pool/haveged
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 932917 from home:jsegitz:branches:security

Browse Source 
- Remove ProtectKernelTunables hardening, causes the service to fail
  (boo#1192921)

OBS-URL: https://build.opensuse.org/request/show/932917
OBS-URL: https://build.opensuse.org/package/show/security/haveged?expand=0&rev=143
This commit is contained in:
Peter Simons 2021-11-22 08:56:09 +00:00 committed by Git OBS Bridge
parent 020d7afb2c
commit 4800de73e5
5 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
harden_haveged.service.patch
View File

@ -2,14 +2,13 @@ Index: haveged-1.9.14/contrib/Fedora/haveged.service
===================================================================
--- haveged-1.9.14.orig/contrib/Fedora/haveged.service
+++ haveged-1.9.14/contrib/Fedora/haveged.service
@@ -24,6 +24,12 @@ ProtectKernelLogs=true
@@ -24,6 +24,11 @@ ProtectKernelLogs=true
ProtectKernelModules=true
RestrictNamespaces=true
RestrictRealtime=true
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+# end of automatic additions

1
haveged-switch-root.service
View File

@ -15,7 +15,6 @@ ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true

6
haveged.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Mon Nov 22 08:14:39 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Remove ProtectKernelTunables hardening, causes the service to fail
(boo#1192921)
-------------------------------------------------------------------
Tue Nov 2 08:18:49 UTC 2021 - Marcus Meissner <meissner@suse.com>

1
haveged.service
View File

@ -19,7 +19,6 @@ ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true

2
haveged.spec
View File

@ -32,7 +32,7 @@ Source5: %{name}-switch-root.service
Patch0: ppc64le.patch
# PATCH-FIX-UPSTREAM: don't write to syslog at startup to avoid deadlocks psimons@suse.com bnc#959237
Patch2: haveged-no-syslog.patch
Patch3: harden_haveged.service.patch
Patch3: harden_haveged.service.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: libtool