mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
* [ptxdist] [PATCH] chrony: fix runtime with busybox init
@ 2021-06-19 15:26 Bruno Thomsen
  2021-06-29  5:09 ` [ptxdist] [APPLIED] " Michael Olbrich
  0 siblings, 1 reply; 2+ messages in thread
From: Bruno Thomsen @ 2021-06-19 15:26 UTC (permalink / raw)
  To: ptxdist; +Cc: bruno.thomsen, bth, m.ciocan

Run as root if busybox init is used (INITMETHOD_BBINIT) so
runtime directory is read and writable. When running under
systemd (INITMETHOD_SYSTEMD) use chrony user.

A busybox init system typically ends up with a turtle shell
security architecture where systemd is used when defense in
depth is needed.

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
---
 rules/chrony.make | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/chrony.make b/rules/chrony.make
index 4435b8e97..cbdf9314b 100644
--- a/rules/chrony.make
+++ b/rules/chrony.make
@@ -54,7 +54,7 @@ CHRONY_CONF_OPT		:= \
 	--disable-phc \
 	$(call ptx/ifdef, PTXCONF_CHRONY_PPS_REFCLK,,--disable-pps) \
 	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
-	--with-user=chrony \
+	--with-user=$(call ptx/ifdef, PTXCONF_INITMETHOD_SYSTEMD,chrony,root) \
 	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
 	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
 

base-commit: e1f0f2abd3116fdcb5e3e3211321aef801e959ff
-- 
2.31.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [ptxdist] [APPLIED] chrony: fix runtime with busybox init
  2021-06-19 15:26 [ptxdist] [PATCH] chrony: fix runtime with busybox init Bruno Thomsen
@ 2021-06-29  5:09 ` Michael Olbrich
  0 siblings, 0 replies; 2+ messages in thread
From: Michael Olbrich @ 2021-06-29  5:09 UTC (permalink / raw)
  To: ptxdist; +Cc: Bruno Thomsen

Thanks, applied as e109b0935b4676f027714dbe59317185a9d602cd.

Michael

[sent from post-receive hook]

On Tue, 29 Jun 2021 07:09:22 +0200, Bruno Thomsen <bruno.thomsen@gmail.com> wrote:
> Run as root if busybox init is used (INITMETHOD_BBINIT) so
> runtime directory is read and writable. When running under
> systemd (INITMETHOD_SYSTEMD) use chrony user.
> 
> A busybox init system typically ends up with a turtle shell
> security architecture where systemd is used when defense in
> depth is needed.
> 
> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> Message-Id: <20210619152607.858107-1-bruno.thomsen@gmail.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/chrony.make b/rules/chrony.make
> index 4435b8e97796..cbdf9314b52b 100644
> --- a/rules/chrony.make
> +++ b/rules/chrony.make
> @@ -54,7 +54,7 @@ CHRONY_CONF_OPT		:= \
>  	--disable-phc \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_PPS_REFCLK,,--disable-pps) \
>  	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
> -	--with-user=chrony \
> +	--with-user=$(call ptx/ifdef, PTXCONF_INITMETHOD_SYSTEMD,chrony,root) \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
>  

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-06-29  5:11 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-19 15:26 [ptxdist] [PATCH] chrony: fix runtime with busybox init Bruno Thomsen
2021-06-29  5:09 ` [ptxdist] [APPLIED] " Michael Olbrich

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox