Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libvma for openSUSE:Factory checked
in at 2021-11-17 01:13:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libvma (Old)
and /work/SRC/openSUSE:Factory/.libvma.new.1890 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libvma"
Wed Nov 17 01:13:39 2021 rev:12 rq:931508 version:9.3.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/libvma/libvma.changes 2021-09-27
20:09:21.362491700 +0200
+++ /work/SRC/openSUSE:Factory/.libvma.new.1890/libvma.changes 2021-11-17
01:14:35.954179874 +0100
@@ -1,0 +2,8 @@
+Tue Oct 5 09:08:03 UTC 2021 - Johannes Segitz <jseg...@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_vma.service.patch
+ Modified:
+ * vma.service
+
+-------------------------------------------------------------------
New:
----
harden_vma.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libvma.spec ++++++
--- /var/tmp/diff_new_pack.DaPJ72/_old 2021-11-17 01:14:36.482180072 +0100
+++ /var/tmp/diff_new_pack.DaPJ72/_new 2021-11-17 01:14:36.486180073 +0100
@@ -29,6 +29,7 @@
Source0: %{name}-%{version}%{git_ver}.tar.gz
Source1: vma.service
Patch1: issue-2485156-Fix-fc35-issues.patch
+Patch2: harden_vma.service.patch
URL: https://github.com/Mellanox/libvma
BuildRequires: autoconf
BuildRequires: automake
@@ -72,6 +73,7 @@
%prep
%setup -q -n %{name}-%{version}%{git_ver}
%patch1
+%patch2 -p1
%build
./autogen.sh
++++++ harden_vma.service.patch ++++++
Index: libvma-9.3.1.0.47396f1a5eaa/contrib/scripts/vma.service.in
===================================================================
--- libvma-9.3.1.0.47396f1a5eaa.orig/contrib/scripts/vma.service.in
+++ libvma-9.3.1.0.47396f1a5eaa/contrib/scripts/vma.service.in
@@ -3,6 +3,19 @@ Description=VMA Daemon
After=network.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
Restart=on-failure
ExecStart=@prefix@/sbin/vmad
++++++ vma.service ++++++
--- /var/tmp/diff_new_pack.DaPJ72/_old 2021-11-17 01:14:36.550180097 +0100
+++ /var/tmp/diff_new_pack.DaPJ72/_new 2021-11-17 01:14:36.554180099 +0100
@@ -9,6 +9,19 @@
After=rdma-hw.target
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=simple
Restart=on-failure
ExecStart=/usr/sbin/vmad
