** Description changed: + [ Impact ] + + * The service file for ntpd-rs in Noble and Resolute does not grant the + daemon CAP_NET_BIND_SERVICE capabilities. As the daemon can be + configured to act as an NTP server, it needs to bind to privileged ports + (UDP 123). + + * This is fixed by granting the capability via AmbientCapabilities in + the systemd service unit. + + [ Test Plan ] + + 1. Setup + * Install ntpd-rs. + * Uncomment `listen = "[::]:123"` in /etc/ntpd-rs/ntp.toml. + * Restart the service: `sudo systemctl restart ntpd-rs.service` + + 2. Unpatched + * Run `journalctl -u ntpd-rs.service` and verify the "Permission denied" socket error. + * Run `ss -lupn 'sport = :123'` and confirm no process is bound to UDP 123. + + 3. Patched + * Upgrade to the package from -proposed. + * Verify no permission errors exist in the journal. + * Run `ss -lupn 'sport = :123'` and confirm ntpd-rs is listening on UDP 123. + + [ Where problems could occur ] + + * Granting CAP_NET_BIND_SERVICE allows the daemon to bind to any privileged port (< 1024), slightly expanding its security exposure if the daemon is compromised. + + * If CapabilityBoundingSet is or becomes restricted in the service unit, missing CAP_NET_BIND_SERVICE in the bounding set could cause issues. + + [ Other Info ] + + * This matches the service file provided by upstream: + https://github.com/pendulum-project/ntpd-rs/blob/d89fbb3916d1dc3a063c9d8813be026728951fce/docs/examples/conf/ntpd-rs.service + + [ Original Report ] + ntpd-rs.service missing CAP_NET_BIND_SERVICE for server mode on UDP/123 Starting service failed to allocate Port 123 with message: WARN Ntp Server{address=0.0.0.0:123}: ntpd::daemon::server: Could not open server socket error=Os { code: 13, kind: PermissionDenied, message: "Permission denied" } self.config.listen=0.0.0.0:123 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: ntpd-rs 1.7.1-1 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: pass Date: Thu Jul 30 10:43:07 2026 InstallationDate: Installed on 2026-07-28 (2 days ago) InstallationMedia: Ubuntu-Server 26.04 "Resolute Raccoon" - Release amd64 (20260420.1) ProcEnviron: - PATH=(custom, no user) - SHELL=/bin/bash - TERM=xterm - XDG_RUNTIME_DIR=<set> + PATH=(custom, no user) + SHELL=/bin/bash + TERM=xterm + XDG_RUNTIME_DIR=<set> SourcePackage: rust-ntpd UpgradeStatus: No upgrade log present (probably fresh install) mtime.conffile..etc.ntpd-rs.ntp.toml: 2026-07-29T16:37:48.696601
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162124 Title: ntpd-rs.service missing CAP_NET_BIND_SERVICE for server mode on UDP/123 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rust-ntpd/+bug/2162124/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
