forked from pool/postfix
Dirk Mueller
8308be11bf
- Refreshed spec-file via spec-cleaner and manual optimizated. * Added -p flag to all install commands. * Removed -f flag from all ln commands. - Changed file harden_postfix.service.patch (boo#1191988). OBS-URL: https://build.opensuse.org/request/show/965609 OBS-URL: https://build.opensuse.org/package/show/server:mail/postfix?expand=0&rev=438
30 lines
994 B
Diff
30 lines
994 B
Diff
Index: postfix-3.6.2/postfix-SUSE/postfix.service
|
|
===================================================================
|
|
--- postfix-3.6.2.orig/postfix-SUSE/postfix.service
|
|
+++ postfix-3.6.2/postfix-SUSE/postfix.service
|
|
@@ -19,6 +19,24 @@ After=amavis.service mysql.service cyrus
|
|
Conflicts=sendmail.service exim.service
|
|
|
|
[Service]
|
|
+# added automatically, for details please see
|
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
|
+
|
|
+# Needed write permissions for /etc/aliases.* or /etc/aliases.lmdb
|
|
+# https://bugzilla.opensuse.org/show_bug.cgi?id=1191988
|
|
+#ProtectSystem=full
|
|
+#ReadWritePaths=/etc/postfix
|
|
+
|
|
+ProtectHome=false
|
|
+PrivateDevices=true
|
|
+ProtectHostname=true
|
|
+ProtectClock=true
|
|
+ProtectKernelTunables=true
|
|
+ProtectKernelModules=true
|
|
+ProtectKernelLogs=true
|
|
+ProtectControlGroups=true
|
|
+RestrictRealtime=true
|
|
+# end of automatic additions
|
|
Type=forking
|
|
PIDFile=/var/spool/postfix/pid/master.pid
|
|
ExecStartPre=-/bin/echo 'Starting mail service (Postfix)'
|