bluez/SOURCES/0004-systemd-More-lockdown.patch
CentOS Sources 08d7f189ee import bluez-5.52-1.el8
# Conflicts:
#	.bluez.metadata
#	.gitignore
#	SOURCES/0001-build-Always-define-confdir-and-statedir.patch
#	SOURCES/0002-systemd-Add-PrivateTmp-and-NoNewPrivileges-options.patch
#	SOURCES/0003-systemd-Add-more-filesystem-lockdown.patch
#	SOURCES/0004-systemd-More-lockdown.patch
#	SPECS/bluez.spec
2021-08-31 14:58:34 +00:00

41 lines
1014 B
Diff

From 9a7872f04cb748e8de743d9136ecd91539d13cb7 Mon Sep 17 00:00:00 2001
From: Gopal Tiwari <gtiwari@redhat.com>
Date: Mon, 8 Jun 2020 19:56:42 +0530
Subject: [PATCH BlueZ 4/4] systemd: More lockdown
From 171d812218883281fed57b57fafd5c18eac441ac Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 13 Sep 2017 15:38:26 +0200
systemd: More lockdown
bluetoothd does not need to execute mapped memory, or real-time
access, so block those.
---
src/bluetooth.service.in | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
index 4daedef2a..f18801866 100644
--- a/src/bluetooth.service.in
+++ b/src/bluetooth.service.in
@@ -22,9 +22,15 @@ ProtectControlGroups=true
ReadWritePaths=@statedir@
ReadOnlyPaths=@confdir@
+# Execute Mappings
+MemoryDenyWriteExecute=true
+
# Privilege escalation
NoNewPrivileges=true
+# Real-time
+RestrictRealtime=true
+
[Install]
WantedBy=bluetooth.target
Alias=dbus-org.bluez.service
--
2.21.1