diff options
| author | Daniel Golle <daniel@makrotopia.org> | 2020-10-19 21:22:30 +0100 |
|---|---|---|
| committer | Daniel Golle <daniel@makrotopia.org> | 2020-10-25 13:01:35 +0000 |
| commit | 2d34355e16b442fcf51e93786401716dae3c4ea2 (patch) | |
| tree | 1fe6e9c20153a6f76d5baf7a48480c93a0537b06 /package/utils/busybox/files | |
| parent | ccb283c71cce2248eea3afd42624f626cdc3a4f2 (diff) | |
| download | upstream-2d34355e16b442fcf51e93786401716dae3c4ea2.tar.gz upstream-2d34355e16b442fcf51e93786401716dae3c4ea2.tar.bz2 upstream-2d34355e16b442fcf51e93786401716dae3c4ea2.zip | |
busybox: allow ntpd to run as non-root ntpd user
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Diffstat (limited to 'package/utils/busybox/files')
| -rw-r--r-- | package/utils/busybox/files/ntpd.capabilities | 22 | ||||
| -rwxr-xr-x | package/utils/busybox/files/sysntpd | 7 |
2 files changed, 29 insertions, 0 deletions
diff --git a/package/utils/busybox/files/ntpd.capabilities b/package/utils/busybox/files/ntpd.capabilities new file mode 100644 index 0000000000..8a05dba4bc --- /dev/null +++ b/package/utils/busybox/files/ntpd.capabilities @@ -0,0 +1,22 @@ +{ + "bounding": [ + "CAP_NET_BIND_SERVICE", + "CAP_SYS_TIME" + ], + "effective": [ + "CAP_NET_BIND_SERVICE", + "CAP_SYS_TIME" + ], + "ambient": [ + "CAP_NET_BIND_SERVICE", + "CAP_SYS_TIME" + ], + "permitted": [ + "CAP_NET_BIND_SERVICE", + "CAP_SYS_TIME" + ], + "inheritable": [ + "CAP_NET_BIND_SERVICE", + "CAP_SYS_TIME" + ] +} diff --git a/package/utils/busybox/files/sysntpd b/package/utils/busybox/files/sysntpd index 52866ba32a..cbc760a48e 100755 --- a/package/utils/busybox/files/sysntpd +++ b/package/utils/busybox/files/sysntpd @@ -55,6 +55,13 @@ start_ntpd_instance() { procd_append_param command -p $peer done procd_set_param respawn + [ -x /sbin/ujail ] && { + procd_add_jail ntpd + procd_set_param capabilities /etc/capabilities/ntpd.json + procd_set_param user ntpd + procd_set_param group ntpd + procd_set_param no_new_privs 1 + } procd_close_instance } |