diff -Naru a/configure.ac b/configure.ac
--- a/configure.ac 2005-03-16 12:27:21 -08:00
+++ b/configure.ac 2005-03-16 12:27:21 -08:00
@@ -48,7 +48,7 @@
AC_CACHE_CHECK(if we should use /dev/clockctl, ac_clockctl,
[AC_ARG_ENABLE(clockctl,
- AC_HELP_STRING([--enable-clockctl], [Use /dev/clockctl for non-root time control]),
+ AC_HELP_STRING([--enable-clockctl], [Use /dev/clockctl for non-root clock control]),
[ans=$enableval],
[case "$host" in
*-*-netbsd*)
@@ -63,9 +63,27 @@
AC_CHECK_HEADERS(sys/clockctl.h)
case "$ac_clockctl$ac_cv_header_sys_clockctl_h" in
yesyes)
- AC_DEFINE(HAVE_CLOCKCTL, ,[[Use /dev/clockctl?]])
+ AC_DEFINE(HAVE_DROPROOT, ,[Can we drop root privileges?])
;;
esac
+
+AC_CACHE_CHECK(if we have linux capabilities (libcap), ac_linuxcaps,
+[AC_ARG_ENABLE(linuxcaps,
+ AC_HELP_STRING([--enable-linuxcaps], [Use Linux capabilities for non-root clock control]),
+ [ans=$enableval],
+ [ans=no])
+ac_linuxcaps=$ans])
+# End of AC_CACHE_CHECK for linuxcaps
+AC_CHECK_HEADERS(sys/capability.h)
+AC_CHECK_HEADERS(sys/prctl.h)
+case "$ac_linuxcaps$ac_cv_header_sys_capability_h$ac_cv_header_sys_prctl_h" in
+ yesyesyes)
+ AC_DEFINE(HAVE_LINUX_CAPABILITIES, ,[Do we have Linux capabilities?])
+ AC_DEFINE(HAVE_DROPROOT, ,[Can we drop root privileges?])
+ LIBS="$LIBS -lcap"
+ ;;
+esac
+
case "$build" in
$host)
diff -Naru a/html/ntpd.html b/html/ntpd.html
--- a/html/ntpd.html 2005-03-16 12:27:21 -08:00
+++ b/html/ntpd.html 2005-03-16 12:27:21 -08:00
@@ -33,7 +33,7 @@
</ul>
<hr>
<h4 id="synop">Synopsis</h4>
- <tt>ntpd [ -46aAbdDgLmnNPqx ] [ -c <i>conffile</i> ] [ -f <i>driftfile</i> ] [ -k <i>keyfile</i> ] [ -l <i>logfile</i> ] [ -p <i>pidfile</i> ] [ -r <i>broadcastdelay</i> ] [ -s <i>statsdir</i> ] [ -t <i>key</i> ] [ -v <i>variable</i> ] [ -V <i>variable</i> ]</tt>
+ <tt>ntpd [ -46aAbdDgLmnNPqx ] [ -c <i>conffile</i> ] [ -f <i>driftfile</i> ] [ -i <i>jaildir</i> ] [ -k <i>keyfile</i> ] [ -l <i>logfile</i> ] [ -p <i>pidfile</i> ] [ -r <i>broadcastdelay</i> ] [ -s <i>statsdir</i> ] [ -t <i>key</i> ] [ -u <i>user</i>[:<i>group</i>] ] [ -v <i>variable</i> ] [ -V <i>variable</i> ]</tt>
<h4 id="descr">Description</h4>
<p>The <tt>ntpd</tt> program is an operating system daemon which sets and maintains the system time of day in synchronism with Internet standard time servers. It is a complete implementation of the Network Time Protocol (NTP) version 4, but also retains compatibility with version 3, as defined by RFC-1305, and version 1 and 2, as defined by RFC-1059 and RFC-1119, respectively. <tt>ntpd</tt> does most computations in 64-bit floating point arithmetic and does relatively clumsy 64-bit fixed point operations only when necessary to preserve the ultimate precision, about 232 picoseconds. While the ultimate precision is not achievable with ordinary workstations and networks of today, it may be required with future gigahertz CPU clocks and gigabit LANs.</p>
<h4 id="op">How NTP Operates</h4>
@@ -84,6 +84,8 @@
<dd>Specify the name and path of the frequency file, default <tt>/etc/ntp.drift</tt>. This is the same operation as the <tt>driftfile <i>driftfile</i></tt> configuration command.
<dt><tt>-g</tt>
<dd>Normally, <tt>ntpd</tt> exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, <tt>ntpd</tt> will exit with a message to the system log. This option can be used with the <tt>-q</tt> and <tt>-x</tt> options. See the <tt>tinker</tt> command for other options.
+ <dt><tt>-i <i>jaildir</i></tt>
+ <dd>Chroot the server to the directory <i>jaildir</i>. This option also implies that the server attempts to drop root privileges at startup (otherwise, chroot gives very little additional security), and it is only available if the OS supports to run the server without full root privileges. You may need to also specify a <tt>-u</tt> option.
<dt><tt>-k <i>keyfile</i></tt>
<dd>Specify the name and path of the symmetric key file, default <tt>/etc/ntp.keys</tt>. This is the same operation as the <tt>keys <i>keyfile</i></tt> configuration command.
<dt><tt>-l <i>logfile</i></tt>
@@ -108,6 +110,8 @@
<dd>Specify the directory path for files created by the statistics facility. This is the same operation as the <tt>statsdir <i>statsdir</i></tt> configuration command.
<dt><tt>-t <i>key</i></tt>
<dd>Add a key number to the trusted key list. This option can occur more than once.
+ <dt><tt>-u <i>user[:group]</i> </tt>
+ <dd>Specify a user, and optionally a group, to switch to. This option is only available if the OS supports to run the server without full root privileges. Currently, this option is supported under NetBSD (configure with --enable-clockctl) and Linux (configure with --enable-linuxcaps).
<dt><tt>-v <i>variable</i></tt>
<dt><tt>-V <i>variable</i></tt>
<dd>Add a system variable listed by default.
diff -Naru a/include/ntpd.h b/include/ntpd.h
--- a/include/ntpd.h 2005-03-16 12:27:21 -08:00
+++ b/include/ntpd.h 2005-03-16 12:27:21 -08:00
@@ -420,7 +420,8 @@
extern volatile int debug; /* debugging flag */
extern int nofork; /* no-fork flag */
extern int initializing; /* initializing flag */
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
+extern int droproot; /* flag: try to drop root privileges after startup */
extern char *user; /* user to switch to */
extern char *group; /* group to switch to */
extern char *chrootdir; /* directory to chroot to */
diff -Naru a/ntpd/cmd_args.c b/ntpd/cmd_args.c
--- a/ntpd/cmd_args.c 2005-03-16 12:27:21 -08:00
+++ b/ntpd/cmd_args.c 2005-03-16 12:27:21 -08:00
@@ -161,7 +161,7 @@
#if defined(HAVE_SCHED_SETSCHEDULER)
(void) fprintf(stderr, "\t\t[ -P fixed_process_priority ]\n");
#endif
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
(void) fprintf(stderr, "\t\t[ -u user[:group] ] [ -i chrootdir ]\n");
#endif
exit(2);
@@ -254,7 +254,8 @@
break;
case 'i':
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
+ droproot = 1;
if (!ntp_optarg)
errflg++;
else
@@ -317,14 +318,21 @@
break;
case 'u':
-#ifdef HAVE_CLOCKCTL
- user = malloc(strlen(ntp_optarg) + 1);
- if ((user == NULL) || (ntp_optarg == NULL))
+#ifdef HAVE_DROPROOT
+ droproot = 1;
+ if( ! ntp_optarg ) {
errflg++;
- (void)strncpy(user, ntp_optarg, strlen(ntp_optarg) + 1);
- group = rindex(user, ':');
- if (group)
- *group++ = '\0'; /* get rid of the ':' */
+ } else {
+ user = malloc(strlen(ntp_optarg) + 1);
+ if (user == NULL) {
+ errflg++;
+ } else {
+ (void)strncpy(user, ntp_optarg, strlen(ntp_optarg) + 1);
+ group = rindex(user, ':');
+ if (group)
+ *group++ = '\0'; /* get rid of the ':' */
+ }
+ }
#else
errflg++;
#endif
@@ -409,7 +417,7 @@
#if defined(HAVE_SCHED_SETSCHEDULER)
(void) fprintf(stderr, "\t\t[ -P fixed_process_priority ]\n");
#endif
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
(void) fprintf(stderr, "\t\t[ -u user[:group] ] [ -i chrootdir ]\n");
#endif
exit(2);
diff -Naru a/ntpd/ntpd.c b/ntpd/ntpd.c
--- a/ntpd/ntpd.c 2005-03-16 12:27:21 -08:00
+++ b/ntpd/ntpd.c 2005-03-16 12:27:21 -08:00
@@ -104,10 +104,14 @@
# include <sys/ci/ciioctl.h>
#endif
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
# include <ctype.h>
# include <grp.h>
# include <pwd.h>
+#ifdef HAVE_LINUX_CAPABILITIES
+# include <sys/capability.h>
+# include <sys/prctl.h>
+#endif
#endif
/*
@@ -164,7 +168,8 @@
*/
int nofork;
-#ifdef HAVE_CLOCKCTL
+#ifdef HAVE_DROPROOT
+int droproot = 0;
char *user = NULL; /* User to switch to */
char *group = NULL; /* group to switch to */
char *chrootdir = NULL; /* directory to chroot to */
@@ -173,7 +178,7 @@
char *endp;
struct group *gr;
struct passwd *pw;
-#endif /* HAVE_CLOCKCTL */
+#endif /* HAVE_DROPROOT */
/*
* Initializing flag. All async routines watch this and only do their
@@ -834,64 +839,106 @@
# endif
#endif
-#ifdef HAVE_CLOCKCTL
- /*
- * Drop super-user privileges and chroot now if the OS supports
- * non root clock control (only NetBSD for now).
- */
- if (user != NULL) {
- if (isdigit((unsigned char)*user)) {
- sw_uid = (uid_t)strtoul(user, &endp, 0);
- if (*endp != '\0')
- goto getuser;
- } else {
+#ifdef HAVE_DROPROOT
+ if( droproot ) {
+ /* Drop super-user privileges and chroot now if the OS supports this */
+
+#ifdef HAVE_LINUX_CAPABILITIES
+ /* set flag: keep privileges accross setuid() call (we only really need cap_sys_time): */
+ if( prctl( PR_SET_KEEPCAPS, 1L, 0L, 0L, 0L ) == -1 ) {
+ msyslog( LOG_ERR, "prctl( PR_SET_KEEPCAPS, 1L ) failed: %m" );
+ exit(-1);
+ }
+#else
+ /* we need a user to switch to */
+ if( user == NULL ) {
+ msyslog(LOG_ERR, "Need user name to drop root privileges (see -u flag!)" );
+ exit(-1);
+ }
+#endif /* HAVE_LINUX_CAPABILITIES */
+
+ if (user != NULL) {
+ if (isdigit((unsigned char)*user)) {
+ sw_uid = (uid_t)strtoul(user, &endp, 0);
+ if (*endp != '\0')
+ goto getuser;
+ } else {
getuser:
- if ((pw = getpwnam(user)) != NULL) {
- sw_uid = pw->pw_uid;
- } else {
- errno = 0;
- msyslog(LOG_ERR, "Cannot find user `%s'", user);
- exit (-1);
- }
- }
- }
- if (group != NULL) {
- if (isdigit((unsigned char)*group)) {
- sw_gid = (gid_t)strtoul(group, &endp, 0);
- if (*endp != '\0')
- goto getgroup;
- } else {
+ if ((pw = getpwnam(user)) != NULL) {
+ sw_uid = pw->pw_uid;
+ } else {
+ errno = 0;
+ msyslog(LOG_ERR, "Cannot find user `%s'", user);
+ exit (-1);
+ }
+ }
+ }
+ if (group != NULL) {
+ if (isdigit((unsigned char)*group)) {
+ sw_gid = (gid_t)strtoul(group, &endp, 0);
+ if (*endp != '\0')
+ goto getgroup;
+ } else {
getgroup:
- if ((gr = getgrnam(group)) != NULL) {
- sw_gid = pw->pw_gid;
- } else {
- errno = 0;
- msyslog(LOG_ERR, "Cannot find group `%s'", group);
- exit (-1);
- }
- }
- }
- if (chrootdir && chroot(chrootdir)) {
- msyslog(LOG_ERR, "Cannot chroot to `%s': %m", chrootdir);
- exit (-1);
- }
- if (group && setgid(sw_gid)) {
- msyslog(LOG_ERR, "Cannot setgid() to group `%s': %m", group);
- exit (-1);
- }
- if (group && setegid(sw_gid)) {
- msyslog(LOG_ERR, "Cannot setegid() to group `%s': %m", group);
- exit (-1);
- }
- if (user && setuid(sw_uid)) {
- msyslog(LOG_ERR, "Cannot setuid() to user `%s': %m", user);
- exit (-1);
- }
- if (user && seteuid(sw_uid)) {
- msyslog(LOG_ERR, "Cannot seteuid() to user `%s': %m", user);
- exit (-1);
- }
-#endif
+ if ((gr = getgrnam(group)) != NULL) {
+ sw_gid = pw->pw_gid;
+ } else {
+ errno = 0;
+ msyslog(LOG_ERR, "Cannot find group `%s'", group);
+ exit (-1);
+ }
+ }
+ }
+
+ if( chrootdir ) {
+ /* make sure cwd is inside the jail: */
+ if( chdir(chrootdir) ) {
+ msyslog(LOG_ERR, "Cannot chdir() to `%s': %m", chrootdir);
+ exit (-1);
+ }
+ if( chroot(chrootdir) ) {
+ msyslog(LOG_ERR, "Cannot chroot() to `%s': %m", chrootdir);
+ exit (-1);
+ }
+ }
+ if (group && setgid(sw_gid)) {
+ msyslog(LOG_ERR, "Cannot setgid() to group `%s': %m", group);
+ exit (-1);
+ }
+ if (group && setegid(sw_gid)) {
+ msyslog(LOG_ERR, "Cannot setegid() to group `%s': %m", group);
+ exit (-1);
+ }
+ if (user && setuid(sw_uid)) {
+ msyslog(LOG_ERR, "Cannot setuid() to user `%s': %m", user);
+ exit (-1);
+ }
+ if (user && seteuid(sw_uid)) {
+ msyslog(LOG_ERR, "Cannot seteuid() to user `%s': %m", user);
+ exit (-1);
+ }
+
+#ifdef HAVE_LINUX_CAPABILITIES
+ do {
+ /* We may be running under non-root uid now, but we still hold full root privileges!
+ * We drop all of them, except for the crucial one: cap_sys_time:
+ */
+ cap_t caps;
+ if( ! ( caps = cap_from_text( "cap_sys_time=ipe" ) ) ) {
+ msyslog( LOG_ERR, "cap_from_text() failed: %m" );
+ exit(-1);
+ }
+ if( cap_set_proc( caps ) == -1 ) {
+ msyslog( LOG_ERR, "cap_set_proc() failed to drop root privileges: %m" );
+ exit(-1);
+ }
+ cap_free( caps );
+ } while(0);
+#endif /* HAVE_LINUX_CAPABILITIES */
+
+ } /* if( droproot ) */
+#endif /* HAVE_DROPROOT */
+
/*
* Report that we're up to any trappers
*/
# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
# 2003/12/19 15:44:14-05:00 stenn@whimsy.udel.edu
# [Bug 251] Timo Felbinger: Drop root under Linux
#
# configure.in
# 2003/12/19 15:43:27-05:00 stenn@whimsy.udel.edu +20 -2
# [Bug 251] Timo Felbinger: Drop root under Linux
#
# html/ntpd.html
# 2003/12/19 15:43:27-05:00 stenn@whimsy.udel.edu +5 -1
# [Bug 251] Timo Felbinger: Drop root under Linux
#
# include/ntpd.h
# 2003/12/19 15:43:27-05:00 stenn@whimsy.udel.edu +2 -1
# [Bug 251] Timo Felbinger: Drop root under Linux
#
# ntpd/cmd_args.c
# 2003/12/19 15:43:28-05:00 stenn@whimsy.udel.edu +18 -10
# [Bug 251] Timo Felbinger: Drop root under Linux
#
# ntpd/ntpd.c
# 2003/12/19 15:43:28-05:00 stenn@whimsy.udel.edu +106 -59
# [Bug 251] Timo Felbinger: Drop root under Linux
#
