From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail-wm1-x344.google.com ([2a00:1450:4864:20::344]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1k1XgE-0006g5-Jm for ptxdist@pengutronix.de; Fri, 31 Jul 2020 18:14:47 +0200 Received: by mail-wm1-x344.google.com with SMTP id t14so4541565wmi.3 for ; Fri, 31 Jul 2020 09:14:46 -0700 (PDT) From: Bruno Thomsen Date: Fri, 31 Jul 2020 18:14:20 +0200 Message-Id: <20200731161420.6568-1-bruno.thomsen@gmail.com> MIME-Version: 1.0 Subject: [ptxdist] [PATCH] chrony: add seccomp sandbox option List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Cc: Bruno Thomsen , bth@kamstrup.com This adds a little extra security by using seccomp. Signed-off-by: Bruno Thomsen --- Note: this patch requires my chrony patch series version 3 before apply. rules/chrony.in | 8 ++++++++ rules/chrony.make | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/rules/chrony.in b/rules/chrony.in index 2f906d2ce..f50b86442 100644 --- a/rules/chrony.in +++ b/rules/chrony.in @@ -6,6 +6,7 @@ menuconfig CHRONY prompt "chrony " select LIBC_M select LIBCAP + select LIBSECCOMP if CHRONY_SECCOMP select NETTLE if CHRONY_USE_NETTLE help This will install the Chrony NTPD Daemon (chronyd) @@ -29,6 +30,13 @@ config CHRONY_USE_NETTLE Use nettle crypto library for stronger keys than MD5 in NTP authentication. +config CHRONY_SECCOMP + bool + default y + prompt "Enable seccomp sandboxing" + help + Enables seccomp sandboxing to reduce the attack surface. + config CHRONY_ADVANCED_COMMAND bool prompt "Enable advanced monitoring command" diff --git a/rules/chrony.make b/rules/chrony.make index 4d6f58f3b..f5e40dfb8 100644 --- a/rules/chrony.make +++ b/rules/chrony.make @@ -55,7 +55,8 @@ CHRONY_CONF_OPT := \ --disable-pps \ $(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \ --with-user=chrony \ - --without-seccomp + $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \ + $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp) # ---------------------------------------------------------------------------- # Install -- 2.26.2 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de