Accepting request 926714 from home:jsegitz:branches:systemdhardening:network:messaging:amqp

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/926714
OBS-URL: https://build.opensuse.org/package/show/network:messaging:amqp/rabbitmq-server?expand=0&rev=173

harden_rabbitmq-server.service.patch

@@ -0,0 +1,24 @@
+Index: rabbitmq-server-3.9.8/deps/rabbit/docs/rabbitmq-server.service.example
+===================================================================
+--- rabbitmq-server-3.9.8.orig/deps/rabbit/docs/rabbitmq-server.service.example
++++ rabbitmq-server-3.9.8/deps/rabbit/docs/rabbitmq-server.service.example
+@@ -5,6 +5,19 @@ After=network.target epmd@0.0.0.0.socket
+ Wants=network.target epmd@0.0.0.0.socket
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=notify
+ User=rabbitmq
+ Group=rabbitmq

rabbitmq-server.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Thu Oct 21 08:16:10 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_rabbitmq-server.service.patch
+  Modified:
+  * rabbitmq-server.service
+
 -------------------------------------------------------------------
 Wed Oct 20 11:17:30 UTC 2021 - Fusion Future <qydwhotmail@gmail.com>
 

rabbitmq-server.service

@@ -4,6 +4,19 @@ After=syslog.target network.target epmd.service
 BindsTo=epmd.service
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=notify
 User=rabbitmq
 Group=rabbitmq

rabbitmq-server.spec

@@ -54,6 +54,7 @@ Source4:        rabbitmq-env.conf
 Source6:        rabbitmq-server.service
 Source7:        https://raw.githubusercontent.com/rabbitmq/rabbitmq-packaging/v%{version}/RPMS/Fedora/rabbitmq-server.tmpfiles
 Source8:        README.SUSE
+Patch0:	harden_rabbitmq-server.service.patch
 BuildRequires:  elixir
 # https://www.rabbitmq.com/which-erlang.html
 BuildRequires:  erlang >= 23.2
@@ -130,6 +131,7 @@ Optional dependency offering zsh completion for %{name}.
 %prep
 %setup -q
 cp %{SOURCE8} .
+%patch0 -p1
 
 %build
 # Make elixir happy with Unicode