Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package rrdtool for openSUSE:Factory checked
in at 2021-11-24 23:54:11
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rrdtool (Old)
and /work/SRC/openSUSE:Factory/.rrdtool.new.1895 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rrdtool"
Wed Nov 24 23:54:11 2021 rev:71 rq:932986 version:1.7.2
Changes:
--------
--- /work/SRC/openSUSE:Factory/rrdtool/rrdtool.changes 2019-10-05
16:17:38.837852492 +0200
+++ /work/SRC/openSUSE:Factory/.rrdtool.new.1895/rrdtool.changes
2021-11-24 23:54:19.304509387 +0100
@@ -1,0 +2,8 @@
+Tue Nov 16 08:36:04 UTC 2021 - Johannes Segitz <jseg...@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_rrdcached.service.patch
+ Modified:
+ * rrdcached.service
+
+-------------------------------------------------------------------
New:
----
harden_rrdcached.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rrdtool.spec ++++++
--- /var/tmp/diff_new_pack.qYr7un/_old 2021-11-24 23:54:20.028506956 +0100
+++ /var/tmp/diff_new_pack.qYr7un/_new 2021-11-24 23:54:20.028506956 +0100
@@ -66,6 +66,7 @@
Requires: dejavu
%if 0%{?suse_version} >= 1500
Patch13: python3.patch
+Patch14: harden_rrdcached.service.patch
%endif
%if %{with python}
BuildRequires: %{python}-devel
@@ -218,6 +219,7 @@
%if 0%{?suse_version} >= 1500
%patch13 -p1
%endif
+%patch14 -p1
# rrd_tool/rrd_cgi: use the date of the last change
modified="$(sed -n '/^----/n;s/ - .*$//;p;q' "%{_sourcedir}/%{name}.changes")"
++++++ harden_rrdcached.service.patch ++++++
Index: rrdtool-1.7.2/etc/rrdcached.service.in
===================================================================
--- rrdtool-1.7.2.orig/etc/rrdcached.service.in
+++ rrdtool-1.7.2/etc/rrdcached.service.in
@@ -8,6 +8,19 @@ Description=Data caching daemon for rrdt
Documentation=man:rrdcached(1)
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
# If you enable socket-activable rrdcached.socket,
# command line socket declarations will be ignored
ExecStart=@prefix@/bin/rrdcached -g
++++++ rrdcached.service ++++++
--- /var/tmp/diff_new_pack.qYr7un/_old 2021-11-24 23:54:20.096506728 +0100
+++ /var/tmp/diff_new_pack.qYr7un/_new 2021-11-24 23:54:20.096506728 +0100
@@ -12,6 +12,19 @@
After=network.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
ExecStartPre=-/bin/echo 'Starting RRD data caching service (rrdtools -
rrdcached)'
ExecStartPre=/bin/sh -c "/usr/share/rrdcached/rrdcached-systemd-pre"
