MIRRORS/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2025-07-19 15:29:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

chrony: Fix privdrop packageconfig

Browse Source 
To drop root privileges on Linux-based systems, chrony requires a
standard user to switch to and the use of capabilities. Fix up the
privdrop packageconfig to account for this.

Signed-off-by: Easwar Hariharan <easwar.hariharan@microsoft.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Easwar Hariharan 2021-08-25 15:43:41 -07:00 committed by Khem Raj
parent 656ab53e15
commit 18306e6fcc
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
meta-networking/recipes-support/chrony/chrony_4.1.bb
View File

@ -47,6 +47,11 @@ DEPENDS = "pps-tools"
# chrony does not use GNU Autotools.
inherit update-rc.d systemd
# Add chronyd user if privdrop packageconfig is selected
inherit ${@bb.utils.contains('PACKAGECONFIG', 'privdrop', 'useradd', '', d)}
USERADD_PACKAGES = "${@bb.utils.contains('PACKAGECONFIG', 'privdrop', '${PN}', '', d)}"
USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'privdrop', '--system -d / -M --shell /bin/nologin chronyd;', '', d)}"
# Configuration options:
# - For command line editing support in chronyc, you may specify either
# 'editline' or 'readline' but not both. editline is smaller, but
@ -68,7 +73,7 @@ PACKAGECONFIG ??= "editline \
PACKAGECONFIG[readline] = "--without-editline,--without-readline,readline"
PACKAGECONFIG[editline] = ",--without-editline,libedit"
PACKAGECONFIG[sechash] = "--without-tomcrypt,--disable-sechash,nss"
PACKAGECONFIG[privdrop] = ",--disable-privdrop,libcap"
PACKAGECONFIG[privdrop] = "--with-libcap,--disable-privdrop --without-libcap,libcap"
PACKAGECONFIG[scfilter] = "--enable-scfilter,--without-seccomp,libseccomp"
PACKAGECONFIG[ipv6] = ",--disable-ipv6,"
PACKAGECONFIG[nss] = "--with-nss,--without-nss,nss"
@ -97,6 +102,10 @@ do_install() {
# Config file
install -d ${D}${sysconfdir}
install -m 644 ${WORKDIR}/chrony.conf ${D}${sysconfdir}
if ${@bb.utils.contains('PACKAGECONFIG', 'privdrop', 'true', 'false', d)}; then
echo "# Define user to drop to after dropping root privileges" >> ${D}${sysconfdir}/chrony.conf
echo "user chronyd" >> ${D}${sysconfdir}/chrony.conf
fi
# System V init script
install -d ${D}${sysconfdir}/init.d