harden_openfortivpn@.service.patch

diff --git a/lib/systemd/system/openfortivpn@.service.in b/lib/systemd/system/openfortivpn@.service.in
index 1249037..741ae07 100644
--- a/lib/systemd/system/openfortivpn@.service.in
+++ b/lib/systemd/system/openfortivpn@.service.in
@@ -9,6 +9,17 @@ Documentation=https://github.com/adrienverge/openfortivpn/wiki
 [Service]
 Type=notify
 PrivateTmp=true
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 ExecStart=@BINDIR@/openfortivpn -c @SYSCONFDIR@/openfortivpn/%I.conf
 Restart=on-failure
 OOMScoreAdjust=-100
Accepting request 966250 from home:mnhauke - Update to version 1.17.2 * fix memory leak when reading user input * improve calls to getsockopt() and associated debug output * allow reading config from process substitution * work around CodeQL false positives, improving code at the same time * change type of systemd.service from simple to notify OBS-URL: https://build.opensuse.org/request/show/966250 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=36 2022-04-01 13:14:22 +00:00			`diff --git a/lib/systemd/system/openfortivpn@.service.in b/lib/systemd/system/openfortivpn@.service.in`
Accepting request 1096575 from home:mnhauke - Update to version 1.20.5 * revert previous fix from 1.20.4, make it optional. - Update to version 1.20.4 * fix "Peer refused to agree to his IP address" message. - Update to version 1.20.3 * minor change in a warning message. * documentation improvement. * minor changes in build and test files. - Update to version 1.20.2 * fix regression: do attempt to apply duplicate routes, log INFO instead of WARN. * minor changes in log messages. - Update patch: * harden_openfortivpn@.service.patch OBS-URL: https://build.opensuse.org/request/show/1096575 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=44 2023-07-05 14:36:42 +00:00			`index 1249037..741ae07 100644`
Accepting request 966250 from home:mnhauke - Update to version 1.17.2 * fix memory leak when reading user input * improve calls to getsockopt() and associated debug output * allow reading config from process substitution * work around CodeQL false positives, improving code at the same time * change type of systemd.service from simple to notify OBS-URL: https://build.opensuse.org/request/show/966250 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=36 2022-04-01 13:14:22 +00:00			`--- a/lib/systemd/system/openfortivpn@.service.in`
			`+++ b/lib/systemd/system/openfortivpn@.service.in`
Accepting request 1096575 from home:mnhauke - Update to version 1.20.5 * revert previous fix from 1.20.4, make it optional. - Update to version 1.20.4 * fix "Peer refused to agree to his IP address" message. - Update to version 1.20.3 * minor change in a warning message. * documentation improvement. * minor changes in build and test files. - Update to version 1.20.2 * fix regression: do attempt to apply duplicate routes, log INFO instead of WARN. * minor changes in log messages. - Update patch: * harden_openfortivpn@.service.patch OBS-URL: https://build.opensuse.org/request/show/1096575 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=44 2023-07-05 14:36:42 +00:00			`@@ -9,6 +9,17 @@ Documentation=https://github.com/adrienverge/openfortivpn/wiki`
Accepting request 925134 from home:jsegitz:branches:systemdhardening:network:vpn Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/925134 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=33 2021-10-17 12:59:54 +00:00			`[Service]`
Accepting request 966250 from home:mnhauke - Update to version 1.17.2 * fix memory leak when reading user input * improve calls to getsockopt() and associated debug output * allow reading config from process substitution * work around CodeQL false positives, improving code at the same time * change type of systemd.service from simple to notify OBS-URL: https://build.opensuse.org/request/show/966250 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=36 2022-04-01 13:14:22 +00:00			`Type=notify`
Accepting request 925134 from home:jsegitz:branches:systemdhardening:network:vpn Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/925134 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=33 2021-10-17 12:59:54 +00:00			`PrivateTmp=true`
			`+# added automatically, for details please see`
			`+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort`
			`+ProtectSystem=full`
			`+ProtectHome=true`
			`+ProtectHostname=true`
			`+ProtectKernelTunables=true`
			`+ProtectKernelModules=true`
			`+ProtectKernelLogs=true`
			`+ProtectControlGroups=true`
			`+RestrictRealtime=true`
			`+# end of automatic additions`
			`ExecStart=@BINDIR@/openfortivpn -c @SYSCONFDIR@/openfortivpn/%I.conf`
Accepting request 1096575 from home:mnhauke - Update to version 1.20.5 * revert previous fix from 1.20.4, make it optional. - Update to version 1.20.4 * fix "Peer refused to agree to his IP address" message. - Update to version 1.20.3 * minor change in a warning message. * documentation improvement. * minor changes in build and test files. - Update to version 1.20.2 * fix regression: do attempt to apply duplicate routes, log INFO instead of WARN. * minor changes in log messages. - Update patch: * harden_openfortivpn@.service.patch OBS-URL: https://build.opensuse.org/request/show/1096575 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=44 2023-07-05 14:36:42 +00:00			`Restart=on-failure`
Accepting request 925134 from home:jsegitz:branches:systemdhardening:network:vpn Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/925134 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openfortivpn?expand=0&rev=33 2021-10-17 12:59:54 +00:00			`OOMScoreAdjust=-100`