From bfff176f0235bcd751f966afb61ef473d4955be9b865005c04ef02f5a690a327 Mon Sep 17 00:00:00 2001
From: Danilo Spinella <danilo.spinella@suse.com>
Date: Mon, 22 Nov 2021 10:20:06 +0000
Subject: [PATCH] Accepting request 932184 from
 home:jsegitz:branches:systemdhardening:devel:languages:python

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/932184
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/rrdtool?expand=0&rev=91
---
 harden_rrdcached.service.patch | 24 ++++++++++++++++++++++++
 rrdcached.service              | 13 +++++++++++++
 rrdtool.changes                |  8 ++++++++
 rrdtool.spec                   |  2 ++
 4 files changed, 47 insertions(+)
 create mode 100644 harden_rrdcached.service.patch

diff --git a/harden_rrdcached.service.patch b/harden_rrdcached.service.patch
new file mode 100644
index 0000000..81e7728
--- /dev/null
+++ b/harden_rrdcached.service.patch
@@ -0,0 +1,24 @@
+Index: rrdtool-1.7.2/etc/rrdcached.service.in
+===================================================================
+--- rrdtool-1.7.2.orig/etc/rrdcached.service.in
++++ rrdtool-1.7.2/etc/rrdcached.service.in
+@@ -8,6 +8,19 @@ Description=Data caching daemon for rrdt
+ Documentation=man:rrdcached(1)
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ # If you enable socket-activable rrdcached.socket,
+ # command line socket declarations will be ignored
+ ExecStart=@prefix@/bin/rrdcached -g
diff --git a/rrdcached.service b/rrdcached.service
index de26f55..4b68f85 100644
--- a/rrdcached.service
+++ b/rrdcached.service
@@ -12,6 +12,19 @@ Wants=network.target
 After=network.target
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=forking
 ExecStartPre=-/bin/echo 'Starting RRD data caching service (rrdtools - rrdcached)'
 ExecStartPre=/bin/sh -c "/usr/share/rrdcached/rrdcached-systemd-pre"
diff --git a/rrdtool.changes b/rrdtool.changes
index f141f7c..c26e58e 100644
--- a/rrdtool.changes
+++ b/rrdtool.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Nov 16 08:36:04 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_rrdcached.service.patch
+  Modified:
+  * rrdcached.service
+
 -------------------------------------------------------------------
 Sun Sep 22 16:40:00 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>
 
diff --git a/rrdtool.spec b/rrdtool.spec
index 3d69c69..f5056cd 100644
--- a/rrdtool.spec
+++ b/rrdtool.spec
@@ -66,6 +66,7 @@ BuildRequires:  zlib-devel
 Requires:       dejavu
 %if 0%{?suse_version} >= 1500
 Patch13:        python3.patch
+Patch14:	harden_rrdcached.service.patch
 %endif
 %if %{with python}
 BuildRequires:  %{python}-devel
@@ -218,6 +219,7 @@ daemon was written to alleviate these problems.
 %if 0%{?suse_version} >= 1500
 %patch13 -p1
 %endif
+%patch14 -p1
 
 # rrd_tool/rrd_cgi: use the date of the last change
 modified="$(sed -n '/^----/n;s/ - .*$//;p;q' "%{_sourcedir}/%{name}.changes")"