Accepting request 923524 from home:jsegitz:branches:systemdhardening:Base:System

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/923524
OBS-URL: https://build.opensuse.org/package/show/Base:System/man?expand=0&rev=128

harden_man-db.service.patch

@@ -0,0 +1,24 @@
+Index: man-db-2.9.4/init/systemd/man-db.service.in
+===================================================================
+--- man-db-2.9.4.orig/init/systemd/man-db.service.in
++++ man-db-2.9.4/init/systemd/man-db.service.in
+@@ -4,6 +4,19 @@ Documentation=man:mandb(8)
+ ConditionACPower=true
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=oneshot
+ # Recover from deletion, per FHS.
+ ExecStart=+/usr/bin/install -d -o @cache_top_owner@ -g @cache_top_owner@ -m 0755 /var/cache/man

man-db-create.service

@@ -8,6 +8,19 @@ ConditionPathExists=/var/cache/man
 ConditionPathExists=!/var/cache/man/index.db
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=oneshot
 RemainAfterExit=yes
 ExecStart=/usr/bin/mandb --quiet --create

man.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Oct  6 11:41:21 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_man-db.service.patch
+  Modified:
+  * man-db-create.service
+
 -------------------------------------------------------------------
 Fri Aug  6 13:38:49 UTC 2021 - Dr. Werner Fink <werner@suse.de>
 

man.spec

@@ -57,6 +57,7 @@ Patch8:         man-db-2.9.4.patch
 # PATCH-FEATURE-OPENSUSE -- Add documentation about man0 section (header files)
 Patch9:         man-db-2.6.3-man0.dif
 Patch10:        man-db-2.9.4-alternitive.dif
+Patch11:	harden_man-db.service.patch
 BuildRequires:  automake
 BuildRequires:  flex
 BuildRequires:  gdbm-devel
@@ -110,6 +111,7 @@ printer (using groff).
 %patch9 -b .s10
 %patch10 -b .libalernative
 rm -f configure
+%patch11 -p1
 
 %build
 %global optflags %{optflags} -funroll-loops -pipe -Wall