Accepting request 926927 from server:mail

Hardening

OBS-URL: https://build.opensuse.org/request/show/926927
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/postfix?expand=0&rev=211

harden_postfix.service.patch

@@ -0,0 +1,25 @@
+Index: postfix-3.6.2/postfix-SUSE/postfix.service
+===================================================================
+--- postfix-3.6.2.orig/postfix-SUSE/postfix.service
++++ postfix-3.6.2/postfix-SUSE/postfix.service
+@@ -19,6 +19,20 @@ After=amavis.service mysql.service cyrus
+ Conflicts=sendmail.service exim.service
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ReadWritePaths=/etc/postfix
++ProtectHome=false
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=forking
+ PIDFile=/var/spool/postfix/pid/master.pid
+ ExecStartPre=-/bin/echo 'Starting mail service (Postfix)'

postfix-bdb.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker <opensuse@dstoecker.de>
+
+- Ensure postfix can write to home directory or server side
+  filtering wont work (sieve)
+
+-------------------------------------------------------------------
+Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Ensure service can write to /etc/postfix
+
+-------------------------------------------------------------------
+Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service (bsc#1181400). Added
+  harden_postfix.service.patch
+
 -------------------------------------------------------------------
 Thu Oct  7 08:03:40 UTC 2021 - Peter Varkoly <varkoly@suse.com>
 

postfix-bdb.spec

@@ -83,6 +83,7 @@ Patch8:         postfix-vda-v14-3.0.3.patch
 Patch9:         fix-postfix-script.patch
 Patch10:        postfix-avoid-infinit-loop-if-no-permission.patch
 Patch11:	postfix-3.6.2-glibc-234-build-fix.patch
+Patch12:	harden_postfix.service.patch
 BuildRequires:  ca-certificates
 BuildRequires:  cyrus-sasl-devel
 BuildRequires:  db-devel
@@ -157,6 +158,7 @@ lmdb.
 %patch9
 %patch10
 %patch11 -p1
+%patch12 -p1
 
 # ---------------------------------------------------------------------------
 

postfix.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker <opensuse@dstoecker.de>
+
+- Ensure postfix can write to home directory or server side
+  filtering wont work (sieve)
+
+-------------------------------------------------------------------
+Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Ensure service can write to /etc/postfix
+
+-------------------------------------------------------------------
+Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service (bsc#1181400). Added
+  harden_postfix.service.patch
+
 -------------------------------------------------------------------
 Thu Oct  7 08:03:40 UTC 2021 - Peter Varkoly <varkoly@suse.com>
 
@@ -5302,4 +5319,3 @@ Mon Oct  9 13:54:13 CEST 2000 - choeger@suse.de
 Mon Oct  9 11:48:39 CEST 2000 - choeger@suse.de
 
 - inititial revision of pfixtls
-

postfix.spec

@@ -70,6 +70,7 @@ Patch9:         fix-postfix-script.patch
 Patch10:        %{name}-avoid-infinit-loop-if-no-permission.patch
 Patch11:	set-default-db-type.patch
 Patch12:	postfix-3.6.2-glibc-234-build-fix.patch
+Patch13:	harden_postfix.service.patch
 BuildRequires:  ca-certificates
 BuildRequires:  cyrus-sasl-devel
 #BuildRequires:  db-devel
@@ -177,6 +178,7 @@ maps with Postfix, you need this.
 %patch10
 %patch11
 %patch12 -p1
+%patch13 -p1
 
 # ---------------------------------------------------------------------------