forked from pool/mariadb
Accepting request 923533 from home:jsegitz:branches:systemdhardening:server:database
Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/923533 OBS-URL: https://build.opensuse.org/package/show/server:database/mariadb?expand=0&rev=281
This commit is contained in:
parent
8686aa890f
commit
3262458610
21
harden_mariadb.service.patch
Normal file
21
harden_mariadb.service.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
Index: mariadb-10.6.4/support-files/mariadb.service.in
|
||||||
|
===================================================================
|
||||||
|
--- mariadb-10.6.4.orig/support-files/mariadb.service.in
|
||||||
|
+++ mariadb-10.6.4/support-files/mariadb.service.in
|
||||||
|
@@ -29,6 +29,16 @@ WantedBy=multi-user.target
|
||||||
|
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
+# added automatically, for details please see
|
||||||
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
+ProtectHostname=true
|
||||||
|
+ProtectClock=true
|
||||||
|
+ProtectKernelTunables=true
|
||||||
|
+ProtectKernelModules=true
|
||||||
|
+ProtectKernelLogs=true
|
||||||
|
+ProtectControlGroups=true
|
||||||
|
+RestrictRealtime=true
|
||||||
|
+# end of automatic additions
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
## Core requirements
|
@ -3,6 +3,14 @@ Thu Oct 7 15:02:44 UTC 2021 - Danilo Spinella <danilo.spinella@suse.com>
|
|||||||
|
|
||||||
- Fix socket address in mariadb@.socket file
|
- Fix socket address in mariadb@.socket file
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Oct 6 11:43:40 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||||
|
|
||||||
|
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||||
|
* harden_mariadb.service.patch
|
||||||
|
Modified:
|
||||||
|
* mariadb.service.in
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Sep 20 09:01:17 UTC 2021 - Danilo Spinella <danilo.spinella@suse.com>
|
Mon Sep 20 09:01:17 UTC 2021 - Danilo Spinella <danilo.spinella@suse.com>
|
||||||
|
|
||||||
|
@ -63,6 +63,17 @@ ProtectSystem=full
|
|||||||
|
|
||||||
# Prevent accessing /home, /root and /run/user
|
# Prevent accessing /home, /root and /run/user
|
||||||
ProtectHome=true
|
ProtectHome=true
|
||||||
|
# added automatically, for details please see
|
||||||
|
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
PrivateDevices=true
|
||||||
|
ProtectHostname=true
|
||||||
|
ProtectClock=true
|
||||||
|
ProtectKernelTunables=true
|
||||||
|
ProtectKernelModules=true
|
||||||
|
ProtectKernelLogs=true
|
||||||
|
ProtectControlGroups=true
|
||||||
|
RestrictRealtime=true
|
||||||
|
# end of automatic additions
|
||||||
|
|
||||||
# Execute pre and post scripts as root, otherwise it does it as User=
|
# Execute pre and post scripts as root, otherwise it does it as User=
|
||||||
PermissionsStartOnly=true
|
PermissionsStartOnly=true
|
||||||
|
@ -79,6 +79,7 @@ Patch4: mariadb-10.2.4-fortify-and-O.patch
|
|||||||
Patch5: mariadb-10.2.19-link-and-enable-c++11-atomics.patch
|
Patch5: mariadb-10.2.19-link-and-enable-c++11-atomics.patch
|
||||||
Patch6: mariadb-10.4.12-harden_setuid.patch
|
Patch6: mariadb-10.4.12-harden_setuid.patch
|
||||||
Patch7: mariadb-10.4.12-fix-install-db.patch
|
Patch7: mariadb-10.4.12-fix-install-db.patch
|
||||||
|
Patch8: harden_mariadb.service.patch
|
||||||
# needed for bison SQL parser and wsrep API
|
# needed for bison SQL parser and wsrep API
|
||||||
BuildRequires: bison
|
BuildRequires: bison
|
||||||
BuildRequires: cmake
|
BuildRequires: cmake
|
||||||
@ -364,6 +365,7 @@ find . -name "*.jar" -type f -exec rm --verbose -f {} \;
|
|||||||
%patch5 -p1
|
%patch5 -p1
|
||||||
%patch6 -p1
|
%patch6 -p1
|
||||||
%patch7 -p1
|
%patch7 -p1
|
||||||
|
%patch8 -p1
|
||||||
|
|
||||||
cp %{_sourcedir}/suse-test-run .
|
cp %{_sourcedir}/suse-test-run .
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user