Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opendkim for openSUSE:Factory checked in at 2021-11-06 18:18:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opendkim (Old) and /work/SRC/openSUSE:Factory/.opendkim.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opendkim" Sat Nov 6 18:18:04 2021 rev:7 rq:929856 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/opendkim/opendkim.changes 2021-10-15 23:04:16.146110532 +0200 +++ /work/SRC/openSUSE:Factory/.opendkim.new.1890/opendkim.changes 2021-11-06 18:21:25.560993561 +0100 @@ -1,0 +2,8 @@ +Mon Oct 18 14:50:48 UTC 2021 - Johannes Segitz <[email protected]> + +- Added hardening to systemd service (bsc#1181400). Added patch: + * harden_opendkim.service.patch + Modified: + * opendkim.service + +------------------------------------------------------------------- New: ---- harden_opendkim.service.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opendkim.spec ++++++ --- /var/tmp/diff_new_pack.DrXKYV/_old 2021-11-06 18:21:25.968993786 +0100 +++ /var/tmp/diff_new_pack.DrXKYV/_new 2021-11-06 18:21:25.972993789 +0100 @@ -54,6 +54,7 @@ Patch2: cve-2020-12272.patch # PATCH-FIX-UPSTREAM Plug memory leak in Unbound callback function https://github.com/trusteddomainproject/OpenDKIM/pull/57/commits/0010ca7150b09c3c259c17bdd9431a8bfe39e299 Patch3: unbound-fix.patch +Patch4: harden_opendkim.service.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: curl-devel @@ -216,6 +217,7 @@ %patch1 %patch2 -p1 %patch3 -p0 +%patch4 -p1 %build autoreconf -iv ++++++ harden_opendkim.service.patch ++++++ Index: OpenDKIM-2.11.0-Beta2/contrib/systemd/opendkim.service.in =================================================================== --- OpenDKIM-2.11.0-Beta2.orig/contrib/systemd/opendkim.service.in +++ OpenDKIM-2.11.0-Beta2/contrib/systemd/opendkim.service.in @@ -8,6 +8,19 @@ Documentation=man:opendkim(8) man:opendk After=network.target nss-lookup.target syslog.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=forking PIDFile=@localstatedir@/run/opendkim/opendkim.pid EnvironmentFile=-@sysconfdir@/sysconfig/opendkim ++++++ opendkim.service ++++++ --- /var/tmp/diff_new_pack.DrXKYV/_old 2021-11-06 18:21:26.016993813 +0100 +++ /var/tmp/diff_new_pack.DrXKYV/_new 2021-11-06 18:21:26.016993813 +0100 @@ -4,6 +4,19 @@ After=local-fs.target network.target syslog.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=simple PIDFile=/run/opendkim/opendkim.pid ExecStart=/usr/sbin/opendkim -f -x /etc/opendkim/opendkim.conf
