Make it safer

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

.gitignore

@@ -1,4 +1,4 @@
 /nebula-1.5.2.tar.gz
 /nebula-1.6.0.tar.gz
 /nebula-1.6.1.tar.gz
-/nebula-vendor-1.6.1.tar.gz
+/nebula-1.7.2.tar.gz

nebula.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Nebula overlay networking tool
+
+After=basic.target network.target network-online.target
+Before=sshd.service
+Wants=basic.target network-online.target nss-lookup.target time-sync.target
+
+[Service]
+ExecReload=/bin/kill -HUP $MAINPID
+ExecStart=/usr/bin/nebula -config /etc/nebula/config.yml
+SyslogIdentifier=nebula
+#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+CapabilityBoundingSet=CAP_NET_ADMIN
+RestrictNamespaces=yes
+WorkingDirectory=/etc/nebula
+ProtectClock=true
+ProtectSystem=strict
+ProtectHostname=yes
+ProtectHome=yes
+PrivateHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+NoNewPrivileges=yes
+PrivateTmp=yes
+UMask=0077
+RestrictAddressFamilies=AF_NETLINK AF_INET AF_INET6
+DeviceAllow=/dev/null rw
+DeviceAllow=/dev/net/tun rw
+PrivateTmp=true
+ProtectSystem=true
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target

nebula.spec

@@ -3,9 +3,10 @@
 
 # https://github.com/slackhq/nebula
 %global goipath         github.com/slackhq/nebula
-Version:                1.6.1
+Version:                1.7.2
+
+%gometa -f
 
-%gometa
 %global goname nebula
 
 %global common_description %{expand:
@@ -22,11 +23,9 @@ Summary:        A scalable overlay networking tool with a focus on performance,
 License:        MIT
 URL:            %{gourl}
 Source0:        %{gosource}
-Source1:        %{name}-vendor-%{version}.tar.gz
+Source1:        nebula.service
 
 BuildRequires:  systemd-rpm-macros
-BuildRequires:  go-rpm-macros
-BuildRequires:  compiler(go-compiler)
 
 # Let's be sure that people do not upgrade from the "old" nebula. We can sensibly drop it by F39
 Conflicts:      nebula < 1.0
@@ -37,44 +36,24 @@ Conflicts:      nebula < 1.0
 %gopkg
 
 %prep
-%if 0%{?fedora}
 %goprep
-# https://github.com/slackhq/nebula/pull/791
+
-sed -i 's/\(Wants=.*\)$/\1 nss-lookup.target time-sync.target/' dist/fedora/nebula.service
 %generate_buildrequires
 %go_generate_buildrequires
 
-%else
-%autosetup -a 1
-mkdir -p %{_builddir}/src/github.com/slackhq/
-cp -r %{_builddir}/%{name}-%{version} %{_builddir}/src/github.com/slackhq/%{name}
-mkdir -p %{_builddir}/%{name}-%{version}/_build/src/github.com/slackhq/nebula
-mv %{_builddir}/src %{_builddir}/%{name}-%{version}/_build/src
-%endif
-
 %build
 export LDFLAGS="-X main.Build=%{version}-Fedora $(LDFLAGS)"
-%if 0%{?fedora}
 for cmd in cmd/* ; do
   %gobuild -o %{gobuilddir}/bin/$(basename $cmd) %{goipath}/$cmd
 done
-%else
-export GOPATH="%{_builddir}/%{name}-%{version}/_build"
-pushd $GOPATH/src/github.com/slackhq/nebula
-go generate
-popd
-for cmd in cmd/* ; do
-  %gobuild -o bin/$(basename $cmd) %{goipath}/$cmd
-done
-%endif
 
 %install
 %gopkginstall
 install -m 0755 -vd                             %{buildroot}%{_bindir}
-install -m 0755 -vp bin/*         %{buildroot}%{_bindir}/
+install -m 0755 -vp %{gobuilddir}/bin/*         %{buildroot}%{_bindir}/
 install -m 0755 -vd                             %{buildroot}%{_sysconfdir}/%{name}
 install -m 0640 -vp examples/config.yml         %{buildroot}%{_sysconfdir}/%{name}
-install -m 0644 -vDp dist/fedora/nebula.service %{buildroot}%{_unitdir}/%{name}.service
+install -m 0644 -vDp %{SOURCE1}                 %{buildroot}%{_unitdir}/%{name}.service
 
 %if %{with check}
 %check

sources

@@ -1,2 +1 @@
-SHA512 (nebula-1.6.1.tar.gz) = 751777c9955bae2f2a2f6f81e1956c131766d7dead3d51fd125e2804d20073a80ed4739ff336f1c2da04e060eaa20d1aa7c2bd9268661eae0fcd26e13cb43cfb
+SHA512 (nebula-1.7.2.tar.gz) = b9b871eabdf0ffb05cb350fd665e4cc7c39c9c519837eb4aa88aba4d8d43d62e098da6eb4d2e679100eaa1755f1bb0a3d416a2ea5271ad1e841be1d3434fb341
-SHA512 (nebula-vendor-1.6.1.tar.gz) = 63fb94b5478fc5cf5d155bec04e5bf6e8d9187719166a8a4f7c7ff2cae772fdf531a2168781339e5b19decce202ec9fcf623ab7543a7e4831bce57ff21c7c9a2