From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail-wr1-x42a.google.com ([2a00:1450:4864:20::42a]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1k0rm4-0007MC-EX for ptxdist@pengutronix.de; Wed, 29 Jul 2020 21:30:00 +0200 Received: by mail-wr1-x42a.google.com with SMTP id l2so12143226wrc.7 for ; Wed, 29 Jul 2020 12:30:00 -0700 (PDT) From: Bruno Thomsen Date: Wed, 29 Jul 2020 21:29:27 +0200 Message-Id: <20200729192928.5765-5-bruno.thomsen@gmail.com> In-Reply-To: <20200729192928.5765-1-bruno.thomsen@gmail.com> References: <20200729192928.5765-1-bruno.thomsen@gmail.com> MIME-Version: 1.0 Subject: [ptxdist] [PATCH v2 5/6] chrony: run as chrony user option List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Cc: Bruno Thomsen , bth@kamstrup.com Default chrony service run as root and that is not best practice as it's doing network communication. Signed-off-by: Bruno Thomsen --- No changes since version 1. rules/chrony.in | 7 +++++++ rules/chrony.make | 1 + 2 files changed, 8 insertions(+) diff --git a/rules/chrony.in b/rules/chrony.in index 16b730199..6e79270e5 100644 --- a/rules/chrony.in +++ b/rules/chrony.in @@ -29,6 +29,13 @@ config CHRONY_USE_NETTLE Use nettle crypto library for stronger keys than MD5 in NTP authentication. +config CHRONY_RUN_AS_NON_ROOT + bool + prompt "Run chronyd as non root user" + help + Default chronyd is started as root, select this + to run service with chrony user. + comment "install options ---" config CHRONY_INSTALL_CHRONY_COMMAND diff --git a/rules/chrony.make b/rules/chrony.make index a11ee5c5e..b28eeb196 100644 --- a/rules/chrony.make +++ b/rules/chrony.make @@ -49,6 +49,7 @@ CHRONY_CONF_OPT := \ --disable-phc \ --disable-pps \ $(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \ + $(call ptx/ifdef, PTXCONF_CHRONY_RUN_AS_USER,--with-user=chrony,) \ --without-seccomp # ---------------------------------------------------------------------------- -- 2.26.2 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de