testing/elfutils
SHA256
3
0
Fork 0
forked from pool/elfutils
Code Pull Requests Activity

Updating link to change in openSUSE:Factory/elfutils revision 90.0

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/Base:System/elfutils?expand=0&rev=afe93b46a24cd7ec01f36e9d694141c3
This commit is contained in:
OBS User buildservice-autocommit 2021-09-20 21:32:23 +00:00 committed by Git OBS Bridge
parent 23acc4a762
commit ac8bf68b1e
3 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
elfutils-debuginfod.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Tue Sep 14 14:14:57 UTC 2021 - Martin Liška <mliska@suse.cz>
- Add harden_debuginfod.service.patch as
Automatic systemd hardening effort by the security team.
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Aug 5 18:12:21 UTC 2021 - Martin Liška <mliska@suse.cz> Thu Aug 5 18:12:21 UTC 2021 - Martin Liška <mliska@suse.cz>

1
elfutils-debuginfod.spec
View File

@ -30,6 +30,7 @@ Source2: elfutils.changes
Source3: elfutils.keyring Source3: elfutils.keyring
Patch0: disable-run-readelf-self-test.patch Patch0: disable-run-readelf-self-test.patch
Patch1: tests-Allow-an-extra-pthread_kill-frame-in-backtrace.patch Patch1: tests-Allow-an-extra-pthread_kill-frame-in-backtrace.patch
Patch2: harden_debuginfod.service.patch
BuildRequires: autoconf BuildRequires: autoconf
BuildRequires: automake BuildRequires: automake
BuildRequires: bison BuildRequires: bison

24
harden_debuginfod.service.patch Normal file
View File

@ -0,0 +1,24 @@
Index: elfutils-0.185/config/debuginfod.service
===================================================================
--- elfutils-0.185.orig/config/debuginfod.service
+++ elfutils-0.185/config/debuginfod.service
@@ -12,6 +12,19 @@ ExecStart=/usr/bin/debuginfod -d /var/ca
# Stopping can take a long time if scanning of large archives is in progress
TimeoutStopSec=60
PrivateTmp=yes
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
[Install]
WantedBy=multi-user.target