Now that the daemons reliably land in this unit rather than inheriting the web
server's namespace, the unit is worth hardening. Add the protections that do
not interfere with capture: ProtectSystem=full, ProtectClock,
ProtectControlGroups, ProtectHostname, ProtectKernelLogs, ProtectKernelModules,
ProtectKernelTunables, LockPersonality, RestrictRealtime and RestrictSUIDSGID.
Set the options that would break us explicitly rather than leaving them to a
default a distribution might override, since each fails in a way that is not
visible from the web ui:
PrivateDevices and PrivateTmp, because zmc publishes frames in /dev/shm for a
zms that runs under the web server, and zmaudit.pl cleans up the swap images
zms writes under /var/tmp.
ProcSubset and ProtectProc, because zmstats reads /proc/stat, /proc/meminfo
and /proc/loadavg, and zmpkg.pl reads /proc/self/cgroup to decide whether
systemd started it.
Record why NoNewPrivileges, ProtectHome and MemoryDenyWriteExecute are absent,
and warn that the mount namespace these options create hides filesystems
mounted after ZoneMinder starts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019URmtYqza6Rzi6F7cmabSm
Merge MAC vendor database from zm_utils into ZoneMinder. Adds entries for
Reolink, Dahua, Hanwha, Buffalo, Google, Sagemcom, and many additional
HikVision/Ubiquiti/Grandstream MACs. Sorted by vendor type for readability.
Removes duplicates from zm_utils source. Preserves ZM-only Uniview and
TP-Link entries. Keeps IC Realtime Dahua control mapping that zm_utils lost.
Updates Vivotek with ePTZ control and normalizes D-Link type name.
34 -> 73 entries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add probeUniview() that queries the camera's LAPI for device model,
name, resolution, and codec. Uses RTSP main stream URL format
rtsp://ip:554/media/video1 and LAPI snapshot endpoint for thumbnails.
Includes OUI alias probeZhejiangUniviewTechnologiesCoLtd for IEEE
vendor name matching. Adds all 4 registered Uniview MAC OUI prefixes
(48ea63, 6cf17e, 88263f, c47905) to MacVendors.json.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Indent with 2 spaces
Also remove expressions form closing tags. They have been made optional a while ago since they make reading rather more difficult.
RPM packaging calls the freedesktop tool "desktop-file-install", which fails with:
```
error: key "Categories" is present in group "Desktop Entry", but the type is "Link" while this key is only valid for type "Application"
```
@connortechnology This fails the build so I'm removing the categories. Let me know if you've got any other ideas.
This avoids duplication and fixes a few things that were missing in the Docker version for modern Apache:
* AllowOverride All
* Require all granted
Deleted `ServerName @WEB_HOST@` since `WEB_HOST` was never defined in ZM code so it would give an Apache error.
