diff options
Diffstat (limited to 'poky/meta/recipes-support/rng-tools')
| -rw-r--r-- | poky/meta/recipes-support/rng-tools/rng-tools/rngd.service | 21 | ||||
| -rw-r--r-- | poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb (renamed from poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb) | 9 |
2 files changed, 28 insertions, 2 deletions
diff --git a/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service b/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service index aaaaa2907..0559b9799 100644 --- a/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service +++ b/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service @@ -8,6 +8,25 @@ Conflicts=shutdown.target [Service] EnvironmentFile=-@SYSCONFDIR@/default/rng-tools ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS +CapabilityBoundingSet=CAP_SYS_ADMIN +IPAddressDeny=any +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectSystem=strict +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service [Install] -WantedBy=multi-user.target +WantedBy=sysinit.target diff --git a/poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb b/poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb index 83a48a4ec..8c98a9aa3 100644 --- a/poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb +++ b/poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb @@ -14,7 +14,7 @@ SRC_URI = "\ file://default \ file://rngd.service \ " -SRCREV = "eb5e34c7fb05594760f99d863fbe0401fe297b93" +SRCREV = "4a865797a69dd38c64a86aa32884ecc9ba7b4d08" S = "${WORKDIR}/git" @@ -49,4 +49,11 @@ do_install_append() { -e 's,@SBINDIR@,${sbindir},g' \ ${D}${sysconfdir}/init.d/rng-tools \ ${D}${systemd_system_unitdir}/rngd.service + + if [ "${@bb.utils.contains('PACKAGECONFIG', 'nistbeacon', 'yes', 'no', d)}" = "yes" ]; then + sed -i \ + -e '/^IPAddressDeny=any/d' \ + -e '/^RestrictAddressFamilies=/ s/$/ AF_INET AF_INET6/' \ + ${D}${systemd_system_unitdir}/rngd.service + fi } |