File fix-hardened-service.patch of Package audit

Overview Repositories Revisions Requests Users Attributes Meta

File fix-hardened-service.patch of Package audit (Revision b45ec063c4e7856d1bf1ea7fa6a46c44)

Currently displaying revision b45ec063c4e7856d1bf1ea7fa6a46c44 , Show latest

From: Enzo Matsumiya <ematsumiya@suse.de>
Subject: init.d/auditd.service: make /etc/audit writable
References: bsc#1181400

systemd hardening effort (bsc#1181400) broke auditd.service when starting/
restarting it. This was because auditd couldn't save/create audit.rules from
/etc/audit/rules.d/* files.

Make /etc/audit writable for the service.

Also remove PrivateDevices=true so /dev/* are exposed to auditd.

Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>

Index: audit-3.0.9/init.d/auditd.service
===================================================================
--- audit-3.0.9.orig/init.d/auditd.service
+++ audit-3.0.9/init.d/auditd.service
@@ -41,12 +41,12 @@ RestrictRealtime=true
 # added automatically, for details please see
 # https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
 ProtectSystem=full
-PrivateDevices=true
 ProtectHostname=true
 ProtectClock=true
 ProtectKernelTunables=true
 ProtectKernelLogs=true
 # end of automatic additions 
+ReadWritePaths=/etc/audit
 
 [Install]
 WantedBy=multi-user.target

Places

File fix-hardened-service.patch of Package audit (Revision b45ec063c4e7856d1bf1ea7fa6a46c44)

Places