rpm/collectd
SHA256
1
0
Fork 0
forked from pool/collectd
Code Pull Requests Activity

Accepting request 915057 from home:jsegitz:branches:systemdhardening:server:monitoring

Browse Source 
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort

OBS-URL: https://build.opensuse.org/request/show/915057
OBS-URL: https://build.opensuse.org/package/show/server:monitoring/collectd?expand=0&rev=172
This commit is contained in:
Christian Vögl 2021-09-01 09:02:20 +00:00 committed by Git OBS Bridge
parent 6b28d49cf9
commit 138347db68
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
collectd.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Mon Aug 30 08:09:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service(s). Added patch(es):
* harden_collectd.service.patch
-------------------------------------------------------------------
Mon Jun 28 13:17:32 UTC 2021 - Matwey Kornilov <matwey.kornilov@gmail.com>

2
collectd.spec
View File

@ -64,6 +64,7 @@ Patch7: collectd-fix_collectd_config_path_in_snmp_probe.patch
Patch8: 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch
# PATCH-FIX-OPENSUSE avoid-pg-config.patch avoid pg_config if possible
Patch11: avoid-pg-config.patch
Patch12: harden_collectd.service.patch
# for /etc/apache2/... ownership (rpmlint):
BuildRequires: apache2
BuildRequires: autoconf
@ -558,6 +559,7 @@ to write %{name} unixsock clients.
%patch8 -p1
%endif
%patch11 -p1
%patch12 -p1
sed -i 's|@@VERSION@@|%{version}|g' configure.ac

24
harden_collectd.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: collectd-5.12.0/contrib/systemd.collectd.service
===================================================================
--- collectd-5.12.0.orig/contrib/systemd.collectd.service
+++ collectd-5.12.0/contrib/systemd.collectd.service
@@ -5,6 +5,19 @@ After=local-fs.target network-online.tar
Requires=local-fs.target network-online.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
ExecStart=/usr/sbin/collectd
EnvironmentFile=-/etc/sysconfig/collectd
EnvironmentFile=-/etc/default/collectd