[ptxdist] [PATCH] chrony: add seccomp sandbox option

[ptxdist] [PATCH] chrony: add seccomp sandbox option

[Bruno Thomsen]

This adds a little extra security by using seccomp.

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
---
Note: this patch requires my chrony patch series
version 3 before apply.

 rules/chrony.in   | 8 ++++++++
 rules/chrony.make | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/rules/chrony.in b/rules/chrony.in
index 2f906d2ce..f50b86442 100644
--- a/rules/chrony.in
+++ b/rules/chrony.in
@@ -6,6 +6,7 @@ menuconfig CHRONY
 	prompt "chrony                        "
 	select LIBC_M
 	select LIBCAP
+	select LIBSECCOMP	if CHRONY_SECCOMP
 	select NETTLE		if CHRONY_USE_NETTLE
 	help
 	  This will install the Chrony NTPD Daemon (chronyd)
@@ -29,6 +30,13 @@ config CHRONY_USE_NETTLE
 	  Use nettle crypto library for stronger keys than MD5 in
 	  NTP authentication.
 
+config CHRONY_SECCOMP
+	bool
+	default y
+	prompt "Enable seccomp sandboxing"
+	help
+	  Enables seccomp sandboxing to reduce the attack surface.
+
 config CHRONY_ADVANCED_COMMAND
 	bool
 	prompt "Enable advanced monitoring command"
diff --git a/rules/chrony.make b/rules/chrony.make
index 4d6f58f3b..f5e40dfb8 100644
--- a/rules/chrony.make
+++ b/rules/chrony.make
@@ -55,7 +55,8 @@ CHRONY_CONF_OPT		:= \
 	--disable-pps \
 	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
 	--with-user=chrony \
-	--without-seccomp
+	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
+	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
 
 # ----------------------------------------------------------------------------
 # Install
-- 
2.26.2


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

Re: [ptxdist] [APPLIED] chrony: add seccomp sandbox option

[Michael Olbrich]

Thanks, applied as 96db4ea70594b4213770929907262de503c32725.

Michael

[sent from post-receive hook]

On Mon, 03 Aug 2020 08:30:22 +0200, Bruno Thomsen <bruno.thomsen@gmail.com> wrote:
> This adds a little extra security by using seccomp.
> 
> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> Message-Id: <20200731161420.6568-1-bruno.thomsen@gmail.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/chrony.in b/rules/chrony.in
> index 2f906d2cec4a..f50b864429b0 100644
> --- a/rules/chrony.in
> +++ b/rules/chrony.in
> @@ -6,6 +6,7 @@ menuconfig CHRONY
>  	prompt "chrony                        "
>  	select LIBC_M
>  	select LIBCAP
> +	select LIBSECCOMP	if CHRONY_SECCOMP
>  	select NETTLE		if CHRONY_USE_NETTLE
>  	help
>  	  This will install the Chrony NTPD Daemon (chronyd)
> @@ -29,6 +30,13 @@ config CHRONY_USE_NETTLE
>  	  Use nettle crypto library for stronger keys than MD5 in
>  	  NTP authentication.
>  
> +config CHRONY_SECCOMP
> +	bool
> +	default y
> +	prompt "Enable seccomp sandboxing"
> +	help
> +	  Enables seccomp sandboxing to reduce the attack surface.
> +
>  config CHRONY_ADVANCED_COMMAND
>  	bool
>  	prompt "Enable advanced monitoring command"
> diff --git a/rules/chrony.make b/rules/chrony.make
> index 4d6f58f3ba1e..f5e40dfb8d12 100644
> --- a/rules/chrony.make
> +++ b/rules/chrony.make
> @@ -55,7 +55,8 @@ CHRONY_CONF_OPT		:= \
>  	--disable-pps \
>  	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
>  	--with-user=chrony \
> -	--without-seccomp
> +	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
> +	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
>  
>  # ----------------------------------------------------------------------------
>  # Install

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de