Accepting request 923531 from home:jsegitz:branches:systemdhardening:network:utilities
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/923531 OBS-URL: https://build.opensuse.org/package/show/network:utilities/memcached?expand=0&rev=86
This commit is contained in:
parent
b7f4d01d9c
commit
75e05f09fb
18
harden_memcached.service.patch
Normal file
18
harden_memcached.service.patch
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
Index: memcached-1.6.9/scripts/memcached.service
|
||||||
|
===================================================================
|
||||||
|
--- memcached-1.6.9.orig/scripts/memcached.service
|
||||||
|
+++ memcached-1.6.9/scripts/memcached.service
|
||||||
|
@@ -41,6 +41,13 @@ CapabilityBoundingSet=CAP_SETGID CAP_SET
|
||||||
|
# Restricts the set of socket address families accessible to the processes
|
||||||
|
# of this unit. Protects against vulnerabilities such as CVE-2016-8655
|
||||||
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||||
|
+# added automatically, for details please see
|
||||||
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
+ProtectHome=true
|
||||||
|
+ProtectHostname=true
|
||||||
|
+ProtectClock=true
|
||||||
|
+ProtectKernelLogs=true
|
||||||
|
+# end of automatic additions
|
||||||
|
|
||||||
|
|
||||||
|
# Some security features are not in the older versions of systemd used by
|
@ -1,3 +1,11 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Oct 6 12:01:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||||
|
|
||||||
|
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||||
|
* harden_memcached.service.patch
|
||||||
|
Modified:
|
||||||
|
* memcached.service
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Jun 4 13:18:29 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
Fri Jun 4 13:18:29 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
||||||
|
|
||||||
|
@ -3,6 +3,19 @@ Description=memcached daemon
|
|||||||
After=network.target
|
After=network.target
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
|
# added automatically, for details please see
|
||||||
|
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
ProtectSystem=full
|
||||||
|
ProtectHome=true
|
||||||
|
PrivateDevices=true
|
||||||
|
ProtectHostname=true
|
||||||
|
ProtectClock=true
|
||||||
|
ProtectKernelTunables=true
|
||||||
|
ProtectKernelModules=true
|
||||||
|
ProtectKernelLogs=true
|
||||||
|
ProtectControlGroups=true
|
||||||
|
RestrictRealtime=true
|
||||||
|
# end of automatic additions
|
||||||
EnvironmentFile=/etc/sysconfig/memcached
|
EnvironmentFile=/etc/sysconfig/memcached
|
||||||
ExecStart=/usr/sbin/memcached -u $MEMCACHED_USER $MEMCACHED_PARAMS
|
ExecStart=/usr/sbin/memcached -u $MEMCACHED_USER $MEMCACHED_PARAMS
|
||||||
|
|
||||||
|
@ -40,6 +40,7 @@ Source2: %{name}.sysconfig
|
|||||||
Source3: memcached-rpmlintrc
|
Source3: memcached-rpmlintrc
|
||||||
Source4: memcached.service
|
Source4: memcached.service
|
||||||
Source5: system-user-memcached.conf
|
Source5: system-user-memcached.conf
|
||||||
|
Patch0: harden_memcached.service.patch
|
||||||
BuildRequires: autoconf
|
BuildRequires: autoconf
|
||||||
BuildRequires: automake
|
BuildRequires: automake
|
||||||
BuildRequires: cyrus-sasl-devel
|
BuildRequires: cyrus-sasl-devel
|
||||||
@ -87,6 +88,7 @@ This package contains development files
|
|||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%setup -q
|
||||||
|
%patch0 -p1
|
||||||
|
|
||||||
%build
|
%build
|
||||||
autoreconf -fi
|
autoreconf -fi
|
||||||
|
Loading…
Reference in New Issue
Block a user