pool/gnuhealth
SHA256
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Accepting request 920514 from home:jsegitz:branches:systemdhardening:Application:ERP:GNUHealth:Factory

Browse Source 
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/920514
OBS-URL: https://build.opensuse.org/package/show/Application:ERP:GNUHealth:Factory/gnuhealth?expand=0&rev=89
This commit is contained in:
Axel Braun 2021-10-05 16:12:00 +00:00 committed by Git OBS Bridge
parent 5862031ce7
commit e3459b81d4
5 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
gnuhealth-webdav@.service
View File

@ -4,6 +4,19 @@ After=syslog.target
Requires=gnuhealth.service
[Service]
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
Type=simple
User=tryton
Group=tryton

9
gnuhealth.changes
View File

@ -1,3 +1,12 @@
-------------------------------------------------------------------
Mon Sep 20 14:02:25 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_gnuhealth.service.patch
Modified:
* gnuhealth-webdav@.service
* gnuhealth.service
-------------------------------------------------------------------
Fri Apr 16 17:16:20 UTC 2021 - Axel Braun <axel.braun@gmx.de>

7
gnuhealth.service
View File

@ -15,6 +15,13 @@ ProtectControlGroups=true
MountFlags=private
NoNewPrivileges=true
PrivateDevices=true
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectHostname=true
ProtectClock=true
ProtectKernelLogs=true
RestrictRealtime=true
# end of automatic additions
MemoryDenyWriteExecute=true
Type=simple

2
gnuhealth.spec
View File

@ -40,6 +40,7 @@ Source7: gnuhealth-rpmlintrc
Source8: https://ftp.gnu.org/gnu/health/%{name}-%{version}.tar.gz.sig
Source9: https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=health&download=1#/%{name}.keyring
Patch0: shebang.diff
Patch1: harden_gnuhealth.service.patch
BuildRequires: fdupes
BuildRequires: python-rpm-generators
@ -112,6 +113,7 @@ This package provides the interface to Orthanc
%patch0 -p1
cp %{S:1} .
cp %{S:2} .
%patch1 -p1
%build
for i in h*; do

24
harden_gnuhealth.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: gnuhealth-3.8.0/scripts/startup/gnuhealth.service
===================================================================
--- gnuhealth-3.8.0.orig/scripts/startup/gnuhealth.service
+++ gnuhealth-3.8.0/scripts/startup/gnuhealth.service
@@ -3,6 +3,19 @@ Description=GNU Health Server
After=network.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=simple
User=gnuhealth
WorkingDirectory=/home/gnuhealth