From 902bd43305b367a4fed539712a61c713346b81be99c238d3cf50959e197026f9 Mon Sep 17 00:00:00 2001 From: Witek Bedyk Date: Wed, 29 Sep 2021 10:37:53 +0000 Subject: [PATCH] Accepting request 920532 from home:jsegitz:branches:systemdhardening:server:monitoring Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/920532 OBS-URL: https://build.opensuse.org/package/show/server:monitoring/golang-github-prometheus-prometheus?expand=0&rev=49 --- golang-github-prometheus-prometheus.changes | 6 ++++++ prometheus.service | 13 +++++++++++++ 2 files changed, 19 insertions(+) diff --git a/golang-github-prometheus-prometheus.changes b/golang-github-prometheus-prometheus.changes index 4148976..6ccd086 100644 --- a/golang-github-prometheus-prometheus.changes +++ b/golang-github-prometheus-prometheus.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Sep 20 14:44:20 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Modified: + * prometheus.service + ------------------------------------------------------------------- Thu Jul 8 08:08:39 UTC 2021 - Witek Bedyk diff --git a/prometheus.service b/prometheus.service index 68c7e8e..fc6c8db 100644 --- a/prometheus.service +++ b/prometheus.service @@ -5,6 +5,19 @@ Wants=network-online.target After=network-online.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Restart=always User=prometheus EnvironmentFile=-/etc/sysconfig/prometheus