rpm/frr
SHA256
1
0
Fork 0
forked from pool/frr
Code Pull Requests Activity

Accepting request 937520 from home:jsegitz:branches:systemdhardening:network

Browse Source 
- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).

OBS-URL: https://build.opensuse.org/request/show/937520
OBS-URL: https://build.opensuse.org/package/show/network/frr?expand=0&rev=36
This commit is contained in:
Martin Hauke 2021-12-09 09:26:15 +00:00 committed by Git OBS Bridge
parent 4daa3f80a5
commit 2fc51f9063
2 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
frr.changes
View File

@ -1,3 +1,8 @@
-------------------------------------------------------------------
Thu Dec 9 08:40:11 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Add ReadWritePaths=/etc/frr to harden_frr.service.patch (bsc#1181400).
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Nov 17 05:48:12 UTC 2021 - Linnaea Lavia <linnaea@lavia.moe> Wed Nov 17 05:48:12 UTC 2021 - Linnaea Lavia <linnaea@lavia.moe>

18
harden_frr.service.patch
View File

@ -1,14 +1,15 @@
Index: frr-frr-8.0.1/tools/frr.service.in Index: frr-frr-8.1/tools/frr.service.in
=================================================================== ===================================================================
--- frr-frr-8.0.1.orig/tools/frr.service.in --- frr-frr-8.1.orig/tools/frr.service.in
+++ frr-frr-8.0.1/tools/frr.service.in +++ frr-frr-8.1/tools/frr.service.in
@@ -7,6 +7,15 @@ Before=network.target @@ -7,6 +7,16 @@ Before=network.target
OnFailure=heartbeat-failed@%n OnFailure=heartbeat-failed@%n
[Service] [Service]
+# added automatically, for details please see +# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full +ProtectSystem=full
+ReadWritePaths=/etc/frr
+ProtectHome=true +ProtectHome=true
+ProtectKernelModules=true +ProtectKernelModules=true
+ProtectKernelLogs=true +ProtectKernelLogs=true
@ -18,17 +19,18 @@ Index: frr-frr-8.0.1/tools/frr.service.in
Nice=-5 Nice=-5
Type=forking Type=forking
NotifyAccess=all NotifyAccess=all
Index: frr-frr-8.0.1/tools/frr@.service.in Index: frr-frr-8.1/tools/frr@.service.in
=================================================================== ===================================================================
--- frr-frr-8.0.1.orig/tools/frr@.service.in --- frr-frr-8.1.orig/tools/frr@.service.in
+++ frr-frr-8.0.1/tools/frr@.service.in +++ frr-frr-8.1/tools/frr@.service.in
@@ -7,6 +7,15 @@ Before=network.target @@ -7,6 +7,16 @@ Before=network.target
OnFailure=heartbeat-failed@%n OnFailure=heartbeat-failed@%n
[Service] [Service]
+# added automatically, for details please see +# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full +ProtectSystem=full
+ReadWritePaths=/etc/frr
+ProtectHome=true +ProtectHome=true
+ProtectKernelModules=true +ProtectKernelModules=true
+ProtectKernelLogs=true +ProtectKernelLogs=true