Accepting request 928154 from network:utilities
OBS-URL: https://build.opensuse.org/request/show/928154 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/memcached?expand=0&rev=52
This commit is contained in:
commit
b0fe98b082
18
harden_memcached.service.patch
Normal file
18
harden_memcached.service.patch
Normal file
@ -0,0 +1,18 @@
|
||||
Index: memcached-1.6.9/scripts/memcached.service
|
||||
===================================================================
|
||||
--- memcached-1.6.9.orig/scripts/memcached.service
|
||||
+++ memcached-1.6.9/scripts/memcached.service
|
||||
@@ -41,6 +41,13 @@ CapabilityBoundingSet=CAP_SETGID CAP_SET
|
||||
# Restricts the set of socket address families accessible to the processes
|
||||
# of this unit. Protects against vulnerabilities such as CVE-2016-8655
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectHome=true
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelLogs=true
|
||||
+# end of automatic additions
|
||||
|
||||
|
||||
# Some security features are not in the older versions of systemd used by
|
@ -1,3 +1,11 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Oct 6 12:01:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||
* harden_memcached.service.patch
|
||||
Modified:
|
||||
* memcached.service
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 4 13:18:29 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
||||
|
||||
|
@ -3,6 +3,19 @@ Description=memcached daemon
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
# added automatically, for details please see
|
||||
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
ProtectSystem=full
|
||||
ProtectHome=true
|
||||
PrivateDevices=true
|
||||
ProtectHostname=true
|
||||
ProtectClock=true
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectControlGroups=true
|
||||
RestrictRealtime=true
|
||||
# end of automatic additions
|
||||
EnvironmentFile=/etc/sysconfig/memcached
|
||||
ExecStart=/usr/sbin/memcached -u $MEMCACHED_USER $MEMCACHED_PARAMS
|
||||
|
||||
|
@ -40,6 +40,7 @@ Source2: %{name}.sysconfig
|
||||
Source3: memcached-rpmlintrc
|
||||
Source4: memcached.service
|
||||
Source5: system-user-memcached.conf
|
||||
Patch0: harden_memcached.service.patch
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
BuildRequires: cyrus-sasl-devel
|
||||
@ -87,6 +88,7 @@ This package contains development files
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch0 -p1
|
||||
|
||||
%build
|
||||
autoreconf -fi
|
||||
|
Loading…
Reference in New Issue
Block a user