From 2fc51f90636ccf970b0230288b8107e2366f120ed0e376c84adf420702c06568 Mon Sep 17 00:00:00 2001 From: Martin Hauke Date: Thu, 9 Dec 2021 09:26:15 +0000 Subject: [PATCH] Accepting request 937520 from home:jsegitz:branches:systemdhardening:network - Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400). OBS-URL: https://build.opensuse.org/request/show/937520 OBS-URL: https://build.opensuse.org/package/show/network/frr?expand=0&rev=36 --- frr.changes | 5 +++++ harden_frr.service.patch | 18 ++++++++++-------- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/frr.changes b/frr.changes index ae61d67..da741c9 100644 --- a/frr.changes +++ b/frr.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Thu Dec 9 08:40:11 UTC 2021 - Johannes Segitz + +- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400). + ------------------------------------------------------------------- Wed Nov 17 05:48:12 UTC 2021 - Linnaea Lavia diff --git a/harden_frr.service.patch b/harden_frr.service.patch index 5267b21..daef202 100644 --- a/harden_frr.service.patch +++ b/harden_frr.service.patch @@ -1,14 +1,15 @@ -Index: frr-frr-8.0.1/tools/frr.service.in +Index: frr-frr-8.1/tools/frr.service.in =================================================================== ---- frr-frr-8.0.1.orig/tools/frr.service.in -+++ frr-frr-8.0.1/tools/frr.service.in -@@ -7,6 +7,15 @@ Before=network.target +--- frr-frr-8.1.orig/tools/frr.service.in ++++ frr-frr-8.1/tools/frr.service.in +@@ -7,6 +7,16 @@ Before=network.target OnFailure=heartbeat-failed@%n [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full ++ReadWritePaths=/etc/frr +ProtectHome=true +ProtectKernelModules=true +ProtectKernelLogs=true @@ -18,17 +19,18 @@ Index: frr-frr-8.0.1/tools/frr.service.in Nice=-5 Type=forking NotifyAccess=all -Index: frr-frr-8.0.1/tools/frr@.service.in +Index: frr-frr-8.1/tools/frr@.service.in =================================================================== ---- frr-frr-8.0.1.orig/tools/frr@.service.in -+++ frr-frr-8.0.1/tools/frr@.service.in -@@ -7,6 +7,15 @@ Before=network.target +--- frr-frr-8.1.orig/tools/frr@.service.in ++++ frr-frr-8.1/tools/frr@.service.in +@@ -7,6 +7,16 @@ Before=network.target OnFailure=heartbeat-failed@%n [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full ++ReadWritePaths=/etc/frr +ProtectHome=true +ProtectKernelModules=true +ProtectKernelLogs=true