diff --git a/harden_teamd@.service.patch b/harden_teamd@.service.patch new file mode 100644 index 0000000..5160f65 --- /dev/null +++ b/harden_teamd@.service.patch @@ -0,0 +1,22 @@ +Index: libteam-1.31/teamd/redhat/systemd/teamd@.service +=================================================================== +--- libteam-1.31.orig/teamd/redhat/systemd/teamd@.service ++++ libteam-1.31/teamd/redhat/systemd/teamd@.service +@@ -4,6 +4,17 @@ Before=network-pre.target + Wants=network-pre.target + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++ProtectHostname=true ++ProtectKernelTunables=true ++ProtectKernelModules=true ++ProtectKernelLogs=true ++ProtectControlGroups=true ++RestrictRealtime=true ++# end of automatic additions + BusName=org.libteam.teamd.%i + ExecStart=/usr/sbin/teamd -U -D -o -t %i -f /run/teamd/%i.conf + Restart=on-failure diff --git a/libteam.changes b/libteam.changes index 03987a7..38ec455 100644 --- a/libteam.changes +++ b/libteam.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Oct 15 07:32:26 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_teamd@.service.patch + ------------------------------------------------------------------- Tue Aug 25 15:45:19 UTC 2020 - Dirk Mueller diff --git a/libteam.spec b/libteam.spec index 63c670c..c5434fc 100644 --- a/libteam.spec +++ b/libteam.spec @@ -31,6 +31,7 @@ Patch1: check_if_psr_ops_were_initialized.patch Patch2: start_teamd_from_usr_sbin.patch Patch3: ignore_ebusy_for_team_hwaddr_set.patch Patch4: 0001-allow-send_interface-dbus.patch +Patch5: harden_teamd@.service.patch BuildRequires: doxygen BuildRequires: libcap-devel BuildRequires: libtool