- Update copyright years.
- Remove «Priority: optional» field, which is now the default.
- Wrap and sort fields.
- Add spaces around operators in make variables.
Change-Id: If80962670fa8effeac7393f47780b2f6521b92b0
- Update copyright years.
- Update Standards-Version to 4.7.2
- Remove Rules-Requires-Root now defaulting to «no».
- Remove ancient conffile removal handling.
Change-Id: I04479e01030c5501fc55b77a8eb4a94b705a1878
ngcp-rate-o-mat service state BEFORE this change:
| $ sudo systemd-analyze security ngcp-rate-o-mat | tail -1
| → Overall exposure level for ngcp-rate-o-mat.service: 9.6 UNSAFE 😨
ngcp-rate-o-mat service state AFTER this change:
| $ sudo systemd-analyze security ngcp-rate-o-mat | grep -v '✓'
| NAME DESCRIPTION EXPOSURE
| ✗ PrivateNetwork= Service has access to the host's network 0.5
| ✗ User=/DynamicUser= Service runs as root user 0.4
| ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3
| ✗ DeviceAllow= Service has a device ACL with some special devices 0.1
| ✗ IPAddressDeny= Service does not define an IP address allow list 0.2
| ✗ ProtectClock= Service may write to the hardware clock or system clock 0.2
| ✗ ProtectKernelLogs= Service may read from or write to the kernel log ring buffer 0.2
| ✗ ProtectProc= Service has full access to process tree (/proc hidepid=) 0.2
| ✗ RestrictSUIDSGID= Service may create SUID/SGID files 0.2
| ✗ RootDirectory=/RootImage= Service runs within the host's root directory 0.1
| SupplementaryGroups= Service runs as root, option does not matter
| RemoveIPC= Service runs as root, option does not apply
| ✗ ProtectHostname= Service may change system host/domainname 0.1
| ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1
| ✗ ProcSubset= Service has full access to non-process /proc files (/proc subset=) 0.1
|
| → Overall exposure level for ngcp-rate-o-mat.service: 2.1 OK 🙂
NOTE: state with systemd v247.3-5 on bullseye
Change-Id: Iace478d9c5762cd641a333c0ea7d1b77b919a10d
Sipwise Jenkins Builder
Guillem Jover
Michael Prokop
Rene Krenn