08d7f189ee
# Conflicts: # .bluez.metadata # .gitignore # SOURCES/0001-build-Always-define-confdir-and-statedir.patch # SOURCES/0002-systemd-Add-PrivateTmp-and-NoNewPrivileges-options.patch # SOURCES/0003-systemd-Add-more-filesystem-lockdown.patch # SOURCES/0004-systemd-More-lockdown.patch # SPECS/bluez.spec
41 lines
1014 B
Diff
41 lines
1014 B
Diff
From 9a7872f04cb748e8de743d9136ecd91539d13cb7 Mon Sep 17 00:00:00 2001
|
|
From: Gopal Tiwari <gtiwari@redhat.com>
|
|
Date: Mon, 8 Jun 2020 19:56:42 +0530
|
|
Subject: [PATCH BlueZ 4/4] systemd: More lockdown
|
|
|
|
From 171d812218883281fed57b57fafd5c18eac441ac Mon Sep 17 00:00:00 2001
|
|
From: Bastien Nocera <hadess@hadess.net>
|
|
Date: Wed, 13 Sep 2017 15:38:26 +0200
|
|
|
|
systemd: More lockdown
|
|
|
|
bluetoothd does not need to execute mapped memory, or real-time
|
|
access, so block those.
|
|
---
|
|
src/bluetooth.service.in | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
|
|
index 4daedef2a..f18801866 100644
|
|
--- a/src/bluetooth.service.in
|
|
+++ b/src/bluetooth.service.in
|
|
@@ -22,9 +22,15 @@ ProtectControlGroups=true
|
|
ReadWritePaths=@statedir@
|
|
ReadOnlyPaths=@confdir@
|
|
|
|
+# Execute Mappings
|
|
+MemoryDenyWriteExecute=true
|
|
+
|
|
# Privilege escalation
|
|
NoNewPrivileges=true
|
|
|
|
+# Real-time
|
|
+RestrictRealtime=true
|
|
+
|
|
[Install]
|
|
WantedBy=bluetooth.target
|
|
Alias=dbus-org.bluez.service
|
|
--
|
|
2.21.1
|
|
|