From 57bbfe9be18a8adf115d4fd19d29ef8b454bd9de4c3a1232502eb60da296af94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20Str=C3=B6der?= Date: Fri, 22 Oct 2021 07:56:31 +0000 Subject: [PATCH] Accepting request 926873 from home:jsegitz:branches:systemdhardening:server:mail - Added hardening to systemd service (bsc#1181400). Added harden_postfix.service.patch - Added hardening to systemd service (bsc#1181400). Added harden_postfix.service.patch OBS-URL: https://build.opensuse.org/request/show/926873 OBS-URL: https://build.opensuse.org/package/show/server:mail/postfix?expand=0&rev=427 --- harden_postfix.service.patch | 24 ++++++++++++++++++++++++ postfix-bdb.changes | 6 ++++++ postfix-bdb.spec | 2 ++ postfix.changes | 6 ++++++ postfix.spec | 2 ++ 5 files changed, 40 insertions(+) create mode 100644 harden_postfix.service.patch diff --git a/harden_postfix.service.patch b/harden_postfix.service.patch new file mode 100644 index 0000000..4e3a4c0 --- /dev/null +++ b/harden_postfix.service.patch @@ -0,0 +1,24 @@ +Index: postfix-3.6.2/postfix-SUSE/postfix.service +=================================================================== +--- postfix-3.6.2.orig/postfix-SUSE/postfix.service ++++ postfix-3.6.2/postfix-SUSE/postfix.service +@@ -19,6 +19,19 @@ After=amavis.service mysql.service cyrus + Conflicts=sendmail.service exim.service + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++PrivateDevices=true ++ProtectHostname=true ++ProtectClock=true ++ProtectKernelTunables=true ++ProtectKernelModules=true ++ProtectKernelLogs=true ++ProtectControlGroups=true ++RestrictRealtime=true ++# end of automatic additions + Type=forking + PIDFile=/var/spool/postfix/pid/master.pid + ExecStartPre=-/bin/echo 'Starting mail service (Postfix)' diff --git a/postfix-bdb.changes b/postfix-bdb.changes index 1e452bc..3bdbcbc 100644 --- a/postfix-bdb.changes +++ b/postfix-bdb.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service (bsc#1181400). Added + harden_postfix.service.patch + ------------------------------------------------------------------- Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly diff --git a/postfix-bdb.spec b/postfix-bdb.spec index c814854..60fee46 100644 --- a/postfix-bdb.spec +++ b/postfix-bdb.spec @@ -83,6 +83,7 @@ Patch8: postfix-vda-v14-3.0.3.patch Patch9: fix-postfix-script.patch Patch10: postfix-avoid-infinit-loop-if-no-permission.patch Patch11: postfix-3.6.2-glibc-234-build-fix.patch +Patch12: harden_postfix.service.patch BuildRequires: ca-certificates BuildRequires: cyrus-sasl-devel BuildRequires: db-devel @@ -157,6 +158,7 @@ lmdb. %patch9 %patch10 %patch11 -p1 +%patch12 -p1 # --------------------------------------------------------------------------- diff --git a/postfix.changes b/postfix.changes index 4dfcfb2..3bf43ff 100644 --- a/postfix.changes +++ b/postfix.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service (bsc#1181400). Added + harden_postfix.service.patch + ------------------------------------------------------------------- Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly diff --git a/postfix.spec b/postfix.spec index 9cb04a8..c3f7ade 100644 --- a/postfix.spec +++ b/postfix.spec @@ -70,6 +70,7 @@ Patch9: fix-postfix-script.patch Patch10: %{name}-avoid-infinit-loop-if-no-permission.patch Patch11: set-default-db-type.patch Patch12: postfix-3.6.2-glibc-234-build-fix.patch +Patch13: harden_postfix.service.patch BuildRequires: ca-certificates BuildRequires: cyrus-sasl-devel #BuildRequires: db-devel @@ -177,6 +178,7 @@ maps with Postfix, you need this. %patch10 %patch11 %patch12 -p1 +%patch13 -p1 # ---------------------------------------------------------------------------