88fb4f57d3
- Add pesign-bsc1202933-Use-normal-file-permissions-instead-of-ACLs.patch to use the normal file permissions in pesign-authorize to avoid the potential security issue (bsc#1202933, CVE-2022-3560) - Set the libexecdir path for "make" to fix the path to pesign-authorize in pesign.service (bsc#1202933) - Add pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch to make the default NSS datebase writeable (bsc#1202933) OBS-URL: https://build.opensuse.org/request/show/1063580 OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign?expand=0&rev=68
26 lines
760 B
Diff
26 lines
760 B
Diff
From 73cd25615367ff1f9a19fdfd38017f68a12a354d Mon Sep 17 00:00:00 2001
|
|
From: Gary Lin <glin@suse.com>
|
|
Date: Tue, 7 Feb 2023 15:34:09 +0800
|
|
Subject: [PATCH] Make /etc/pki/pesign/ writeable
|
|
|
|
The default NSS database for the pesign daemon is stored in /etc/pki/pesign/.
|
|
Make it writeable after hardening the service.
|
|
|
|
Signed-off-by: Gary Lin <glin@suse.com>
|
|
---
|
|
src/pesign.service.in | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/src/pesign.service.in b/src/pesign.service.in
|
|
index 87accee..8542c63 100644
|
|
--- a/src/pesign.service.in
|
|
+++ b/src/pesign.service.in
|
|
@@ -20,3 +20,4 @@ Type=forking
|
|
PIDFile=/run/pesign.pid
|
|
ExecStart=/usr/bin/pesign --daemonize
|
|
ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize
|
|
+ReadWritePaths=/etc/pki/pesign/
|
|
--
|
|
2.35.3
|
|
|