Remove customizations to memcached package

Keep memcached package intact and customize memcached service file by
overwriting it from platform-util.

Story: 2002826
Task: 24548
Depends-On: https://review.openstack.org/600867

Change-Id: Ic18d7efc1ea5548dc6245c7e9658843bd8d557cf
Signed-off-by: Jack Ding <jack.ding@windriver.com>

utilities/platform-util/centos/build_srpm.data

@@ -1,4 +1,4 @@
 SRC_DIR="platform-util"
 COPY_LIST_TO_TAR="scripts"
 
-TIS_PATCH_VER=12
+TIS_PATCH_VER=13

utilities/platform-util/centos/platform-util.spec

@@ -20,6 +20,12 @@ Summary: non controller platform utilities
 %description -n platform-util-noncontroller
 Platform utilities that don't get packaged on controller hosts
 
+%package -n platform-util-controller
+Summary: controller platform utilities
+
+%description -n platform-util-controller
+Platform utilities that packaged on controllers or one node system
+
 %define local_dir /usr/local
 %define local_bindir %{local_dir}/bin
 %define local_sbindir %{local_dir}/sbin
@@ -52,6 +58,7 @@ install -m 700 -p -D %{_buildsubdir}/scripts/patch-restart-haproxy %{buildroot}%
 install -d %{buildroot}/etc/systemd/system
 install -m 644 -p -D %{_buildsubdir}/scripts/opt-platform.mount %{buildroot}/etc/systemd/system
 install -m 644 -p -D %{_buildsubdir}/scripts/opt-platform.service %{buildroot}/etc/systemd/system
+install -m 644 -p -D %{_buildsubdir}/scripts/memcached.service %{buildroot}/etc/systemd/system
 
 # Mask the systemd ctrl-alt-delete.target, to disable reboot on ctrl-alt-del
 ln -sf /dev/null %{buildroot}/etc/systemd/system/ctrl-alt-del.target
@@ -85,3 +92,7 @@ systemctl enable opt-platform.service
 # from parsing the fstab is not used by systemd.
 /etc/systemd/system/opt-platform.mount
 /etc/systemd/system/opt-platform.service
+
+%files -n platform-util-controller
+%defattr(-,root,root,-)
+/etc/systemd/system/memcached.service

utilities/platform-util/scripts/memcached.service

@@ -0,0 +1,55 @@
+#
+# This service file is a customized version in platform-util package from
+# openstack/stx-integ project
+
+[Unit]
+Description=memcached daemon
+Before=httpd.service
+After=network-online.target
+
+[Service]
+EnvironmentFile=/etc/sysconfig/memcached
+ExecStart=/usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS
+
+# Set up a new file system namespace and mounts private /tmp and /var/tmp directories
+# so this service cannot access the global directories and other processes cannot
+# access this service's directories.
+PrivateTmp=true
+
+# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
+ProtectSystem=full
+
+# Ensures that the service process and all its children can never gain new privileges
+NoNewPrivileges=true
+
+# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
+# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
+# but no physical devices such as /dev/sda.
+PrivateDevices=true
+
+# Required for dropping privileges and running as a different user
+CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
+LimitNOFILE=16384
+
+# Attempts to create memory mappings that are writable and executable at the same time,
+# or to change existing memory mappings to become executable are prohibited.
+# XXX: this property is supported with systemd 231+ which is not yet on EL7
+# MemoryDenyWriteExecute=true
+
+# Restricts the set of socket address families accessible to the processes of this unit.
+# Protects against vulnerabilities such as CVE-2016-8655
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+# These service parameters are commented out since they are incompatible with
+# Centos 7 and generate warning messages when included.
+#ProtectKernelModules=true
+#ProtectKernelTunables=true
+#ProtectControlGroups=true
+#RestrictRealtime=true
+#RestrictNamespaces=true
+
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target