diff --git a/harden_spacenavd.service.patch b/harden_spacenavd.service.patch new file mode 100644 index 0000000..4ff692a --- /dev/null +++ b/harden_spacenavd.service.patch @@ -0,0 +1,22 @@ +Index: spacenavd-0.8/contrib/systemd/spacenavd.service +=================================================================== +--- spacenavd-0.8.orig/contrib/systemd/spacenavd.service ++++ spacenavd-0.8/contrib/systemd/spacenavd.service +@@ -3,6 +3,17 @@ Description=3Dconnexion Input Devices Us + After=syslog.target + + [Service] ++# added automatically, for details please see ++# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ++ProtectSystem=full ++ProtectHome=true ++ProtectHostname=true ++ProtectKernelTunables=true ++ProtectKernelModules=true ++ProtectKernelLogs=true ++ProtectControlGroups=true ++RestrictRealtime=true ++# end of automatic additions + Type=forking + PIDFile=/run/spnavd.pid + ExecStart=/usr/local/bin/spacenavd diff --git a/spacenavd.changes b/spacenavd.changes index f34c62b..f259ab3 100644 --- a/spacenavd.changes +++ b/spacenavd.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Wed Nov 17 10:49:36 UTC 2021 - Johannes Segitz + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_spacenavd.service.patch + Modified: + * spacenavd.service + ------------------------------------------------------------------- Tue Mar 16 18:56:16 UTC 2021 - Herbert Graeber diff --git a/spacenavd.service b/spacenavd.service index 2b817dc..90d6c6f 100644 --- a/spacenavd.service +++ b/spacenavd.service @@ -2,6 +2,17 @@ Description=Userspace Daemon of the spacenav driver. [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +ProtectHostname=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=forking PIDFile=/run/spnavd.pid ExecStart=/usr/sbin/spacenavd diff --git a/spacenavd.spec b/spacenavd.spec index ecba184..f3af850 100644 --- a/spacenavd.spec +++ b/spacenavd.spec @@ -30,6 +30,7 @@ Source2: spnavrc Source3: xinitrc-%{name} Source4: %{name}.service Patch1: %{name}-fix-pidfile.patch +Patch2: harden_spacenavd.service.patch BuildRequires: pkgconfig BuildRequires: systemd-rpm-macros BuildRequires: pkgconfig(x11) @@ -64,6 +65,7 @@ any program that was written for the 3Dconnexion driver. %prep %setup -q %patch1 -p1 +%patch2 -p1 %build %configure