From 3c1f222e373f31d08216608c623c2920cdae4876b2e081f1354e8ebcda5d948d Mon Sep 17 00:00:00 2001
From: Dirk Mueller <dmueller@suse.com>
Date: Sun, 21 Nov 2021 11:09:01 +0000
Subject: [PATCH] Accepting request 932194 from
 home:jsegitz:branches:systemdhardening:network

Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/932194
OBS-URL: https://build.opensuse.org/package/show/network/rsync?expand=0&rev=84
---
 rsync.changes  | 6 ++++++
 rsyncd.service | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/rsync.changes b/rsync.changes
index ad16712..d4969a6 100644
--- a/rsync.changes
+++ b/rsync.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Nov 16 08:59:11 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Modified:
+  * rsyncd.service
+
 -------------------------------------------------------------------
 Fri Sep  4 10:25:17 UTC 2020 - Pedro Monreal <pmonreal@suse.com>
 
diff --git a/rsyncd.service b/rsyncd.service
index 89ebbd8..4c7bd65 100644
--- a/rsyncd.service
+++ b/rsyncd.service
@@ -8,6 +8,15 @@ ExecStart=/usr/sbin/rsyncd --daemon --no-detach
 IOSchedulingClass=idle
 CPUSchedulingPolicy=batch
 PrivateTmp=true
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 
 [Install]
 WantedBy=multi-user.target