Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package zypper-lifecycle-plugin for
openSUSE:Factory checked in at 2022-02-17 09:02:55
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/zypper-lifecycle-plugin (Old)
and /work/SRC/openSUSE:Factory/.zypper-lifecycle-plugin.new.1958 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zypper-lifecycle-plugin"
Thu Feb 17 09:02:55 2022 rev:7 rq:955345 version:0.6.1601367426.843fe7a
Changes:
--------
---
/work/SRC/openSUSE:Factory/zypper-lifecycle-plugin/zypper-lifecycle-plugin.changes
2020-09-29 19:05:19.814025177 +0200
+++
/work/SRC/openSUSE:Factory/.zypper-lifecycle-plugin.new.1958/zypper-lifecycle-plugin.changes
2022-02-17 09:02:56.349878652 +0100
@@ -1,0 +2,6 @@
+Tue Jan 11 15:33:16 UTC 2022 - Johannes Segitz <jseg...@suse.com>
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_lifecycle-report.service.patch
+
+-------------------------------------------------------------------
New:
----
harden_lifecycle-report.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ zypper-lifecycle-plugin.spec ++++++
--- /var/tmp/diff_new_pack.UzrwW2/_old 2022-02-17 09:02:56.961878508 +0100
+++ /var/tmp/diff_new_pack.UzrwW2/_new 2022-02-17 09:02:56.969878506 +0100
@@ -1,7 +1,7 @@
#
# spec file for package zypper-lifecycle-plugin
#
-# Copyright (c) 2020 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -35,6 +35,7 @@
%{?systemd_requires}
Source: zypper-lifecycle-%{version}.tar.xz
+Patch0: harden_lifecycle-report.service.patch
Summary: Zypper subcommand for lifecycle information
License: GPL-2.0
Group: System/Packages
@@ -46,6 +47,7 @@
%prep
%setup -q -n zypper-lifecycle-%{version}
+%patch0 -p1
%build
++++++ harden_lifecycle-report.service.patch ++++++
Index: zypper-lifecycle-0.6.1601367426.843fe7a/lifecycle-report.service
===================================================================
--- zypper-lifecycle-0.6.1601367426.843fe7a.orig/lifecycle-report.service
+++ zypper-lifecycle-0.6.1601367426.843fe7a/lifecycle-report.service
@@ -2,5 +2,17 @@
Description=Report changes in product/package lifecycle
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=oneshot
ExecStart=/usr/share/lifecycle/lifecycle-report
