Compilation results for cp7009.magru.wmnet: System changes detected

Catalog differences

Summary

Resources modified

• File[/lib/systemd/system/haproxy.service]

  Content differences:

  --- /lib/systemd/system/haproxy.service.orig
  +++ /lib/systemd/system/haproxy.service
  @@ -18,6 +18,7 @@
   SuccessExitStatus=143
   Type=notify
   LimitNOFILE=500000
  +LimitMEMLOCK=infinity
   
   # haproxy systemd hardening.
   NoNewPrivileges=true

• Systemd::Unit[haproxy]

• Systemd::Service[haproxy]

• Class[Profile::Cache::Haproxy]

  Parameters differences:

  --- Class[Profile::Cache::Haproxy].orig
  +++ Class[Profile::Cache::Haproxy]
  
  @@
  -    enable_mlock => False
  +    enable_mlock => True
  

• Class[Haproxy]

  Parameters differences:

  --- Class[Haproxy].orig
  +++ Class[Haproxy]
  
  @@
  -    systemd_content => [Unit]
  Description=HAProxy Load Balancer
  Documentation=man:haproxy(1)
  Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz
  After=network-online.target syslog.service
  Wants=network-online.target syslog.service
  
  [Service]
  Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/run/haproxy/haproxy.pid"
  EnvironmentFile=-/etc/default/haproxy
  ExecStartPre=/usr/local/sbin/tls-check /etc/haproxy-tls-check.cfg
  ExecStartPre=/usr/sbin/haproxy -f ${CONFIG} -c -q $EXTRAOPTS
  ExecStart=/usr/sbin/haproxy -Ws -f ${CONFIG} -p $PIDFILE $EXTRAOPTS
  ExecReload=/usr/sbin/haproxy -f ${CONFIG} -c -q $EXTRAOPTS
  ExecReload=/bin/kill -USR2 $MAINPID
  KillMode=mixed
  Restart=always
  SuccessExitStatus=143
  Type=notify
  LimitNOFILE=500000
  
  # haproxy systemd hardening.
  NoNewPrivileges=true
  PrivateDevices=true
  PrivateTmp=true
  ProtectHome=true
  ProtectSystem=strict
  ProtectKernelTunables=true
  ProtectKernelModules=true
  ProtectControlGroups=true
  RestrictNamespaces=true
  RestrictRealtime=true
  SystemCallArchitectures=native
  RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
  SystemCallFilter=~@clock @cpu-emulation @keyring @module @obsolete @raw-io @reboot @swap
  CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_KILL
  
  # Since we set ProtectSystem=strict, allow access to the below paths.
  ReadWritePaths=/run/haproxy
  ReadWritePaths=/var/lib/haproxy
  
  [Install]
  WantedBy=multi-user.target
  
  +    systemd_content => [Unit]
  Description=HAProxy Load Balancer
  Documentation=man:haproxy(1)
  Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz
  After=network-online.target syslog.service
  Wants=network-online.target syslog.service
  
  [Service]
  Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/run/haproxy/haproxy.pid"
  EnvironmentFile=-/etc/default/haproxy
  ExecStartPre=/usr/local/sbin/tls-check /etc/haproxy-tls-check.cfg
  ExecStartPre=/usr/sbin/haproxy -f ${CONFIG} -c -q $EXTRAOPTS
  ExecStart=/usr/sbin/haproxy -Ws -f ${CONFIG} -p $PIDFILE $EXTRAOPTS
  ExecReload=/usr/sbin/haproxy -f ${CONFIG} -c -q $EXTRAOPTS
  ExecReload=/bin/kill -USR2 $MAINPID
  KillMode=mixed
  Restart=always
  SuccessExitStatus=143
  Type=notify
  LimitNOFILE=500000
  LimitMEMLOCK=infinity
  
  # haproxy systemd hardening.
  NoNewPrivileges=true
  PrivateDevices=true
  PrivateTmp=true
  ProtectHome=true
  ProtectSystem=strict
  ProtectKernelTunables=true
  ProtectKernelModules=true
  ProtectControlGroups=true
  RestrictNamespaces=true
  RestrictRealtime=true
  SystemCallArchitectures=native
  RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
  SystemCallFilter=~@clock @cpu-emulation @keyring @module @obsolete @raw-io @reboot @swap
  CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_KILL
  
  # Since we set ProtectSystem=strict, allow access to the below paths.
  ReadWritePaths=/run/haproxy
  ReadWritePaths=/var/lib/haproxy
  
  [Install]
  WantedBy=multi-user.target
  
  

Relevant files

• Production catalog
• Change catalog
• Production errors/warnings
• Change errors/warnings
• Core Diff
• Full Diff