fwupd/harden_fwupd-refresh.service.patch
Dominique Leuenberger a034b11e2e - Update to version 1.9.24:
+ This release fixes the following bugs:
    - Add support for capsule on disk for Dell systems
    - Do not re-use the connection cache to fix Redfish BMC restart
    - Exclude known recovery partitions when choosing an ESP volume
    - Fix the VLI usb3 private flag registration
  + This release adds support for the following hardware:
    - More Mediatek scaler devices
    - Parade USB hubs

OBS-URL: https://build.opensuse.org/package/show/Base:System/fwupd?expand=0&rev=191
2024-08-22 06:25:28 +00:00

19 lines
677 B
Diff

Index: fwupd-1.9.10/data/motd/fwupd-refresh.service.in
===================================================================
--- fwupd-1.9.10.orig/data/motd/fwupd-refresh.service.in
+++ fwupd-1.9.10/data/motd/fwupd-refresh.service.in
@@ -14,5 +14,13 @@ SystemCallFilter=~@mount
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelLogs=true
+# end of automatic additions
SuccessExitStatus=2
ExecStart=@bindir@/fwupdmgr refresh