diff --git a/harden_postfix.service.patch b/harden_postfix.service.patch deleted file mode 100644 index 44045ec..0000000 --- a/harden_postfix.service.patch +++ /dev/null @@ -1,25 +0,0 @@ -Index: postfix-3.6.2/postfix-SUSE/postfix.service -=================================================================== ---- postfix-3.6.2.orig/postfix-SUSE/postfix.service -+++ postfix-3.6.2/postfix-SUSE/postfix.service -@@ -19,6 +19,20 @@ After=amavis.service mysql.service cyrus - Conflicts=sendmail.service exim.service - - [Service] -+# added automatically, for details please see -+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort -+ProtectSystem=full -+ReadWritePaths=/etc/postfix -+ProtectHome=false -+PrivateDevices=true -+ProtectHostname=true -+ProtectClock=true -+ProtectKernelTunables=true -+ProtectKernelModules=true -+ProtectKernelLogs=true -+ProtectControlGroups=true -+RestrictRealtime=true -+# end of automatic additions - Type=forking - PIDFile=/var/spool/postfix/pid/master.pid - ExecStartPre=-/bin/echo 'Starting mail service (Postfix)' diff --git a/postfix-bdb.changes b/postfix-bdb.changes index 71c78ee..1e452bc 100644 --- a/postfix-bdb.changes +++ b/postfix-bdb.changes @@ -1,20 +1,3 @@ -------------------------------------------------------------------- -Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker - -- Ensure postfix can write to home directory or server side - filtering wont work (sieve) - -------------------------------------------------------------------- -Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz - -- Ensure service can write to /etc/postfix - -------------------------------------------------------------------- -Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz - -- Added hardening to systemd service (bsc#1181400). Added - harden_postfix.service.patch - ------------------------------------------------------------------- Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly diff --git a/postfix-bdb.spec b/postfix-bdb.spec index 60fee46..c814854 100644 --- a/postfix-bdb.spec +++ b/postfix-bdb.spec @@ -83,7 +83,6 @@ Patch8: postfix-vda-v14-3.0.3.patch Patch9: fix-postfix-script.patch Patch10: postfix-avoid-infinit-loop-if-no-permission.patch Patch11: postfix-3.6.2-glibc-234-build-fix.patch -Patch12: harden_postfix.service.patch BuildRequires: ca-certificates BuildRequires: cyrus-sasl-devel BuildRequires: db-devel @@ -158,7 +157,6 @@ lmdb. %patch9 %patch10 %patch11 -p1 -%patch12 -p1 # --------------------------------------------------------------------------- diff --git a/postfix.changes b/postfix.changes index 0f62028..4dfcfb2 100644 --- a/postfix.changes +++ b/postfix.changes @@ -1,20 +1,3 @@ -------------------------------------------------------------------- -Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker - -- Ensure postfix can write to home directory or server side - filtering wont work (sieve) - -------------------------------------------------------------------- -Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz - -- Ensure service can write to /etc/postfix - -------------------------------------------------------------------- -Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz - -- Added hardening to systemd service (bsc#1181400). Added - harden_postfix.service.patch - ------------------------------------------------------------------- Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly @@ -5319,3 +5302,4 @@ Mon Oct 9 13:54:13 CEST 2000 - choeger@suse.de Mon Oct 9 11:48:39 CEST 2000 - choeger@suse.de - inititial revision of pfixtls + diff --git a/postfix.spec b/postfix.spec index c3f7ade..9cb04a8 100644 --- a/postfix.spec +++ b/postfix.spec @@ -70,7 +70,6 @@ Patch9: fix-postfix-script.patch Patch10: %{name}-avoid-infinit-loop-if-no-permission.patch Patch11: set-default-db-type.patch Patch12: postfix-3.6.2-glibc-234-build-fix.patch -Patch13: harden_postfix.service.patch BuildRequires: ca-certificates BuildRequires: cyrus-sasl-devel #BuildRequires: db-devel @@ -178,7 +177,6 @@ maps with Postfix, you need this. %patch10 %patch11 %patch12 -p1 -%patch13 -p1 # ---------------------------------------------------------------------------