Accepting request 923412 from vdr
OBS-URL: https://build.opensuse.org/request/show/923412 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/lirc?expand=0&rev=72
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
c6207cafb4
21
harden_irexec.service.patch
Normal file
21
harden_irexec.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/irexec.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/irexec.service
|
||||
+++ lirc-0.10.1/systemd/irexec.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Handle events from IR remotes decoded by lircd(8)
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
; user=lirc
|
||||
; group=lirc
|
||||
|
||||
21
harden_lircd-uinput.service.patch
Normal file
21
harden_lircd-uinput.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircd-uinput.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircd-uinput.service
|
||||
+++ lirc-0.10.1/systemd/lircd-uinput.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Forward LIRC button presses as uinput events
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircd-uinput
|
||||
; user=lirc
|
||||
21
harden_lircd.service.patch
Normal file
21
harden_lircd.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircd.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircd.service
|
||||
+++ lirc-0.10.1/systemd/lircd.service
|
||||
@@ -6,6 +6,16 @@ Wants=lircd-setup.service
|
||||
After=network.target lircd-setup.service
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircd --nodaemon
|
||||
; User=lirc
|
||||
21
harden_lircmd.service.patch
Normal file
21
harden_lircmd.service.patch
Normal file
@ -0,0 +1,21 @@
|
||||
Index: lirc-0.10.1/systemd/lircmd.service
|
||||
===================================================================
|
||||
--- lirc-0.10.1.orig/systemd/lircmd.service
|
||||
+++ lirc-0.10.1/systemd/lircmd.service
|
||||
@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
|
||||
Description=Convert IR remotes button presses to mouse movements and clicks
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/lircmd --nodaemon
|
||||
; user=lirc
|
||||
22
lirc.changes
22
lirc.changes
@ -1,3 +1,25 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 5 12:06:44 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
|
||||
- Revert "Require typelib packages": better to have rpm auto-detect
|
||||
them.
|
||||
- Add gobject-introspection BuildRequires to have the typelib dep
|
||||
scanner on board.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 5 11:43:13 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||
* harden_irexec.service.patch
|
||||
* harden_lircd-uinput.service.patch
|
||||
* harden_lircd.service.patch
|
||||
* harden_lircmd.service.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sun Aug 8 01:55:41 UTC 2021 - Stanislav Brabec <sbrabec@suse.com>
|
||||
|
||||
- Require typelib packages, otherwise lirc-setup fails to start.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat Feb 20 11:09:50 UTC 2021 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
|
||||
10
lirc.spec
10
lirc.spec
@ -32,8 +32,13 @@ URL: http://www.lirc.org/
|
||||
Source0: https://downloads.sourceforge.net/project/lirc/LIRC/%{version}/lirc-%{version}.tar.bz2
|
||||
Source1: baselibs.conf
|
||||
Patch0: reproducible.patch
|
||||
Patch1: harden_irexec.service.patch
|
||||
Patch2: harden_lircd-uinput.service.patch
|
||||
Patch3: harden_lircd.service.patch
|
||||
Patch4: harden_lircmd.service.patch
|
||||
BuildRequires: fdupes
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: gobject-introspection
|
||||
BuildRequires: kmod-compat
|
||||
BuildRequires: libxslt-tools
|
||||
# for hw_atilibusb driver
|
||||
@ -195,6 +200,10 @@ Some seldom used X11-based tools for debugging lirc configurations.
|
||||
# Don't provide or require anything from _docdir, per policy.
|
||||
%global __provides_exclude_from ^%{_docdir}/.*$
|
||||
%global __requires_exclude_from ^%{_docdir}/.*$
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
|
||||
sed -i -e 's|/usr/local/etc/|%{_sysconfdir}/|' contrib/irman2lirc
|
||||
sed -i -e 's/#effective-user/effective-user /' lirc_options.conf
|
||||
@ -251,6 +260,7 @@ rm -rf %{buildroot}/%{_datadir}/lirc/lirc-%{version}.tar.gz %{buildroot}/%{_data
|
||||
%postun -n liblirc_driver0 -p /sbin/ldconfig
|
||||
%postun -n liblirc0 -p /sbin/ldconfig
|
||||
%postun -n libirrecord0 -p /sbin/ldconfig
|
||||
|
||||
%pre core
|
||||
getent group lirc >/dev/null || groupadd -r lirc
|
||||
getent passwd lirc >/dev/null || \
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user