Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ledmon for openSUSE:Factory checked in at 2021-10-16 22:47:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ledmon (Old) and /work/SRC/openSUSE:Factory/.ledmon.new.1890 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ledmon" Sat Oct 16 22:47:16 2021 rev:22 rq:925652 version:0.95 Changes: -------- --- /work/SRC/openSUSE:Factory/ledmon/ledmon.changes 2021-07-02 13:29:03.496019833 +0200 +++ /work/SRC/openSUSE:Factory/.ledmon.new.1890/ledmon.changes 2021-10-16 22:47:52.508703796 +0200 @@ -1,0 +2,6 @@ +Fri Oct 15 07:28:48 UTC 2021 - Johannes Segitz <jseg...@suse.com> + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_ledmon.service.patch + +------------------------------------------------------------------- New: ---- harden_ledmon.service.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ledmon.spec ++++++ --- /var/tmp/diff_new_pack.fOJUAE/_old 2021-10-16 22:47:52.940704160 +0200 +++ /var/tmp/diff_new_pack.fOJUAE/_new 2021-10-16 22:47:52.940704160 +0200 @@ -24,6 +24,7 @@ Group: Hardware/Other URL: https://github.com/intel/ledmon/ Source0: https://github.com/intel/ledmon/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +Patch0: harden_ledmon.service.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: libsgutils-devel @@ -42,7 +43,7 @@ solutions. %prep -%autosetup +%autosetup -p1 %build %define _lto_cflags %{nil} ++++++ harden_ledmon.service.patch ++++++ Index: ledmon-0.95/systemd/ledmon.service.in =================================================================== --- ledmon-0.95.orig/systemd/ledmon.service.in +++ ledmon-0.95/systemd/ledmon.service.in @@ -5,6 +5,17 @@ Description=Enclosure LED Utilities WantedBy=multi-user.target [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectSystem=full +ProtectHome=true +ProtectHostname=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=simple User=root ExecStart=@sbindir@/ledmon --foreground
