Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ofono for openSUSE:Factory checked in at 2021-10-15 23:03:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ofono (Old) and /work/SRC/openSUSE:Factory/.ofono.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ofono" Fri Oct 15 23:03:49 2021 rev:19 rq:925233 version:1.33 Changes: -------- --- /work/SRC/openSUSE:Factory/ofono/ofono.changes 2021-09-17 23:26:23.217259476 +0200 +++ /work/SRC/openSUSE:Factory/.ofono.new.1890/ofono.changes 2021-10-15 23:04:07.850104617 +0200 @@ -1,0 +2,6 @@ +Wed Oct 13 06:33:00 UTC 2021 - Johannes Segitz <[email protected]> + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_ofono.service.patch + +------------------------------------------------------------------- New: ---- harden_ofono.service.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ofono.spec ++++++ --- /var/tmp/diff_new_pack.tdHaBk/_old 2021-10-15 23:04:08.302104939 +0200 +++ /var/tmp/diff_new_pack.tdHaBk/_new 2021-10-15 23:04:08.318104951 +0200 @@ -28,6 +28,7 @@ Source0: https://www.kernel.org/pub/linux/network/ofono/%{name}-%{version}.tar.xz Source1: https://www.kernel.org/pub/linux/network/ofono/sha256sums.asc#/%{name}-%{version}.tar.xz.sig Source2: http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x589DA6B1#/ofono.keyring +Patch0: harden_ofono.service.patch BuildRequires: pkgconfig BuildRequires: pkgconfig(bluez) >= 4.85 BuildRequires: pkgconfig(dbus-1) @@ -71,6 +72,7 @@ %prep %setup -q +%patch0 -p1 %build %configure \ ++++++ harden_ofono.service.patch ++++++ Index: ofono-1.33/src/ofono.service.in =================================================================== --- ofono-1.33.orig/src/ofono.service.in +++ ofono-1.33/src/ofono.service.in @@ -3,6 +3,19 @@ Description=Telephony service After=syslog.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=dbus BusName=org.ofono ExecStart=@prefix@/sbin/ofonod -n
