Make it safer

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

.gitignore

@@ -1,3 +1,4 @@
 /nebula-1.5.2.tar.gz
 /nebula-1.6.0.tar.gz
 /nebula-1.6.1.tar.gz
+/nebula-1.7.2.tar.gz

nebula.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Nebula overlay networking tool
+
+After=basic.target network.target network-online.target
+Before=sshd.service
+Wants=basic.target network-online.target nss-lookup.target time-sync.target
+
+[Service]
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/usr/bin/nebula -config /etc/nebula/config.yml
+SyslogIdentifier=nebula
+#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+CapabilityBoundingSet=CAP_NET_ADMIN
+RestrictNamespaces=yes
+WorkingDirectory=/etc/nebula
+ProtectClock=true
+ProtectSystem=strict
+ProtectHostname=yes
+ProtectHome=yes
+PrivateHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+NoNewPrivileges=yes
+PrivateTmp=yes
+UMask=0077
+RestrictAddressFamilies=AF_NETLINK AF_INET AF_INET6
+DeviceAllow=/dev/null rw
+DeviceAllow=/dev/net/tun rw
+PrivateTmp=true
+ProtectSystem=true
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target

nebula.spec

@@ -3,9 +3,10 @@
 
 # https://github.com/slackhq/nebula
 %global goipath         github.com/slackhq/nebula
-Version:                1.6.1
+Version:                1.7.2
+
+%gometa -f
 
-%gometa
 %global goname nebula
 
 %global common_description %{expand:
@@ -22,6 +23,7 @@ Summary:        A scalable overlay networking tool with a focus on performance,
 License:        MIT
 URL:            %{gourl}
 Source0:        %{gosource}
+Source1:        nebula.service
 
 BuildRequires:  systemd-rpm-macros
 
@@ -35,8 +37,6 @@ Conflicts:      nebula < 1.0
 
 %prep
 %goprep
-# https://github.com/slackhq/nebula/pull/791
-sed -i 's/\(Wants=.*\)$/\1 nss-lookup.target time-sync.target/' dist/fedora/nebula.service
 
 %generate_buildrequires
 %go_generate_buildrequires
@@ -53,7 +53,7 @@ install -m 0755 -vd                             %{buildroot}%{_bindir}
 install -m 0755 -vp %{gobuilddir}/bin/*         %{buildroot}%{_bindir}/
 install -m 0755 -vd                             %{buildroot}%{_sysconfdir}/%{name}
 install -m 0640 -vp examples/config.yml         %{buildroot}%{_sysconfdir}/%{name}
-install -m 0644 -vDp dist/fedora/nebula.service %{buildroot}%{_unitdir}/%{name}.service
+install -m 0644 -vDp %{SOURCE1}                 %{buildroot}%{_unitdir}/%{name}.service
 
 %if %{with check}
 %check

sources

@@ -1 +1 @@
-SHA512 (nebula-1.6.1.tar.gz) = 751777c9955bae2f2a2f6f81e1956c131766d7dead3d51fd125e2804d20073a80ed4739ff336f1c2da04e060eaa20d1aa7c2bd9268661eae0fcd26e13cb43cfb
+SHA512 (nebula-1.7.2.tar.gz) = b9b871eabdf0ffb05cb350fd665e4cc7c39c9c519837eb4aa88aba4d8d43d62e098da6eb4d2e679100eaa1755f1bb0a3d416a2ea5271ad1e841be1d3434fb341