https://bugzilla.opensuse.org/show_bug.cgi?id=1192921

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/haveged?expand=0&rev=61

harden_haveged.service.patch

@@ -1,17 +0,0 @@
-Index: haveged-1.9.14/contrib/Fedora/haveged.service
-===================================================================
---- haveged-1.9.14.orig/contrib/Fedora/haveged.service
-+++ haveged-1.9.14/contrib/Fedora/haveged.service
-@@ -24,6 +24,12 @@ ProtectKernelLogs=true
- ProtectKernelModules=true
- RestrictNamespaces=true
- RestrictRealtime=true
-+# added automatically, for details please see
-+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
-+ProtectClock=true
-+ProtectKernelTunables=true
-+ProtectControlGroups=true
-+# end of automatic additions 
- 
- LockPersonality=true
- MemoryDenyWriteExecute=true

haveged-switch-root.service

@@ -8,19 +8,6 @@ JoinsNamespaceOf=haveged.service
 [Service]
 ExecStart=-/usr/sbin/haveged -c root=/sysroot
 PrivateNetwork=yes
-# added automatically, for details please see
-# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
-ProtectSystem=full
-ProtectHome=true
-PrivateDevices=true
-ProtectHostname=true
-ProtectClock=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-RestrictRealtime=true
-# end of automatic additions 
 Type=oneshot
 StandardInput=null
 StandardOutput=null

haveged.changes

@@ -12,15 +12,6 @@ Mon Oct 11 13:26:52 UTC 2021 - Cristian Rodríguez <crrodriguez@opensuse.org>
   initrd modules and udev rules, the other components
   are still useful.
 
--------------------------------------------------------------------
-Tue Sep 21 12:15:06 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
-
-- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
-  * harden_haveged.service.patch
-  Modified:
-  * haveged-switch-root.service
-  * haveged.service
-
 -------------------------------------------------------------------
 Mon Jan  4 08:28:40 UTC 2021 - Paolo Stivanin <info@paolostivanin.com>
 

haveged.service

@@ -12,19 +12,6 @@ Before=sysinit.target shutdown.target systemd-journald.service
 ExecStart=/usr/sbin/haveged -w 1024 -v 0 -F
 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SYS_CHROOT
 PrivateNetwork=yes
-# added automatically, for details please see
-# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
-ProtectSystem=full
-ProtectHome=true
-PrivateDevices=true
-ProtectHostname=true
-ProtectClock=true
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectKernelLogs=true
-ProtectControlGroups=true
-RestrictRealtime=true
-# end of automatic additions 
 Restart=always
 SuccessExitStatus=137 143
 

haveged.spec

@@ -32,7 +32,6 @@ Source5:        %{name}-switch-root.service
 Patch0:         ppc64le.patch
 # PATCH-FIX-UPSTREAM: don't write to syslog at startup to avoid deadlocks psimons@suse.com bnc#959237
 Patch2:         haveged-no-syslog.patch
-Patch3:	harden_haveged.service.patch
 BuildRequires:  autoconf
 BuildRequires:  automake
 BuildRequires:  libtool