
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=dbus
+ BusName=uk.org.thekelleys.dnsmasq
+ ExecStartPre=/usr/sbin/dnsmasq --test