Accepting request 923297 from home:jsegitz:branches:systemdhardening:vdr
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/923297 OBS-URL: https://build.opensuse.org/package/show/vdr/lirc?expand=0&rev=105
This commit is contained in:
Stefan Seyfried
Git OBS Bridge
parent
4ec80e981b
commit
404bb4bc5d
21
harden_irexec.service.patch
Normal file
21
harden_irexec.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/irexec.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/irexec.service
|
||||
+++ lirc-0.10.1/systemd/irexec.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Handle events from IR remotes decoded by lircd(8)
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
; user=lirc
|
||||
; group=lirc
|
||||
|
||||
21
harden_lircd-uinput.service.patch
Normal file
21
harden_lircd-uinput.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircd-uinput.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircd-uinput.service
|
||||
+++ lirc-0.10.1/systemd/lircd-uinput.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Forward LIRC button presses as uinput events
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircd-uinput
|
||||
; user=lirc
|
||||
21
harden_lircd.service.patch
Normal file
21
harden_lircd.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircd.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircd.service
|
||||
+++ lirc-0.10.1/systemd/lircd.service
|
||||
@@ -6,6 +6,16 @@ Wants=lircd-setup.service
|
||||
After=network.target lircd-setup.service
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircd --nodaemon
|
||||
; User=lirc
|
||||
21
harden_lircmd.service.patch
Normal file
21
harden_lircmd.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircmd.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircmd.service
|
||||
+++ lirc-0.10.1/systemd/lircmd.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Convert IR remotes button presses to mouse movements and clicks
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircmd --nodaemon
|
||||
; user=lirc
|
||||
@ -6,6 +6,15 @@ Tue Oct 5 12:06:44 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
- Add gobject-introspection BuildRequires to have the typelib dep
|
||||
scanner on board.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 5 11:43:13 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||
* harden_irexec.service.patch
|
||||
* harden_lircd-uinput.service.patch
|
||||
* harden_lircd.service.patch
|
||||
* harden_lircmd.service.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sun Aug 8 01:55:41 UTC 2021 - Stanislav Brabec <sbrabec@suse.com>
|
||||
|
||||
|
||||
@ -32,6 +32,10 @@ URL: http://www.lirc.org/
|
||||
Source0: https://downloads.sourceforge.net/project/lirc/LIRC/%{version}/lirc-%{version}.tar.bz2
|
||||
Source1: baselibs.conf
|
||||
Patch0: reproducible.patch
|
||||
Patch1: harden_irexec.service.patch
|
||||
Patch2: harden_lircd-uinput.service.patch
|
||||
Patch3: harden_lircd.service.patch
|
||||
Patch4: harden_lircmd.service.patch
|
||||
BuildRequires: fdupes
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: gobject-introspection
|
||||
@ -196,6 +200,10 @@ Some seldom used X11-based tools for debugging lirc configurations.
|
||||
# Don't provide or require anything from _docdir, per policy.
|
||||
%global __provides_exclude_from ^%{_docdir}/.*$
|
||||
%global __requires_exclude_from ^%{_docdir}/.*$
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
|
||||
sed -i -e 's|/usr/local/etc/|%{_sysconfdir}/|' contrib/irman2lirc
|
||||
sed -i -e 's/#effective-user/effective-user /' lirc_options.conf
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user