pool/haveged
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 932923 from security

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/932923
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/haveged?expand=0&rev=62
This commit is contained in:
Dominique Leuenberger 2021-11-23 21:10:23 +00:00 committed by Git OBS Bridge
commit 3a06ec655c
5 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
harden_haveged.service.patch Normal file
View File

@ -0,0 +1,16 @@
Index: haveged-1.9.14/contrib/Fedora/haveged.service
===================================================================
--- haveged-1.9.14.orig/contrib/Fedora/haveged.service
+++ haveged-1.9.14/contrib/Fedora/haveged.service
@@ -24,6 +24,11 @@ ProtectKernelLogs=true
ProtectKernelModules=true
RestrictNamespaces=true
RestrictRealtime=true
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectClock=true
+ProtectControlGroups=true
+# end of automatic additions
LockPersonality=true
MemoryDenyWriteExecute=true

12
haveged-switch-root.service
View File

@ -8,6 +8,18 @@ JoinsNamespaceOf=haveged.service
[Service]
ExecStart=-/usr/sbin/haveged -c root=/sysroot
PrivateNetwork=yes
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
Type=oneshot
StandardInput=null
StandardOutput=null

15
haveged.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Mon Nov 22 08:14:39 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Remove ProtectKernelTunables hardening, causes the service to fail
(boo#1192921)
-------------------------------------------------------------------
Tue Nov 2 08:18:49 UTC 2021 - Marcus Meissner <meissner@suse.com>
@ -12,6 +18,15 @@ Mon Oct 11 13:26:52 UTC 2021 - Cristian Rodríguez <crrodriguez@opensuse.org>
initrd modules and udev rules, the other components
are still useful.
-------------------------------------------------------------------
Tue Sep 21 12:15:06 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_haveged.service.patch
Modified:
* haveged-switch-root.service
* haveged.service
-------------------------------------------------------------------
Mon Jan 4 08:28:40 UTC 2021 - Paolo Stivanin <info@paolostivanin.com>

12
haveged.service
View File

@ -12,6 +12,18 @@ Before=sysinit.target shutdown.target systemd-journald.service
ExecStart=/usr/sbin/haveged -w 1024 -v 0 -F
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SYS_CHROOT
PrivateNetwork=yes
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
Restart=always
SuccessExitStatus=137 143

1
haveged.spec
View File

@ -32,6 +32,7 @@ Source5: %{name}-switch-root.service
Patch0: ppc64le.patch
# PATCH-FIX-UPSTREAM: don't write to syslog at startup to avoid deadlocks psimons@suse.com bnc#959237
Patch2: haveged-no-syslog.patch
Patch3: harden_haveged.service.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: libtool