Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package openwsman for openSUSE:Factory
checked in at 2021-10-15 23:03:33
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/openwsman (Old)
and /work/SRC/openSUSE:Factory/.openwsman.new.1890 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openwsman"
Fri Oct 15 23:03:33 2021 rev:73 rq:925142 version:2.7.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/openwsman/openwsman.changes 2020-09-03
01:16:30.444522474 +0200
+++ /work/SRC/openSUSE:Factory/.openwsman.new.1890/openwsman.changes
2021-10-15 23:03:45.094088393 +0200
@@ -1,0 +2,8 @@
+Wed Oct 13 12:23:48 UTC 2021 - Johannes Segitz <jseg...@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_openwsman.service.patch
+ Modified:
+ * openwsman.service
+
+-------------------------------------------------------------------
New:
----
harden_openwsman.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ openwsman.spec ++++++
--- /var/tmp/diff_new_pack.13s4YT/_old 2021-10-15 23:03:45.750088861 +0200
+++ /var/tmp/diff_new_pack.13s4YT/_new 2021-10-15 23:03:45.758088867 +0200
@@ -155,6 +155,7 @@
Source21: %{name}.pam.rh
Source22: %{name}.pam
Patch1: openwsman-initscript.patch
+Patch2: harden_openwsman.service.patch
%if 0%{?fedora_version} || 0%{?centos_version} || 0%{?rhel_version} ||
0%{?fedora} || 0%{?rhel}
%define pamfile %{S:21}
%else
@@ -385,6 +386,7 @@
%if 0%{?fedora_version} || 0%{?centos_version} || 0%{?rhel_version} ||
0%{?fedora} || 0%{?rhel}
%patch1 -p1
%endif
+%patch2 -p1
%build
rm -rf build
++++++ harden_openwsman.service.patch ++++++
Index: openwsman-2.7.0/package/openwsman.service.in
===================================================================
--- openwsman-2.7.0.orig/package/openwsman.service.in
+++ openwsman-2.7.0/package/openwsman.service.in
@@ -3,6 +3,19 @@ Description=Openwsman WS-Management Serv
After=syslog.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
ExecStart=@prefix@/sbin/openwsmand -S
++++++ openwsman.service ++++++
--- /var/tmp/diff_new_pack.13s4YT/_old 2021-10-15 23:03:45.878088952 +0200
+++ /var/tmp/diff_new_pack.13s4YT/_new 2021-10-15 23:03:45.882088955 +0200
@@ -3,6 +3,19 @@
After=syslog.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
ExecStart=/usr/sbin/openwsmand -S
