d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1a14a0bfb7
freebsd-dev/etc
History
Ian Lepore 3496c981ac Make it possible to run ntpd as a non-root user, add ntpd uid and gid. 
Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting system time, and
(re-)binding to privileged UDP port 123. These changes add a new mac(4)
policy module, mac_ntpd(4), which grants just those privileges to any
process running with uid 123.

This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes
them the owner of the /var/db/ntp directory, so that it can be used as a
location where the non-privileged daemon can write files such as the
driftfile, and any optional logfile or stats files.

Because there are so many ways to configure ntpd, the question of how to
configure it to run without root privs can be a bit complex, so that will be
addressed in a separate commit. These changes are just what's required to
grant the limited subset of privs to ntpd, and the small change to ntpd to
prevent it from exiting with an error if running as non-root.

Differential Revision:	https://reviews.freebsd.org/D16281
2018-07-19 23:55:29 +00:00
..
autofs etc: clean up trailing whitespace in autofs 2018-02-15 11:41:38 +00:00
bluetooth
cron.d Conditionally handle the crontab entry for atrun(8) 2017-05-18 06:33:55 +00:00
defaults geli attach multiple providers 2018-06-26 18:07:16 +00:00
devd Fix quoting in sending the NOMATCH event to devmatch 2018-06-28 15:00:18 +00:00
etc.aarch64 For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.amd64 For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.arm For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.i386 For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.mips Enable all callin ttys if the tty is an available console. 2015-10-20 16:10:46 +00:00
etc.powerpc For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.riscv For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
etc.sparc64 For video consoles, only launch a getty if the device exists. 2018-05-09 20:49:00 +00:00
gss
mail Replace send-mail with the more standarized sendmail, we do not create 2017-12-27 06:23:50 +00:00
mtree Make it possible to run ntpd as a non-root user, add ntpd uid and gid. 2018-07-19 23:55:29 +00:00
newsyslog.conf.d Handle the logfiles in newsyslog and syslogd conditionally, based on 2017-05-13 03:10:50 +00:00
ntp Replace the leap-seconds file in r320242 from USNO - 2017-06-23 01:05:49 +00:00
pam.d various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
periodic filter all passwords (not only changed) from periodic passwd backup 2017-11-21 20:31:54 +00:00
pkg Give hint on how to disable the default repository. 2014-03-30 15:24:17 +00:00
rc.d When being verbose about various leapfile versions, also mention expiration. 2018-06-28 22:13:32 +00:00
root Fix typo introduced in r320672 - check for existence of the right file. 2017-07-05 15:42:33 +00:00
sendmail Only create /var/log/sendmail.st if start sendmail. 2018-06-06 01:51:05 +00:00
syslog.d Handle the logfiles in newsyslog and syslogd conditionally, based on 2017-05-13 03:10:50 +00:00
amd.map
apmd.conf
auto_master Stop appending "noatime" in the autofs -media map, and instead add it 2016-09-20 04:52:01 +00:00
blacklistd.conf Add basic blacklist build support 2016-06-02 19:06:04 +00:00
crontab Set the $PATH in /etc/crontab like it is set by the cron(8) 2018-06-10 02:13:30 +00:00
csh.cshrc
csh.login
csh.logout
ddb.conf
devd.conf User service foo rather than /etc/rc.d/foo. 2018-06-11 22:48:34 +00:00
devfs.conf
dhclient.conf
disktab
fbtab
freebsd-update.conf
ftpusers
gettytab Add 3wire and std as terminal types/classes. These are similar to 2014-03-09 20:51:14 +00:00
group Make it possible to run ntpd as a non-root user, add ntpd uid and gid. 2018-07-19 23:55:29 +00:00
hosts
hosts.allow Allow info to display correctly in for varying tabstop settings 2014-12-24 01:50:44 +00:00
hosts.equiv
hosts.lpd
inetd.conf Remove rcmds. 2017-10-06 08:43:14 +00:00
libalias.conf
libmap.conf
login.access
login.conf Fix handling of umtxp resource limit in sh(1)/ulimit(1), limits(1), add 2016-03-12 14:54:34 +00:00
mac.conf
Makefile WITHOUT_SERVICESDB: 2018-07-04 17:18:35 +00:00
Makefile.depend META MODE: Update dependencies with 'the-lot' and add missing directories. 2015-12-01 05:23:19 +00:00
master.passwd Make it possible to run ntpd as a non-root user, add ntpd uid and gid. 2018-07-19 23:55:29 +00:00
minfree
motd Add the less-ambiguous freebsd-version command. 2014-11-02 19:25:31 +00:00
netconfig
netstart Remove NATM configuration bits and assorted NATM and ATM remnants. 2017-04-25 21:59:34 +00:00
network.subr Reduce code duplication for wlan(4) interface creation in network.subr. 2017-11-19 20:18:21 +00:00
networks
newsyslog.conf [etc] Update newsyslog.conf default comment 2018-05-03 00:57:19 +00:00
nls.alias
nscd.conf
nsmb.conf Remove IPX support. 2014-03-14 02:58:48 +00:00
nsswitch.conf Implement an NSS backend for netgroups and add getnetgrent_r(3). 2016-06-09 01:28:44 +00:00
ntp.conf Fix a comment; the ntp leaplist file is updated periodically, but not weekly 2018-06-24 03:31:23 +00:00
opieaccess
pccard_ether Do not try to recreate wlan(4) interface if it already exists. 2016-12-04 15:58:34 +00:00
pf.os pf.os: Add OpenBSD:6.1 2017-12-02 06:23:02 +00:00
phones
portsnap.conf userland: Fix several typos and minor errors 2017-12-27 03:23:01 +00:00
printcap Update several more URLs 2017-10-29 08:17:03 +00:00
profile
protocols etc: minor spelling fixes. 2016-05-01 16:43:22 +00:00
rc Fix firstboot fs mount logic 2018-02-06 20:12:05 +00:00
rc.bsdextended
rc.firewall The firewall_type is ignored if not set in rc.conf or rc.conf.local, 2018-02-22 08:25:39 +00:00
rc.initdiskless userland: Fix several typos and minor errors 2017-12-27 03:23:01 +00:00
rc.resume
rc.sendmail
rc.shutdown Since r275359, there is no need to provide a bogus service name. 2015-10-26 15:16:27 +00:00
rc.subr rc.subr: Support loading environmental variables from a file 2018-05-25 19:36:26 +00:00
rc.suspend
regdomain.xml Correct Russia spelling in regdomain.xml 2018-02-05 18:45:21 +00:00
remote
rpc
services Add VXLAN (RFC 7348) port 2017-12-31 17:11:12 +00:00
shells
snmpd.config Move the mibII module up so uncommenting the bridge module works 2017-01-07 09:03:40 +00:00
sysctl.conf
syslog.conf Handle the logfiles in newsyslog and syslogd conditionally, based on 2017-05-13 03:10:50 +00:00
termcap.small