Projects
Factory:RISC-V:Base
bluez
_service:tar_scm:0004-systemd-More-lockdown.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:0004-systemd-More-lockdown.patch of Package bluez
From a6963e0402695d7b6a89c1b1c75c40dbd8fcde52 Mon Sep 17 00:00:00 2001 From: Bastien Nocera <hadess@hadess.net> Date: Wed, 13 Sep 2017 15:38:26 +0200 Subject: [PATCH 4/4] systemd: More lockdown bluetoothd does not need to execute mapped memory, or real-time access, so block those. --- src/bluetooth.service.in | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in index 4daedef2a..f18801866 100644 --- a/src/bluetooth.service.in +++ b/src/bluetooth.service.in @@ -22,9 +22,15 @@ ProtectControlGroups=true ReadWritePaths=@statedir@ ReadOnlyPaths=@confdir@ +# Execute Mappings +MemoryDenyWriteExecute=true + # Privilege escalation NoNewPrivileges=true +# Real-time +RestrictRealtime=true + [Install] WantedBy=bluetooth.target Alias=dbus-org.bluez.service -- 2.21.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2