commit: 5eefb61d11a77c123475fec73db819fa6121b7f2 Author: Sam James (sam_c) <sam <AT> cmpct <DOT> info> AuthorDate: Wed Mar 4 04:49:58 2020 +0000 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> CommitDate: Mon Mar 30 18:36:43 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5eefb61d
net-misc/chrony: Run as non-root when USE=caps, revbump When caps is enabled, drop to the user ntp (acct-user/ntp), as opposed to remaining root. Adds a tmpfile.d entry for /run/chrony to ensure correct permissions. Closes: https://bugs.gentoo.org/711058 Signed-off-by: Sam James (sam_c) <sam <AT> cmpct.info> Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> .../{chrony-9999.ebuild => chrony-3.5-r3.ebuild} | 45 +++++++++++++++++----- net-misc/chrony/chrony-9999.ebuild | 29 ++++++++++++-- net-misc/chrony/files/chronyd.conf | 2 +- 3 files changed, 63 insertions(+), 13 deletions(-) diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-3.5-r3.ebuild similarity index 70% copy from net-misc/chrony/chrony-9999.ebuild copy to net-misc/chrony/chrony-3.5-r3.ebuild index e939129a01a..3f11f8dd951 100644 --- a/net-misc/chrony/chrony-9999.ebuild +++ b/net-misc/chrony/chrony-3.5-r3.ebuild @@ -1,16 +1,16 @@ -# Copyright 1999-2019 Gentoo Authors +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit git-r3 systemd toolchain-funcs +inherit systemd tmpfiles toolchain-funcs DESCRIPTION="NTP client and server programs" HOMEPAGE="https://chrony.tuxfamily.org/"; -EGIT_REPO_URI="https://git.tuxfamily.org/chrony/chrony.git/"; +SRC_URI="https://download.tuxfamily.org/${PN}/${P/_/-}.tar.gz"; LICENSE="GPL-2" SLOT="0" -KEYWORDS="" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ppc ~ppc64 ~sparc ~x86" IUSE=" +adns caps +cmdmon html ipv6 libedit +ntp +phc pps readline +refclock +rtc seccomp selinux @@ -27,14 +27,17 @@ CDEPEND=" " DEPEND=" ${CDEPEND} - dev-ruby/asciidoctor + caps? ( acct-group/ntp acct-user/ntp ) + html? ( dev-ruby/asciidoctor ) pps? ( net-misc/pps-tools ) " RDEPEND=" ${CDEPEND} selinux? ( sec-policy/selinux-chronyd ) " + RESTRICT=test + S="${WORKDIR}/${P/_/-}" PATCHES=( @@ -47,6 +50,16 @@ src_prepare() { sed -i \ -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf "$T"/chronyd.conf + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf || die + fi } src_configure() { @@ -95,14 +108,14 @@ src_configure() { } src_compile() { - emake all docs + emake all docs $(usex html '' 'ADOC=true') } src_install() { default newinitd "${FILESDIR}"/chronyd.init-r2 chronyd - newconfd "${FILESDIR}"/chronyd.conf chronyd + newconfd "${T}"/chronyd.conf chronyd insinto /etc/${PN} newins examples/chrony.conf.example1 chrony.conf @@ -110,8 +123,12 @@ src_install() { docinto examples dodoc examples/*.example* - docinto html - dodoc doc/*.html + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + + if use html; then + docinto html + dodoc doc/*.html + fi keepdir /var/{lib,log}/chrony @@ -121,3 +138,13 @@ src_install() { systemd_dounit examples/{chronyd,chrony-wait}.service systemd_enable_ntpunit 50-chrony chronyd.service } + +pkg_preinst() { + if use caps && has_version net-misc/chrony[-caps]; then + elog "/run/chronyd needs ntp:ntp permissions; please check." + elog "The safest option is reboot, but you may chown manually." + elif ! use caps && has_version net-misc/chrony[caps]; then + elog "/run/chronyd needs root:root permissions; please check." + elog "The safest option is reboot, but you may chown manually." + fi +} diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-9999.ebuild index e939129a01a..5b03ec4fe42 100644 --- a/net-misc/chrony/chrony-9999.ebuild +++ b/net-misc/chrony/chrony-9999.ebuild @@ -1,8 +1,8 @@ -# Copyright 1999-2019 Gentoo Authors +# Copyright 1999-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -inherit git-r3 systemd toolchain-funcs +inherit git-r3 tmpfiles systemd toolchain-funcs DESCRIPTION="NTP client and server programs" HOMEPAGE="https://chrony.tuxfamily.org/"; @@ -27,6 +27,7 @@ CDEPEND=" " DEPEND=" ${CDEPEND} + caps? ( acct-group/ntp acct-user/ntp ) dev-ruby/asciidoctor pps? ( net-misc/pps-tools ) " @@ -47,6 +48,16 @@ src_prepare() { sed -i \ -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf "$T"/chronyd.conf + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf || die + fi } src_configure() { @@ -102,7 +113,7 @@ src_install() { default newinitd "${FILESDIR}"/chronyd.init-r2 chronyd - newconfd "${FILESDIR}"/chronyd.conf chronyd + newconfd "${T}"/chronyd.conf chronyd insinto /etc/${PN} newins examples/chrony.conf.example1 chrony.conf @@ -110,6 +121,8 @@ src_install() { docinto examples dodoc examples/*.example* + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + docinto html dodoc doc/*.html @@ -121,3 +134,13 @@ src_install() { systemd_dounit examples/{chronyd,chrony-wait}.service systemd_enable_ntpunit 50-chrony chronyd.service } + +pkg_preinst() { + if use caps && has_version net-misc/chrony[-caps]; then + elog "/run/chronyd needs ntp:ntp permissions; please check." + elog "The safest option is reboot, but you may chown manually." + elif ! use caps && has_version net-misc/chrony[caps]; then + elog "/run/chronyd needs root:root permissions; please check." + elog "The safest option is reboot, but you may chown manually." + fi +} diff --git a/net-misc/chrony/files/chronyd.conf b/net-misc/chrony/files/chronyd.conf index fc43a95c40f..c641d985e56 100644 --- a/net-misc/chrony/files/chronyd.conf +++ b/net-misc/chrony/files/chronyd.conf @@ -9,4 +9,4 @@ CFGFILE="/etc/chrony/chrony.conf" # The combination of "-s -r" allows chronyd to perform long term averaging of # the gain or loss rate across system reboots and shutdowns. -ARGS="" +ARGS="-u ntp"
