Re: [ptxdist] [PATCH 5/6] chrony: run as chrony user option

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Fri, Jul 24, 2020 at 05:48:42PM +0200, Bruno Thomsen wrote:
> Default chrony service run as root and that is not
> best practice as it's doing network communication.

Is there a use-case to run chrony as root? I think we can skip the option
and always run it as user chrony.

Michael

> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> ---
>  rules/chrony.in   | 7 +++++++
>  rules/chrony.make | 1 +
>  2 files changed, 8 insertions(+)
> 
> diff --git a/rules/chrony.in b/rules/chrony.in
> index 525be2681..6a4f12de0 100644
> --- a/rules/chrony.in
> +++ b/rules/chrony.in
> @@ -29,6 +29,13 @@ config CHRONY_USE_NETTLE
>  	  Use nettle crypto library for stronger keys than MD5 in
>  	  NTP authentication.
>  
> +config CHRONY_RUN_AS_NON_ROOT
> +	bool
> +	prompt "Run chronyd as non root user"
> +	help
> +	  Default chronyd is started as root, select this
> +	  to run service with chrony user.
> +
>  comment "install options   ---"
>  
>  config CHRONY_INSTALL_CHRONY_COMMAND
> diff --git a/rules/chrony.make b/rules/chrony.make
> index a72752030..d5ae52883 100644
> --- a/rules/chrony.make
> +++ b/rules/chrony.make
> @@ -48,6 +48,7 @@ CHRONY_CONF_OPT		:= \
>  	--disable-phc \
>  	--disable-pps \
>  	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
> +	$(call ptx/ifdef, PTXCONF_CHRONY_RUN_AS_USER,--with-user=chrony,) \
>  	--without-seccomp
>  
>  # ----------------------------------------------------------------------------
> -- 
> 2.26.2
> 
> 
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de