diff --git a/fcoe-utils.changes b/fcoe-utils.changes index 919d22b..b23eb5c 100644 --- a/fcoe-utils.changes +++ b/fcoe-utils.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Tue Sep 14 08:23:41 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_fcoe.service.patch + ------------------------------------------------------------------- Thu Mar 25 17:09:14 UTC 2021 - Lee Duncan diff --git a/fcoe-utils.spec b/fcoe-utils.spec index f52947d..148877e 100644 --- a/fcoe-utils.spec +++ b/fcoe-utils.spec @@ -37,6 +37,7 @@ Summary: FCoE userspace management tools License: GPL-2.0-only Group: System/Daemons Source: %{name}-%{version}.tar.xz +Patch0: harden_fcoe.service.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %{?systemd_requires} @@ -47,6 +48,7 @@ connections. %prep %setup -q +%patch0 -p1 %build autoreconf -vi diff --git a/harden_fcoe.service.patch b/harden_fcoe.service.patch new file mode 100644 index 0000000..5c987d6 --- /dev/null +++ b/harden_fcoe.service.patch @@ -0,0 +1,21 @@ +Index: fcoe-utils-1.0.34/etc/systemd/fcoe.service +=================================================================== +--- fcoe-utils-1.0.34.orig/etc/systemd/fcoe.service ++++ fcoe-utils-1.0.34/etc/systemd/fcoe.service +@@ -3,6 +3,16 @@ Description=Open-FCoE initiator daemon + After=syslog.target network.target + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++ProtectHostname=true ++ProtectClock=true ++ProtectKernelLogs=true ++ProtectControlGroups=true ++RestrictRealtime=true ++# end of automatic additions + Type=simple + EnvironmentFile=/etc/fcoe/config + ExecStartPre=/sbin/modprobe -qa $SUPPORTED_DRIVERS