rpm/argus
SHA256
1
0
Fork 0
forked from pool/argus
Code Pull Requests Activity

Accepting request 912408 from security

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/912408
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/argus?expand=0&rev=29
This commit is contained in:
Richard Brown 2021-08-18 06:55:52 +00:00 committed by Git OBS Bridge
commit 718bf9bdd6
4 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
argus.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Tue Aug 10 11:50:18 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s). Added patch(es):
* harden_argus.service.patch
Modified:
* argus.service
-------------------------------------------------------------------
Thu Jun 3 16:02:21 UTC 2021 - Ferdinand Thiessen <rpm@fthiessen.de>

13
argus.service
View File

@ -3,6 +3,19 @@ Description=Argus generates network transaction audit records
After=syslog.target network.target
[Service]
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
PIDFile=/var/run/argus.pid
ExecStart=/usr/sbin/argus -d

2
argus.spec
View File

@ -28,6 +28,7 @@ Source3: README.SUSE
Source4: argus_linux.8.gz
Source5: argus.service
Patch1: %{name}-3.0.6.1-libpcap.patch
Patch2: harden_argus.service.patch
BuildRequires: bison
BuildRequires: flex
BuildRequires: libnsl-devel
@ -56,6 +57,7 @@ Daemon for Argus network monitoring tool.
%patch1 -p1
cp %{SOURCE3} .
cp %{SOURCE4} man/man8/
%patch2 -p1
%build
#autoreconf -fiv

24
harden_argus.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: argus-3.0.8.3/support/Startup/argus.service
===================================================================
--- argus-3.0.8.3.orig/support/Startup/argus.service
+++ argus-3.0.8.3/support/Startup/argus.service
@@ -12,6 +12,19 @@ After=network.target
# This was tested on Fedora 16
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
ExecStartPre=/sbin/ifconfig em2 up
ExecStart=/usr/local/sbin/argus