Accepting request 930777 from hardware

OBS-URL: https://build.opensuse.org/request/show/930777
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/powerman?expand=0&rev=27

harden_powerman.service.patch

@@ -0,0 +1,22 @@
+Index: powerman-2.3.26/scripts/powerman.service.in
+===================================================================
+--- powerman-2.3.26.orig/scripts/powerman.service.in
++++ powerman-2.3.26/scripts/powerman.service.in
+@@ -5,6 +5,17 @@ After=syslog.target network.target
+ [Service]
+ Type=forking
+ PrivateTmp=yes
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++ProtectHostname=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ User=@RUN_AS_USER@
+ Group=@RUN_AS_GROUP@
+ ExecStart=/usr/sbin/powermand

powerman.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Oct 19 13:06:07 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_powerman.service.patch
+
 -------------------------------------------------------------------
 Thu May 13 07:54:21 UTC 2021 - pgajdos@suse.com
 

powerman.spec

@@ -39,6 +39,7 @@ URL:            https://github.com/chaos/powerman
 Source0:        https://github.com/chaos/%{name}/releases/download/%{version}/%{name}-%{version}.tar.gz
 Patch1:         service-dynamic-user-autofiles.patch
 Patch2:         service-dynamic-user-configure.patch
+Patch3:         harden_powerman.service.patch
 BuildRequires:  automake
 BuildRequires:  fdupes
 BuildRequires:  ncurses-devel
@@ -80,6 +81,7 @@ Header files, pkg-config file and man pages for developing applications using Po
 %setup -q
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 %configure \