Accepting request 923412 from vdr

OBS-URL: https://build.opensuse.org/request/show/923412
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/lirc?expand=0&rev=72

harden_irexec.service.patch

@@ -0,0 +1,21 @@
+Index: lirc-0.10.1/systemd/irexec.service
+===================================================================
+--- lirc-0.10.1.orig/systemd/irexec.service
++++ lirc-0.10.1/systemd/irexec.service
+@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
+ Description=Handle events from IR remotes decoded by lircd(8)
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ ; user=lirc
+ ; group=lirc
+ 

harden_lircd-uinput.service.patch

@@ -0,0 +1,21 @@
+Index: lirc-0.10.1/systemd/lircd-uinput.service
+===================================================================
+--- lirc-0.10.1.orig/systemd/lircd-uinput.service
++++ lirc-0.10.1/systemd/lircd-uinput.service
+@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
+ Description=Forward LIRC button presses as uinput events
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=simple
+ ExecStart=/usr/sbin/lircd-uinput
+ ; user=lirc

harden_lircd.service.patch

@@ -0,0 +1,21 @@
+Index: lirc-0.10.1/systemd/lircd.service
+===================================================================
+--- lirc-0.10.1.orig/systemd/lircd.service
++++ lirc-0.10.1/systemd/lircd.service
+@@ -6,6 +6,16 @@ Wants=lircd-setup.service
+ After=network.target lircd-setup.service
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=simple
+ ExecStart=/usr/sbin/lircd --nodaemon
+ ; User=lirc

harden_lircmd.service.patch

@@ -0,0 +1,21 @@
+Index: lirc-0.10.1/systemd/lircmd.service
+===================================================================
+--- lirc-0.10.1.orig/systemd/lircmd.service
++++ lirc-0.10.1/systemd/lircmd.service
+@@ -5,6 +5,16 @@ Documentation=http://lirc.org/html/confi
+ Description=Convert IR remotes button presses to mouse movements and clicks
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=simple
+ ExecStart=/usr/sbin/lircmd  --nodaemon
+ ; user=lirc

lirc.changes

@@ -1,3 +1,25 @@
+-------------------------------------------------------------------
+Tue Oct  5 12:06:44 UTC 2021 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Revert "Require typelib packages": better to have rpm auto-detect
+  them.
+- Add gobject-introspection BuildRequires to have the typelib dep
+  scanner on board.
+
+-------------------------------------------------------------------
+Tue Oct  5 11:43:13 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_irexec.service.patch
+  * harden_lircd-uinput.service.patch
+  * harden_lircd.service.patch
+  * harden_lircmd.service.patch
+
+-------------------------------------------------------------------
+Sun Aug  8 01:55:41 UTC 2021 - Stanislav Brabec <sbrabec@suse.com>
+
+- Require typelib packages, otherwise lirc-setup fails to start.
+
 -------------------------------------------------------------------
 Sat Feb 20 11:09:50 UTC 2021 - Dirk Müller <dmueller@suse.com>
 

lirc.spec

@@ -32,8 +32,13 @@ URL:            http://www.lirc.org/
 Source0:        https://downloads.sourceforge.net/project/lirc/LIRC/%{version}/lirc-%{version}.tar.bz2
 Source1:        baselibs.conf
 Patch0:         reproducible.patch
+Patch1:	harden_irexec.service.patch
+Patch2:	harden_lircd-uinput.service.patch
+Patch3:	harden_lircd.service.patch
+Patch4:	harden_lircmd.service.patch
 BuildRequires:  fdupes
 BuildRequires:  gcc-c++
+BuildRequires:  gobject-introspection
 BuildRequires:  kmod-compat
 BuildRequires:  libxslt-tools
 # for hw_atilibusb driver
@@ -195,6 +200,10 @@ Some seldom used X11-based tools for debugging lirc configurations.
 # Don't provide or require anything from _docdir, per policy.
 %global __provides_exclude_from ^%{_docdir}/.*$
 %global __requires_exclude_from ^%{_docdir}/.*$
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
 
 sed -i -e 's|/usr/local/etc/|%{_sysconfdir}/|' contrib/irman2lirc
 sed -i -e 's/#effective-user/effective-user /' lirc_options.conf
@@ -251,6 +260,7 @@ rm -rf %{buildroot}/%{_datadir}/lirc/lirc-%{version}.tar.gz %{buildroot}/%{_data
 %postun -n liblirc_driver0 -p /sbin/ldconfig
 %postun -n liblirc0 -p /sbin/ldconfig
 %postun -n libirrecord0 -p /sbin/ldconfig
+
 %pre core
 getent group lirc >/dev/null || groupadd -r lirc
 getent passwd lirc >/dev/null || \