Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tinc for openSUSE:Factory checked in at 2023-01-06 17:06:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tinc (Old) and /work/SRC/openSUSE:Factory/.tinc.new.1563 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tinc" Fri Jan 6 17:06:06 2023 rev:7 rq:1056357 version:1.0.36 Changes: -------- --- /work/SRC/openSUSE:Factory/tinc/tinc.changes 2020-02-05 19:43:43.851325667 +0100 +++ /work/SRC/openSUSE:Factory/.tinc.new.1563/tinc.changes 2023-01-06 17:06:51.100618059 +0100 @@ -1,0 +2,7 @@ +Thu Nov 25 07:30:37 UTC 2021 - Johannes Segitz <[email protected]> + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_tinc.service.patch + * [email protected] + +------------------------------------------------------------------- New: ---- harden_tinc.service.patch [email protected] ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tinc.spec ++++++ --- /var/tmp/diff_new_pack.RTnoRI/_old 2023-01-06 17:06:51.636621069 +0100 +++ /var/tmp/diff_new_pack.RTnoRI/_new 2023-01-06 17:06:51.640621091 +0100 @@ -26,6 +26,8 @@ URL: http://www.tinc-vpn.org/ Source0: http://www.tinc-vpn.org/packages/%{name}-%{version}.tar.gz Patch0: tinc-systemd-path-fix.patch +Patch1: harden_tinc.service.patch +Patch2: [email protected] BuildRequires: lzo-devel BuildRequires: openssl-devel @@ -48,6 +50,8 @@ %prep %setup -q %patch0 -p1 +%patch1 -p1 +%patch2 -p1 %build %configure \ ++++++ harden_tinc.service.patch ++++++ Index: tinc-1.0.36/systemd/tinc.service.in =================================================================== --- tinc-1.0.36.orig/systemd/tinc.service.in +++ tinc-1.0.36/systemd/tinc.service.in @@ -10,6 +10,19 @@ After=network.target Wants=network.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=oneshot RemainAfterExit=yes ExecStart=/bin/true ++++++ [email protected] ++++++ Index: tinc-1.0.36/systemd/[email protected] =================================================================== --- tinc-1.0.36.orig/systemd/[email protected] +++ tinc-1.0.36/systemd/[email protected] @@ -7,6 +7,19 @@ PartOf=tinc.service ReloadPropagatedFrom=tinc.service [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=simple WorkingDirectory=@sysconfdir@/tinc/%i ExecStart=@sbindir@/tincd -n %i -D
