From 71f71b97015f45a5a48c64bdb230339745c09b9ce1f36babf9d71e10c59ce5a1 Mon Sep 17 00:00:00 2001 From: Jason Sikes Date: Fri, 25 Mar 2022 04:40:47 +0000 Subject: [PATCH] Accepting request 925352 from home:jsegitz:branches:systemdhardening:security:chipcard Automatic systemd hardening effort by the security team. This has not been tested. For details please see https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort OBS-URL: https://build.opensuse.org/request/show/925352 OBS-URL: https://build.opensuse.org/package/show/security:chipcard/pam_pkcs11?expand=0&rev=29 --- pam_pkcs11.changes | 6 ++++++ pkcs11_eventmgr.service | 11 +++++++++++ 2 files changed, 17 insertions(+) diff --git a/pam_pkcs11.changes b/pam_pkcs11.changes index ccef297..a12f1e6 100644 --- a/pam_pkcs11.changes +++ b/pam_pkcs11.changes @@ -7,6 +7,12 @@ Sat Jan 15 10:26:28 UTC 2022 - Andreas Stieger * console output color updates * Add support of ECDSA signature in addition to RSA +------------------------------------------------------------------- +Thu Oct 14 10:34:54 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Modified: + * pkcs11_eventmgr.service + ------------------------------------------------------------------- Tue Jan 29 22:45:28 CET 2019 - sbrabec@suse.com diff --git a/pkcs11_eventmgr.service b/pkcs11_eventmgr.service index 7ea5225..790f9de 100644 --- a/pkcs11_eventmgr.service +++ b/pkcs11_eventmgr.service @@ -2,6 +2,17 @@ Description=pkcs11 event manager [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=read-only +ProtectHostname=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=forking ExecStart=/usr/bin/pkcs11_eventmgr StandardOutput=journal