freebsd-skq/etc/mtree
Ian Lepore 3496c981ac Make it possible to run ntpd as a non-root user, add ntpd uid and gid.
Code analysis and runtime analysis using truss(8) indicate that the only
privileged operations performed by ntpd are adjusting system time, and
(re-)binding to privileged UDP port 123. These changes add a new mac(4)
policy module, mac_ntpd(4), which grants just those privileges to any
process running with uid 123.

This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes
them the owner of the /var/db/ntp directory, so that it can be used as a
location where the non-privileged daemon can write files such as the
driftfile, and any optional logfile or stats files.

Because there are so many ways to configure ntpd, the question of how to
configure it to run without root privs can be a bit complex, so that will be
addressed in a separate commit. These changes are just what's required to
grant the limited subset of privs to ntpd, and the small change to ntpd to
prevent it from exiting with an error if running as non-root.

Differential Revision:	https://reviews.freebsd.org/D16281
2018-07-19 23:55:29 +00:00
..
BSD.debug.dist More follow-up to r335799 (llvm/clang 6.0.1 update), where I forgot to 2018-06-30 15:03:22 +00:00
BSD.include.dist Complete removal of lmc(4) 2018-05-28 17:08:37 +00:00
BSD.lib32.dist Normalize the g(eom,cache,part,...) build. 2018-06-25 19:55:15 +00:00
BSD.libsoft.dist Add libsoft to the tree, just like lib32. 2016-01-03 04:32:05 +00:00
BSD.release.dist
BSD.root.dist Move /boot/overlays to /boot/dtb/overlays 2018-03-19 16:16:12 +00:00
BSD.sendmail.dist
BSD.tests.dist praudit(1): add tests 2018-06-17 17:31:16 +00:00
BSD.usr.dist Create an aarch64 subdir under man4, now that we have aarch64 manpages. 2018-07-08 01:29:48 +00:00
BSD.var.dist Make it possible to run ntpd as a non-root user, add ntpd uid and gid. 2018-07-19 23:55:29 +00:00
Makefile Unconditionally install etc/mtree/BSD.debug.dist again 2017-07-25 00:28:23 +00:00
README

$FreeBSD$

Note: If you modify these files, please keep hier(7) updated!

These files are used to create empty file hierarchies for building the
system into.  Some notes about working with them are placed here to try
and keep them in good working order.

    a)  The files use 4 space indentation, and other than in the header
        comments, should not contain any tabs.  An indentation of 4 is
        preferable to the standard indentation of 8 because the indentation
        of levels in these files can become quite deep causing the line to
        overflow 80 characters.

        This also matches with the files generated when using the
        mtree -c option, which was implemented that way for the same reason.

    b)  Only directories should be listed here.

    c)  The listing should be kept in filename sorted order.

    d)  Sanity checking changes to these files can be done by following
        this procedure (the sed -e is ugly, but fixing mtree -c to
        not emit the trailing white space would be even uglier):

            mkdir /tmp/MTREE
            mtree -deU -f BSD.X.dist -p /tmp/MTREE
            mtree -cdin -k uname,gname,mode -p /tmp/MTREE | \
		sed -e 's/ *$//' >BSD.X.new
            diff -u BSD.X.dist BSD.X.new
            rm -r /tmp/MTREE

        Note that you will get some differences about /set lines,
        and uname= gname= on certain directory areas, mainly man page
        sections.  This is caused by mtree not having a look ahead
        mechanism for making better selections for these as it
        traverses the hierarchy.

        The BSD.X.new file should NOT be committed, as it will be missing
        the correct header, and important keywords like ``nochange''.
        Simply use the diff for a sanity check to make sure things are in
        the correct order and correctly indented.

    e)  Further sanity checking of the system builds with DESTDIR=/someplace
        are more complicated, but can often catch missing entries in these
        files.  I tend to run this more complete sanity check shortly after
        the target date for a new release is announced.

        If you want details on it bug me about it via email to
        rgrimes@FreeBSD.org.