Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package golang-github-czerwonk-ping_exporter for openSUSE:Factory checked in at 2021-09-30 23:43:45
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/golang-github-czerwonk-ping_exporter (Old)
and /work/SRC/openSUSE:Factory/.golang-github-czerwonk-ping_exporter.new.2443 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "golang-github-czerwonk-ping_exporter"
Thu Sep 30 23:43:45 2021 rev:2 rq:922327 version:0.4.5
Changes:
--------
--- /work/SRC/openSUSE:Factory/golang-github-czerwonk-ping_exporter/golang-github-czerwonk-ping_exporter.changes 2021-03-18 22:55:18.191554343 +0100
+++ /work/SRC/openSUSE:Factory/.golang-github-czerwonk-ping_exporter.new.2443/golang-github-czerwonk-ping_exporter.changes 2021-09-30 23:45:03.524583650 +0200
@@ -1,0 +2,8 @@
+Mon Sep 20 14:06:14 UTC 2021 - Johannes Segitz
+
+- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
+ * harden_ping_exporter.service.patch
+ Modified:
+ * ping_exporter.service
+
+-------------------------------------------------------------------
New:
----
harden_ping_exporter.service.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ golang-github-czerwonk-ping_exporter.spec ++++++
--- /var/tmp/diff_new_pack.teyXup/_old 2021-09-30 23:45:04.036584236 +0200
+++ /var/tmp/diff_new_pack.teyXup/_new 2021-09-30 23:45:04.040584241 +0200
@@ -27,6 +27,7 @@
Source1: vendor.tar.gz
Source2: ping_exporter.yaml
Source3: ping_exporter.service
+Patch0: harden_ping_exporter.service.patch
BuildRequires: golang-packaging
Requires(post): %fillup_prereq
%systemd_ordering
@@ -38,6 +39,7 @@
%prep
%setup -q -n %{name}-%{version}
%setup -q -n %{name}-%{version} -T -D -a 1
+%patch0 -p1
%build
%{goprep} github.com/czerwonk/ping_exporter
++++++ harden_ping_exporter.service.patch ++++++
Index: golang-github-czerwonk-ping_exporter-0.4.5/dist/ping_exporter.service
===================================================================
--- golang-github-czerwonk-ping_exporter-0.4.5.orig/dist/ping_exporter.service
+++ golang-github-czerwonk-ping_exporter-0.4.5/dist/ping_exporter.service
@@ -21,6 +21,10 @@ DevicePolicy=closed
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectKernelLogs=true
+# end of automatic additions
MemoryDenyWriteExecute=yes
LockPersonality=yes
++++++ ping_exporter.service ++++++
--- /var/tmp/diff_new_pack.teyXup/_old 2021-09-30 23:45:04.124584338 +0200
+++ /var/tmp/diff_new_pack.teyXup/_new 2021-09-30 23:45:04.124584338 +0200
@@ -2,6 +2,19 @@
Description=Prometheus exporter for ICMP echo requests
[Service]
+# added automatically, for details please see
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
+ProtectSystem=full
+ProtectHome=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
ExecStart=/usr/bin/ping_exporter --config.path=/etc/ping_exporter.yaml
DynamicUser=Yes
AmbientCapabilities=CAP_NET_RAW
