Accepting request 933279 from hardware

OBS-URL: https://build.opensuse.org/request/show/933279
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/spacenavd?expand=0&rev=8

harden_spacenavd.service.patch

@@ -0,0 +1,22 @@
+Index: spacenavd-0.8/contrib/systemd/spacenavd.service
+===================================================================
+--- spacenavd-0.8.orig/contrib/systemd/spacenavd.service
++++ spacenavd-0.8/contrib/systemd/spacenavd.service
+@@ -3,6 +3,17 @@ Description=3Dconnexion Input Devices Us
+ After=syslog.target
+ 
+ [Service]
++# added automatically, for details please see
++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
++ProtectSystem=full
++ProtectHome=true
++ProtectHostname=true
++ProtectKernelTunables=true
++ProtectKernelModules=true
++ProtectKernelLogs=true
++ProtectControlGroups=true
++RestrictRealtime=true
++# end of automatic additions 
+ Type=forking
+ PIDFile=/run/spnavd.pid
+ ExecStart=/usr/local/bin/spacenavd

spacenavd.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Nov 17 10:49:36 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+  * harden_spacenavd.service.patch
+  Modified:
+  * spacenavd.service
+
 -------------------------------------------------------------------
 Tue Mar 16 18:56:16 UTC 2021 - Herbert Graeber <herbert@graeber-clan.de>
 

spacenavd.service

@@ -2,6 +2,17 @@
 Description=Userspace Daemon of the spacenav driver.
 
 [Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions 
 Type=forking
 PIDFile=/run/spnavd.pid
 ExecStart=/usr/sbin/spacenavd

spacenavd.spec

@@ -30,6 +30,7 @@ Source2:        spnavrc
 Source3:        xinitrc-%{name}
 Source4:        %{name}.service
 Patch1:         %{name}-fix-pidfile.patch
+Patch2:         harden_spacenavd.service.patch
 BuildRequires:  pkgconfig
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  pkgconfig(x11)
@@ -64,6 +65,7 @@ any program that was written for the 3Dconnexion driver.
 %prep
 %setup -q
 %patch1 -p1
+%patch2 -p1
 
 %build
 %configure