PR#13: Update Systemd security settings - rpms/realmd

Sumit Bose • 2 months ago

63ee752

0001-Systemd-security-settings.patch

file added

+38

		`@@ -0,0 +1,38 @@`
		`+ From 83b8eba4f9aa0ce8a5e22ef1829df167f9bfd027 Mon Sep 17 00:00:00 2001`
		`+ From: Rahul Sundaram <sundaram@fedoraproject.org>`
		`+ Date: Thu, 29 Feb 2024 21:27:03 -0500`
		`+ Subject: [PATCH] Systemd security settings`
		`+`
		`+ ---`
		`+ dbus/realmd.service.in \| 18 ++++++++++++++++++`
		`+ 1 file changed, 18 insertions(+)`
		`+`
		`+ diff --git a/dbus/realmd.service.in b/dbus/realmd.service.in`
		`+ index f0e8973..8fce139 100644`
		`+ --- a/dbus/realmd.service.in`
		`+ +++ b/dbus/realmd.service.in`
		`+ @@ -6,3 +6,21 @@ Documentation=man:realm(8) man:realmd.conf(5)`
		`+ Type=dbus`
		`+ BusName=org.freedesktop.realmd`
		`+ ExecStart=@libexecdir@/realmd`
		`+ +DevicePolicy=closed`
		`+ +KeyringMode=private`
		`+ +LockPersonality=yes`
		`+ +MemoryDenyWriteExecute=yes`
		`+ +NoNewPrivileges=yes`
		`+ +PrivateDevices=yes`
		`+ +ProtectClock=yes`
		`+ +ProtectControlGroups=yes`
		`+ +ProtectHome=yes`
		`+ +ProtectHostname=yes`
		`+ +ProtectKernelLogs=yes`
		`+ +ProtectKernelModules=yes`
		`+ +ProtectKernelTunables=yes`
		`+ +ProtectProc=invisible`
		`+ +ProtectSystem=no`
		`+ +RestrictRealtime=yes`
		`+ +RestrictSUIDSGID=yes`
		`+ +SystemCallArchitectures=native`
		`+ --`
		`+ 2.44.0`
		`+`

realmd.spec

file modified

+5 -1

		`@@ -1,6 +1,6 @@`
		`Name: realmd`
		`Version: 0.17.1`
		`- Release: 10%{?dist}`
		`+ Release: 11%{?dist}`
		`Summary: Kerberos realm enrollment service`
		`License: LGPL-2.1-or-later`
		`URL: https://gitlab.freedesktop.org/realmd/realmd`
		`@@ -12,6 +12,7 @@`
		`Patch0004: 0001-sssd-package-fix.patch`
		`Patch0005: 0001-tools-fix-ccache-handling-for-leave-operation.patch`
		`Patch0006: 0001-ipa-Propagate-hostname-error.patch`
		`+ Patch0007: 0001-Systemd-security-settings.patch`

		`BuildRequires: make`
		`BuildRequires: gcc`
		`@@ -98,6 +99,9 @@`
		`%doc ChangeLog`

		`%changelog`
		`+ * Thu Feb 29 2024 Sumit Bose <sbose@redhat.com> - 0.17.1-11`
		`+ - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening`
		`+`
		`* Mon Feb 26 2024 Sumit Bose <sbose@redhat.com> - 0.17.1-10`
		`- Propagate FreeIPA hostname error`
		`Resolves: rhbz#2264944`