[ptxdist] [PATCH] chrony: fix runtime with busybox init

[ptxdist] [PATCH] chrony: fix runtime with busybox init

[Bruno Thomsen]

Run as root if busybox init is used (INITMETHOD_BBINIT) so
runtime directory is read and writable. When running under
systemd (INITMETHOD_SYSTEMD) use chrony user.

A busybox init system typically ends up with a turtle shell
security architecture where systemd is used when defense in
depth is needed.

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
---
 rules/chrony.make | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/chrony.make b/rules/chrony.make
index 4435b8e97..cbdf9314b 100644
--- a/rules/chrony.make
+++ b/rules/chrony.make
@@ -54,7 +54,7 @@ CHRONY_CONF_OPT		:= \
 	--disable-phc \
 	$(call ptx/ifdef, PTXCONF_CHRONY_PPS_REFCLK,,--disable-pps) \
 	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
-	--with-user=chrony \
+	--with-user=$(call ptx/ifdef, PTXCONF_INITMETHOD_SYSTEMD,chrony,root) \
 	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
 	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
 

base-commit: e1f0f2abd3116fdcb5e3e3211321aef801e959ff
-- 
2.31.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

Re: [ptxdist] [APPLIED] chrony: fix runtime with busybox init

[Michael Olbrich]

Thanks, applied as e109b0935b4676f027714dbe59317185a9d602cd.

Michael

[sent from post-receive hook]

On Tue, 29 Jun 2021 07:09:22 +0200, Bruno Thomsen <bruno.thomsen@gmail.com> wrote:
> Run as root if busybox init is used (INITMETHOD_BBINIT) so
> runtime directory is read and writable. When running under
> systemd (INITMETHOD_SYSTEMD) use chrony user.
> 
> A busybox init system typically ends up with a turtle shell
> security architecture where systemd is used when defense in
> depth is needed.
> 
> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> Message-Id: <20210619152607.858107-1-bruno.thomsen@gmail.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/chrony.make b/rules/chrony.make
> index 4435b8e97796..cbdf9314b52b 100644
> --- a/rules/chrony.make
> +++ b/rules/chrony.make
> @@ -54,7 +54,7 @@ CHRONY_CONF_OPT		:= \
>  	--disable-phc \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_PPS_REFCLK,,--disable-pps) \
>  	$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
> -	--with-user=chrony \
> +	--with-user=$(call ptx/ifdef, PTXCONF_INITMETHOD_SYSTEMD,chrony,root) \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
>  	$(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
>  

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de