rpm/postfix
SHA256
1
0
Fork 0
forked from pool/postfix
Code Pull Requests Activity

Accepting request 926927 from server:mail

Browse Source 
Hardening

OBS-URL: https://build.opensuse.org/request/show/926927
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/postfix?expand=0&rev=211
This commit is contained in:
Dominique Leuenberger 2021-10-23 21:13:48 +00:00 committed by Git OBS Bridge
commit 83e4f58fbd
5 changed files with 63 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
harden_postfix.service.patch Normal file
View File

@ -0,0 +1,25 @@
Index: postfix-3.6.2/postfix-SUSE/postfix.service
===================================================================
--- postfix-3.6.2.orig/postfix-SUSE/postfix.service
+++ postfix-3.6.2/postfix-SUSE/postfix.service
@@ -19,6 +19,20 @@ After=amavis.service mysql.service cyrus
Conflicts=sendmail.service exim.service
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ReadWritePaths=/etc/postfix
+ProtectHome=false
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
PIDFile=/var/spool/postfix/pid/master.pid
ExecStartPre=-/bin/echo 'Starting mail service (Postfix)'

17
postfix-bdb.changes
View File

@ -1,3 +1,20 @@
-------------------------------------------------------------------
Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker <opensuse@dstoecker.de>
- Ensure postfix can write to home directory or server side
filtering wont work (sieve)
-------------------------------------------------------------------
Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Ensure service can write to /etc/postfix
-------------------------------------------------------------------
Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service (bsc#1181400). Added
harden_postfix.service.patch
-------------------------------------------------------------------
Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly <varkoly@suse.com>

2
postfix-bdb.spec
View File

@ -83,6 +83,7 @@ Patch8: postfix-vda-v14-3.0.3.patch
Patch9: fix-postfix-script.patch
Patch10: postfix-avoid-infinit-loop-if-no-permission.patch
Patch11: postfix-3.6.2-glibc-234-build-fix.patch
Patch12: harden_postfix.service.patch
BuildRequires: ca-certificates
BuildRequires: cyrus-sasl-devel
BuildRequires: db-devel
@ -157,6 +158,7 @@ lmdb.
%patch9
%patch10
%patch11 -p1
%patch12 -p1
# ---------------------------------------------------------------------------

18
postfix.changes
View File

@ -1,3 +1,20 @@
-------------------------------------------------------------------
Fri Oct 22 09:45:40 UTC 2021 - Dirk Stoecker <opensuse@dstoecker.de>
- Ensure postfix can write to home directory or server side
filtering wont work (sieve)
-------------------------------------------------------------------
Fri Oct 22 08:46:19 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Ensure service can write to /etc/postfix
-------------------------------------------------------------------
Thu Oct 21 15:39:55 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
- Added hardening to systemd service (bsc#1181400). Added
harden_postfix.service.patch
-------------------------------------------------------------------
Thu Oct 7 08:03:40 UTC 2021 - Peter Varkoly <varkoly@suse.com>
@ -5302,4 +5319,3 @@ Mon Oct 9 13:54:13 CEST 2000 - choeger@suse.de
Mon Oct 9 11:48:39 CEST 2000 - choeger@suse.de
- inititial revision of pfixtls

2
postfix.spec
View File

@ -70,6 +70,7 @@ Patch9: fix-postfix-script.patch
Patch10: %{name}-avoid-infinit-loop-if-no-permission.patch
Patch11: set-default-db-type.patch
Patch12: postfix-3.6.2-glibc-234-build-fix.patch
Patch13: harden_postfix.service.patch
BuildRequires: ca-certificates
BuildRequires: cyrus-sasl-devel
#BuildRequires: db-devel
@ -177,6 +178,7 @@ maps with Postfix, you need this.
%patch10
%patch11
%patch12 -p1
%patch13 -p1
# ---------------------------------------------------------------------------