From 138347db68bed1f13b08ce639fbed65245fe6f2cac034c6a2dccdd0f4ce4c3f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20V=C3=B6gl?= Date: Wed, 1 Sep 2021 09:02:20 +0000 Subject: [PATCH 1/2] Accepting request 915057 from home:jsegitz:branches:systemdhardening:server:monitoring Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/915057 OBS-URL: https://build.opensuse.org/package/show/server:monitoring/collectd?expand=0&rev=172 --- collectd.changes | 6 ++++++ collectd.spec | 2 ++ harden_collectd.service.patch | 24 ++++++++++++++++++++++++ 3 files changed, 32 insertions(+) create mode 100644 harden_collectd.service.patch diff --git a/collectd.changes b/collectd.changes index 9c83c56..23e7ef4 100644 --- a/collectd.changes +++ b/collectd.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Aug 30 08:09:48 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s). Added patch(es): + * harden_collectd.service.patch + ------------------------------------------------------------------- Mon Jun 28 13:17:32 UTC 2021 - Matwey Kornilov diff --git a/collectd.spec b/collectd.spec index 4c13dd9..59ceac0 100644 --- a/collectd.spec +++ b/collectd.spec @@ -64,6 +64,7 @@ Patch7: collectd-fix_collectd_config_path_in_snmp_probe.patch Patch8: 9e36cd85a2bb_sigrok_Update_to_support_libsigrok_0_4.patch # PATCH-FIX-OPENSUSE avoid-pg-config.patch avoid pg_config if possible Patch11: avoid-pg-config.patch +Patch12: harden_collectd.service.patch # for /etc/apache2/... ownership (rpmlint): BuildRequires: apache2 BuildRequires: autoconf @@ -558,6 +559,7 @@ to write %{name} unixsock clients. %patch8 -p1 %endif %patch11 -p1 +%patch12 -p1 sed -i 's|@@VERSION@@|%{version}|g' configure.ac diff --git a/harden_collectd.service.patch b/harden_collectd.service.patch new file mode 100644 index 0000000..330d641 --- /dev/null +++ b/harden_collectd.service.patch @@ -0,0 +1,24 @@ +Index: collectd-5.12.0/contrib/systemd.collectd.service +=================================================================== +--- collectd-5.12.0.orig/contrib/systemd.collectd.service ++++ collectd-5.12.0/contrib/systemd.collectd.service +@@ -5,6 +5,19 @@ After=local-fs.target network-online.tar + Requires=local-fs.target network-online.target + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++PrivateDevices=true ++ProtectHostname=true ++ProtectClock=true ++ProtectKernelTunables=true ++ProtectKernelModules=true ++ProtectKernelLogs=true ++ProtectControlGroups=true ++RestrictRealtime=true ++# end of automatic additions + ExecStart=/usr/sbin/collectd + EnvironmentFile=-/etc/sysconfig/collectd + EnvironmentFile=-/etc/default/collectd From fc23dd9e28525b0f05903e18ab17a7bb3821f0943dad4fc280f4c05b43dd0085 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20V=C3=B6gl?= Date: Wed, 1 Sep 2021 12:18:57 +0000 Subject: [PATCH 2/2] Accepting request 915471 from home:cvoegl:branches:server:monitoring - Disabled the mqtt plugin for SLES and the modbus plugin for everything except Tumpleweed as the dependencies are not met in those distributions - Added the modbus plugin as dependency to plugins-all OBS-URL: https://build.opensuse.org/request/show/915471 OBS-URL: https://build.opensuse.org/package/show/server:monitoring/collectd?expand=0&rev=173 --- collectd.changes | 8 ++++++++ collectd.spec | 17 +++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/collectd.changes b/collectd.changes index 23e7ef4..4b8aa13 100644 --- a/collectd.changes +++ b/collectd.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Wed Sep 1 11:14:56 UTC 2021 - Christian Vögl + +- Disabled the mqtt plugin for SLES and the modbus plugin for + everything except Tumpleweed as the dependencies are not met in + those distributions +- Added the modbus plugin as dependency to plugins-all + ------------------------------------------------------------------- Mon Aug 30 08:09:48 UTC 2021 - Johannes Segitz diff --git a/collectd.spec b/collectd.spec index 59ceac0..774fa2f 100644 --- a/collectd.spec +++ b/collectd.spec @@ -110,8 +110,12 @@ BuildRequires: pkgconfig(libiptc) BuildRequires: pkgconfig(libmemcached) BuildRequires: pkgconfig(libmicrohttpd) BuildRequires: pkgconfig(libmnl) +%if 0%{?suse_version} > 1500 BuildRequires: pkgconfig(libmodbus) +%endif +%if 0%{?is_opensuse} BuildRequires: pkgconfig(libmosquitto) +%endif BuildRequires: pkgconfig(libnotify) BuildRequires: pkgconfig(liboping) BuildRequires: pkgconfig(libpq) @@ -296,6 +300,7 @@ Requires: %{name} = %{version}-%{release} %description plugin-memcachec Optional %{name} plugin to sample memcached statistics. +%if 0%{?suse_version} > 1500 %package plugin-modbus Summary: TCP Modbus Plugin for %{name} Group: System/Monitoring @@ -303,7 +308,9 @@ Requires: %{name} = %{version}-%{release} %description plugin-modbus Optional %{name} plugin to communicate with TCP Modbus devices. +%endif +%if 0%{?is_opensuse} %package plugin-mqtt Summary: MQTT Plugin for %{name} Group: System/Monitoring @@ -311,6 +318,7 @@ Requires: %{name} = %{version}-%{release} %description plugin-mqtt Optional %{name} plugin to send and receive MQTT messages. +%endif %package plugin-pinba Summary: Pinba Collector Plugin for %{name} @@ -483,7 +491,12 @@ Requires: %{name}-plugin-logparser = %{version}-%{release} Requires: %{name}-plugin-lua = %{version}-%{release} Requires: %{name}-plugin-mcelog = %{version}-%{release} Requires: %{name}-plugin-memcachec = %{version}-%{release} +%if 0%{?suse_version} > 1500 +Requires: %{name}-plugin-modbus = %{version}-%{release} +%endif +%if 0%{?is_opensuse} Requires: %{name}-plugin-mqtt = %{version}-%{release} +%endif Requires: %{name}-plugin-mysql = %{version}-%{release} Requires: %{name}-plugin-notify-desktop = %{version}-%{release} Requires: %{name}-plugin-openldap = %{version}-%{release} @@ -817,13 +830,17 @@ ln -s %{_sbindir}/service %{buildroot}%{_sbindir}/rc%{name} %{_libdir}/collectd/memcachec.so %{_libdir}/collectd/memcachec.la +%if 0%{?suse_version} > 1500 %files plugin-modbus %{_libdir}/collectd/modbus.so %{_libdir}/collectd/modbus.la +%endif +%if 0%{?is_opensuse} %files plugin-mqtt %{_libdir}/collectd/mqtt.so %{_libdir}/collectd/mqtt.la +%endif %if 0%{?sle_version} < 150000 || 0%{?is_opensuse}