Accepting request 923524 from home:jsegitz:branches:systemdhardening:Base:System
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/923524 OBS-URL: https://build.opensuse.org/package/show/Base:System/man?expand=0&rev=128
This commit is contained in:
parent
8713a03fc7
commit
369d376210
24
harden_man-db.service.patch
Normal file
24
harden_man-db.service.patch
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
Index: man-db-2.9.4/init/systemd/man-db.service.in
|
||||||
|
===================================================================
|
||||||
|
--- man-db-2.9.4.orig/init/systemd/man-db.service.in
|
||||||
|
+++ man-db-2.9.4/init/systemd/man-db.service.in
|
||||||
|
@@ -4,6 +4,19 @@ Documentation=man:mandb(8)
|
||||||
|
ConditionACPower=true
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
+# added automatically, for details please see
|
||||||
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
+ProtectSystem=full
|
||||||
|
+ProtectHome=true
|
||||||
|
+PrivateDevices=true
|
||||||
|
+ProtectHostname=true
|
||||||
|
+ProtectClock=true
|
||||||
|
+ProtectKernelTunables=true
|
||||||
|
+ProtectKernelModules=true
|
||||||
|
+ProtectKernelLogs=true
|
||||||
|
+ProtectControlGroups=true
|
||||||
|
+RestrictRealtime=true
|
||||||
|
+# end of automatic additions
|
||||||
|
Type=oneshot
|
||||||
|
# Recover from deletion, per FHS.
|
||||||
|
ExecStart=+/usr/bin/install -d -o @cache_top_owner@ -g @cache_top_owner@ -m 0755 /var/cache/man
|
@ -8,6 +8,19 @@ ConditionPathExists=/var/cache/man
|
|||||||
ConditionPathExists=!/var/cache/man/index.db
|
ConditionPathExists=!/var/cache/man/index.db
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
|
# added automatically, for details please see
|
||||||
|
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
ProtectSystem=full
|
||||||
|
ProtectHome=true
|
||||||
|
PrivateDevices=true
|
||||||
|
ProtectHostname=true
|
||||||
|
ProtectClock=true
|
||||||
|
ProtectKernelTunables=true
|
||||||
|
ProtectKernelModules=true
|
||||||
|
ProtectKernelLogs=true
|
||||||
|
ProtectControlGroups=true
|
||||||
|
RestrictRealtime=true
|
||||||
|
# end of automatic additions
|
||||||
Type=oneshot
|
Type=oneshot
|
||||||
RemainAfterExit=yes
|
RemainAfterExit=yes
|
||||||
ExecStart=/usr/bin/mandb --quiet --create
|
ExecStart=/usr/bin/mandb --quiet --create
|
||||||
|
@ -1,3 +1,11 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Oct 6 11:41:21 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||||
|
|
||||||
|
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||||
|
* harden_man-db.service.patch
|
||||||
|
Modified:
|
||||||
|
* man-db-create.service
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Aug 6 13:38:49 UTC 2021 - Dr. Werner Fink <werner@suse.de>
|
Fri Aug 6 13:38:49 UTC 2021 - Dr. Werner Fink <werner@suse.de>
|
||||||
|
|
||||||
|
2
man.spec
2
man.spec
@ -57,6 +57,7 @@ Patch8: man-db-2.9.4.patch
|
|||||||
# PATCH-FEATURE-OPENSUSE -- Add documentation about man0 section (header files)
|
# PATCH-FEATURE-OPENSUSE -- Add documentation about man0 section (header files)
|
||||||
Patch9: man-db-2.6.3-man0.dif
|
Patch9: man-db-2.6.3-man0.dif
|
||||||
Patch10: man-db-2.9.4-alternitive.dif
|
Patch10: man-db-2.9.4-alternitive.dif
|
||||||
|
Patch11: harden_man-db.service.patch
|
||||||
BuildRequires: automake
|
BuildRequires: automake
|
||||||
BuildRequires: flex
|
BuildRequires: flex
|
||||||
BuildRequires: gdbm-devel
|
BuildRequires: gdbm-devel
|
||||||
@ -110,6 +111,7 @@ printer (using groff).
|
|||||||
%patch9 -b .s10
|
%patch9 -b .s10
|
||||||
%patch10 -b .libalernative
|
%patch10 -b .libalernative
|
||||||
rm -f configure
|
rm -f configure
|
||||||
|
%patch11 -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%global optflags %{optflags} -funroll-loops -pipe -Wall
|
%global optflags %{optflags} -funroll-loops -pipe -Wall
|
||||||
|
Loading…
Reference in New Issue
Block a user