diff --git a/harden_numad.service.patch b/harden_numad.service.patch new file mode 100644 index 0000000..0bc25f0 --- /dev/null +++ b/harden_numad.service.patch @@ -0,0 +1,20 @@ +Index: numad-0.5.20130522/numad.service +=================================================================== +--- numad-0.5.20130522.orig/numad.service ++++ numad-0.5.20130522/numad.service +@@ -2,6 +2,15 @@ + Description=numad - The NUMA daemon that manages application locality. + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++ProtectHostname=true ++ProtectKernelModules=true ++ProtectKernelLogs=true ++RestrictRealtime=true ++# end of automatic additions + Type=simple + EnvironmentFile=/etc/numad.conf + ExecStart=/usr/sbin/numad -i $INTERVAL -F diff --git a/numad.changes b/numad.changes index e1f8915..77aa5f1 100644 --- a/numad.changes +++ b/numad.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Oct 15 07:27:14 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_numad.service.patch + ------------------------------------------------------------------- Wed Jun 12 14:58:50 UTC 2019 - Dominique Leuenberger diff --git a/numad.spec b/numad.spec index 6f794ab..5856fec 100644 --- a/numad.spec +++ b/numad.spec @@ -1,7 +1,7 @@ # # spec file for package numad # -# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2021 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,14 +12,14 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # Name: numad -Url: http://git.fedorahosted.org/git/numad.git +URL: http://git.fedorahosted.org/git/numad.git Summary: Userspace daemon that automatically binds workloads to NUMA nodes -License: LGPL-2.1 +License: LGPL-2.1-only Group: System/Daemons Version: 0.5.20130522 Release: 0 @@ -32,6 +32,7 @@ Patch4: numad-versioning.patch Patch5: numad-rpm-opt-flags.patch Patch6: numad-opensuse-systemd.patch Patch7: numad-systemd-simple-type.patch +Patch8: harden_numad.service.patch %if 0%{?suse_version} > 1140 BuildRequires: pkgconfig(systemd) @@ -62,6 +63,7 @@ to regress performance. %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 %build make OPT_CFLAGS="$RPM_OPT_FLAGS" %{?_smp_mflags}