Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package zypper-lifecycle-plugin for openSUSE:Factory checked in at 2022-02-17 09:02:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zypper-lifecycle-plugin (Old) and /work/SRC/openSUSE:Factory/.zypper-lifecycle-plugin.new.1958 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zypper-lifecycle-plugin" Thu Feb 17 09:02:55 2022 rev:7 rq:955345 version:0.6.1601367426.843fe7a Changes: -------- --- /work/SRC/openSUSE:Factory/zypper-lifecycle-plugin/zypper-lifecycle-plugin.changes 2020-09-29 19:05:19.814025177 +0200 +++ /work/SRC/openSUSE:Factory/.zypper-lifecycle-plugin.new.1958/zypper-lifecycle-plugin.changes 2022-02-17 09:02:56.349878652 +0100 @@ -1,0 +2,6 @@ +Tue Jan 11 15:33:16 UTC 2022 - Johannes Segitz <jseg...@suse.com> + +- Added hardening to systemd service(s) (bsc#1181400). Added patch(es): + * harden_lifecycle-report.service.patch + +------------------------------------------------------------------- New: ---- harden_lifecycle-report.service.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zypper-lifecycle-plugin.spec ++++++ --- /var/tmp/diff_new_pack.UzrwW2/_old 2022-02-17 09:02:56.961878508 +0100 +++ /var/tmp/diff_new_pack.UzrwW2/_new 2022-02-17 09:02:56.969878506 +0100 @@ -1,7 +1,7 @@ # # spec file for package zypper-lifecycle-plugin # -# Copyright (c) 2020 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -35,6 +35,7 @@ %{?systemd_requires} Source: zypper-lifecycle-%{version}.tar.xz +Patch0: harden_lifecycle-report.service.patch Summary: Zypper subcommand for lifecycle information License: GPL-2.0 Group: System/Packages @@ -46,6 +47,7 @@ %prep %setup -q -n zypper-lifecycle-%{version} +%patch0 -p1 %build ++++++ harden_lifecycle-report.service.patch ++++++ Index: zypper-lifecycle-0.6.1601367426.843fe7a/lifecycle-report.service =================================================================== --- zypper-lifecycle-0.6.1601367426.843fe7a.orig/lifecycle-report.service +++ zypper-lifecycle-0.6.1601367426.843fe7a/lifecycle-report.service @@ -2,5 +2,17 @@ Description=Report changes in product/package lifecycle [Service] +# added automatically, for details please see +# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort +ProtectHome=true +PrivateDevices=true +ProtectHostname=true +ProtectClock=true +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true +# end of automatic additions Type=oneshot ExecStart=/usr/share/lifecycle/lifecycle-report