Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package prometheus-webhook-snmp for
openSUSE:Factory checked in at 2021-10-21 23:55:29
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/prometheus-webhook-snmp (Old)
and /work/SRC/openSUSE:Factory/.prometheus-webhook-snmp.new.1890 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "prometheus-webhook-snmp"
Thu Oct 21 23:55:29 2021 rev:4 rq:926730 version:1.4
Changes:
--------
---
/work/SRC/openSUSE:Factory/prometheus-webhook-snmp/prometheus-webhook-snmp.changes
2020-05-28 09:21:58.301506018 +0200
+++
/work/SRC/openSUSE:Factory/.prometheus-webhook-snmp.new.1890/prometheus-webhook-snmp.changes
2021-10-21 23:55:49.260034582 +0200
@@ -1,0 +2,6 @@
+Wed Oct 20 13:57:15 UTC 2021 - Johannes Segitz <[email protected]>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_prometheus-webhook-snmp.service.patch
+
+-------------------------------------------------------------------
New:
----
harden_prometheus-webhook-snmp.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ prometheus-webhook-snmp.spec ++++++
--- /var/tmp/diff_new_pack.he4Uy0/_old 2021-10-21 23:55:49.668034792 +0200
+++ /var/tmp/diff_new_pack.he4Uy0/_new 2021-10-21 23:55:49.668034792 +0200
@@ -22,6 +22,7 @@
Group: System/Management
URL: https://github.com/SUSE/prometheus-webhook-snmp
Source0: %{name}-%{version}.tar.gz
+Patch0: harden_prometheus-webhook-snmp.service.patch
BuildArch: noarch
BuildRequires: python3-setuptools
@@ -44,6 +45,7 @@
%prep
%setup -n %{name}-%{version}
+%patch0 -p1
%build
++++++ harden_prometheus-webhook-snmp.service.patch ++++++
Index: prometheus-webhook-snmp-1.4/prometheus-webhook-snmp.service
===================================================================
--- prometheus-webhook-snmp-1.4.orig/prometheus-webhook-snmp.service
+++ prometheus-webhook-snmp-1.4/prometheus-webhook-snmp.service
@@ -3,6 +3,19 @@ Description=Prometheus Alertmanager rece
After=network.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
EnvironmentFile=-/etc/default/prometheus-webhook-snmp
ExecStart=/usr/bin/prometheus-webhook-snmp $PROMETHEUS_WEBHOOK_SNMP_OPTIONS run
ExecReload=/bin/kill -HUP $MAINPID
