Accepting request 924887 from home:jsegitz:branches:systemdhardening:Base:System
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/924887 OBS-URL: https://build.opensuse.org/package/show/Base:System/nvme-cli?expand=0&rev=96
This commit is contained in:
parent
194a96e7e1
commit
c0f839dfcb
23
harden_nvmf-connect@.service.patch
Normal file
23
harden_nvmf-connect@.service.patch
Normal file
@ -0,0 +1,23 @@
|
||||
Index: nvme-cli-1.15/nvmf-autoconnect/systemd/nvmf-connect@.service
|
||||
===================================================================
|
||||
--- nvme-cli-1.15.orig/nvmf-autoconnect/systemd/nvmf-connect@.service
|
||||
+++ nvme-cli-1.15/nvmf-autoconnect/systemd/nvmf-connect@.service
|
||||
@@ -9,6 +9,18 @@ PartOf=nvmf-connect.target
|
||||
Requires=nvmf-connect.target
|
||||
|
||||
[Service]
|
||||
+# added automatically, for details please see
|
||||
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||
+ProtectSystem=full
|
||||
+ProtectHome=true
|
||||
+ProtectHostname=true
|
||||
+ProtectClock=true
|
||||
+ProtectKernelTunables=true
|
||||
+ProtectKernelModules=true
|
||||
+ProtectKernelLogs=true
|
||||
+ProtectControlGroups=true
|
||||
+RestrictRealtime=true
|
||||
+# end of automatic additions
|
||||
Type=simple
|
||||
Environment="CONNECT_ARGS=%i"
|
||||
ExecStart=/bin/sh -c "nvme connect-all --matching --quiet `/bin/echo -e '${CONNECT_ARGS}'`"
|
@ -1,3 +1,9 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 12 11:40:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||
* harden_nvmf-connect@.service.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Aug 18 13:19:10 UTC 2021 - Daniel Wagner <daniel.wagner@suse.com>
|
||||
|
||||
|
@ -27,6 +27,7 @@ Source: https://github.com/linux-nvme/nvme-cli/archive/v%{version}.tar.g
|
||||
Source2: nvme-cli-rpmlintrc
|
||||
# downstream patches:
|
||||
Patch102: 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
|
||||
Patch103: harden_nvmf-connect@.service.patch
|
||||
BuildRequires: libhugetlbfs-devel
|
||||
BuildRequires: libuuid-devel
|
||||
BuildRequires: pkgconfig
|
||||
@ -65,6 +66,7 @@ Optional dependency offering bash completion for NVM Express user space tools
|
||||
%prep
|
||||
%setup -q
|
||||
%patch102 -p1
|
||||
%patch103 -p1
|
||||
|
||||
%build
|
||||
echo %{version} > version
|
||||
|
Loading…
Reference in New Issue
Block a user