Accepting request 923541 from Base:System

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort (forwarded request 923524 from jsegitz)

OBS-URL: https://build.opensuse.org/request/show/923541
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/man?expand=0&rev=88
This commit is contained in:
Dominique Leuenberger 2021-10-11 13:30:27 +00:00 committed by Git OBS Bridge
commit d8fb79d19c
4 changed files with 47 additions and 0 deletions

View File

@ -0,0 +1,24 @@
Index: man-db-2.9.4/init/systemd/man-db.service.in
===================================================================
--- man-db-2.9.4.orig/init/systemd/man-db.service.in
+++ man-db-2.9.4/init/systemd/man-db.service.in
@@ -4,6 +4,19 @@ Documentation=man:mandb(8)
ConditionACPower=true
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=oneshot
# Recover from deletion, per FHS.
ExecStart=+/usr/bin/install -d -o @cache_top_owner@ -g @cache_top_owner@ -m 0755 /var/cache/man

View File

@ -8,6 +8,19 @@ ConditionPathExists=/var/cache/man
ConditionPathExists=!/var/cache/man/index.db
[Service]
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/mandb --quiet --create

View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Wed Oct 6 11:41:21 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
* harden_man-db.service.patch
Modified:
* man-db-create.service
-------------------------------------------------------------------
Fri Aug 6 13:38:49 UTC 2021 - Dr. Werner Fink <werner@suse.de>

View File

@ -57,6 +57,7 @@ Patch8: man-db-2.9.4.patch
# PATCH-FEATURE-OPENSUSE -- Add documentation about man0 section (header files)
Patch9: man-db-2.6.3-man0.dif
Patch10: man-db-2.9.4-alternitive.dif
Patch11: harden_man-db.service.patch
BuildRequires: automake
BuildRequires: flex
BuildRequires: gdbm-devel
@ -110,6 +111,7 @@ printer (using groff).
%patch9 -b .s10
%patch10 -b .libalernative
rm -f configure
%patch11 -p1
%build
%global optflags %{optflags} -funroll-loops -pipe -Wall