Accepting request 932184 from home:jsegitz:branches:systemdhardening:devel:languages:python

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/932184
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/rrdtool?expand=0&rev=91

harden_rrdcached.service.patch

@@ -0,0 +1,24 @@
+Index: rrdtool-1.7.2/etc/rrdcached.service.in
+===================================================================
+--- rrdtool-1.7.2.orig/etc/rrdcached.service.in
++++ rrdtool-1.7.2/etc/rrdcached.service.in
+@@ -8,6 +8,19 @@ Description=Data caching daemon for rrdt
+ Documentation=man:rrdcached(1)
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++PrivateDevices=true
++ProtectHostname=true
++ProtectClock=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ # If you enable socket-activable rrdcached.socket,
+ # command line socket declarations will be ignored
+ ExecStart=@prefix@/bin/rrdcached -g

rrdcached.service

@@ -12,6 +12,19 @@ Wants=network.target
 After=network.target
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=forking
 ExecStartPre=-/bin/echo 'Starting RRD data caching service (rrdtools - rrdcached)'
 ExecStartPre=/bin/sh -c "/usr/share/rrdcached/rrdcached-systemd-pre"

rrdtool.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Nov 16 08:36:04 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_rrdcached.service.patch
+  Modified:
+  * rrdcached.service
+
 -------------------------------------------------------------------
 Sun Sep 22 16:40:00 UTC 2019 - Andreas Stieger <andreas.stieger@gmx.de>
 

rrdtool.spec

@@ -66,6 +66,7 @@ BuildRequires:  zlib-devel
 Requires:       dejavu
 %if 0%{?suse_version} >= 1500
 Patch13:        python3.patch
+Patch14:	harden_rrdcached.service.patch
 %endif
 %if %{with python}
 BuildRequires:  %{python}-devel
@@ -218,6 +219,7 @@ daemon was written to alleviate these problems.
 %if 0%{?suse_version} >= 1500
 %patch13 -p1
 %endif
+%patch14 -p1
 
 # rrd_tool/rrd_cgi: use the date of the last change
 modified="$(sed -n '/^----/n;s/ - .*$//;p;q' "%{_sourcedir}/%{name}.changes")"