From f7e09b5ce009c8df2f7fa21d23a3254d9ffcf5a5 Mon Sep 17 00:00:00 2001
From: Gianluca Boiano <491117+M0Rf30@users.noreply.github.com>
Date: Fri, 19 Jun 2026 21:41:14 +0200
Subject: [PATCH 1/2] chore: [CO-3846] temporary revert to ProtectSystem=yes
 (#126)

---
 build/agent/PKGBUILD                  | 2 +-
 build/agent/service-discover.service  | 8 ++++++--
 build/server/PKGBUILD                 | 2 +-
 build/server/service-discover.service | 8 ++++++--
 4 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/build/agent/PKGBUILD b/build/agent/PKGBUILD
index 632397e..2cfc04d 100644
--- a/build/agent/PKGBUILD
+++ b/build/agent/PKGBUILD
@@ -30,7 +30,7 @@ source=(
   "service-discover-legacy.service"
 )
 sha256sums=(
-  '24d801a607705c6134d0ed4efd08f3badab46d15c669d6238f5dc046b0be374b'
+  '3c26a0a04ebec4047a80915c988cddf9a356ed2da71e19b1ae59b905c60a5d0d'
   'e0e17bae0bfb978dd52718a03079eaf30c2bf5dba080ca98c2964eb42e02bf14'
 )
 
diff --git a/build/agent/service-discover.service b/build/agent/service-discover.service
index fe1851d..e5b6f56 100644
--- a/build/agent/service-discover.service
+++ b/build/agent/service-discover.service
@@ -22,8 +22,12 @@ TimeoutStopSec=120s
 
 # Hardening
 PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths=/var/lib/service-discover /etc/zextras/service-discover /run/carbonio /tmp
+#ProtectSystem=strict
+#ReadWritePaths=/var/lib/service-discover /etc/zextras/service-discover /run/carbonio /tmp
+ProtectSystem=yes
+ReadOnlyPaths=/usr
+ReadOnlyPaths=/boot
+ReadOnlyPaths=/efi
 PrivateDevices=yes
 ProtectHome=yes
 ProtectKernelModules=yes
diff --git a/build/server/PKGBUILD b/build/server/PKGBUILD
index c4bc4f5..33a86c6 100644
--- a/build/server/PKGBUILD
+++ b/build/server/PKGBUILD
@@ -29,7 +29,7 @@ source=(
   "service-discover-legacy.service"
 )
 sha256sums=(
-  'b419dbd9787fe0512ca2b9fb6225444d5bb5e28418a434a10f11571836d597ef'
+  '3777ea6ca6c77656a92666bd4eeca63df87c67f4b29d3b4dc8abc3bc32b9cc2a'
   '5780163ac614276da1c812580686eb8adfdbfe9eebe62397d6a354ca461db1a9'
 )
 
diff --git a/build/server/service-discover.service b/build/server/service-discover.service
index 3b42f01..cc1e2ce 100644
--- a/build/server/service-discover.service
+++ b/build/server/service-discover.service
@@ -22,8 +22,12 @@ TimeoutStopSec=120s
 
 # Hardening
 PrivateTmp=yes
-ProtectSystem=strict
-ReadWritePaths=/var/lib/service-discover /etc/zextras/service-discover /run/carbonio /tmp
+#ProtectSystem=strict
+#ReadWritePaths=/var/lib/service-discover /etc/zextras/service-discover /run/carbonio /tmp
+ProtectSystem=yes
+ReadOnlyPaths=/usr
+ReadOnlyPaths=/boot
+ReadOnlyPaths=/efi
 PrivateDevices=yes
 ProtectHome=yes
 ProtectKernelModules=yes

From acf088cc49aa785c227da48fbede3594cf0a3d59 Mon Sep 17 00:00:00 2001
From: Zextras Bot <bot@zextras.com>
Date: Sat, 20 Jun 2026 02:20:14 +0000
Subject: [PATCH 2/2] fix(deps): update module github.com/moby/moby/api to
 v1.55.0

---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index c47a947..97782a7 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/hashicorp/consul/api/v2 v2.0.0
-	github.com/moby/moby/api v1.54.2
+	github.com/moby/moby/api v1.55.0
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.11.1
 	github.com/testcontainers/testcontainers-go v0.42.0
diff --git a/go.sum b/go.sum
index 94e2d9a..5262dca 100644
--- a/go.sum
+++ b/go.sum
@@ -231,8 +231,8 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
 github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
 github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
 github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=