mirror of
https://github.com/systemd/systemd
synced 2024-07-21 10:17:21 +00:00
timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)
This commit is contained in:
parent
2bcc252371
commit
a349eb10d3
|
@ -4066,6 +4066,7 @@ systemd_timesyncd_LDADD = \
|
||||||
libsystemd-shared.la \
|
libsystemd-shared.la \
|
||||||
libsystemd-resolve.la \
|
libsystemd-resolve.la \
|
||||||
libsystemd-network.la \
|
libsystemd-network.la \
|
||||||
|
libsystemd-capability.la \
|
||||||
-lm
|
-lm
|
||||||
|
|
||||||
rootlibexec_PROGRAMS += \
|
rootlibexec_PROGRAMS += \
|
||||||
|
|
5
README
5
README
|
@ -183,6 +183,11 @@ USERS AND GROUPS:
|
||||||
exist. During execution this network facing service will drop
|
exist. During execution this network facing service will drop
|
||||||
privileges and assume this uid/gid for security reasons.
|
privileges and assume this uid/gid for security reasons.
|
||||||
|
|
||||||
|
The NTP daemon requires the "systemd-timesync" system user and
|
||||||
|
group to exist. During execution this network facing service
|
||||||
|
will drop priviliges (with the exception of CAP_SYS_TIME) and
|
||||||
|
assume this uid/gid for security reasons.
|
||||||
|
|
||||||
WARNINGS:
|
WARNINGS:
|
||||||
systemd will warn you during boot if /etc/mtab is not a
|
systemd will warn you during boot if /etc/mtab is not a
|
||||||
symlink to /proc/mounts. Please ensure that /etc/mtab is a
|
symlink to /proc/mounts. Please ensure that /etc/mtab is a
|
||||||
|
|
|
@ -156,7 +156,8 @@ int capability_bounding_set_drop(uint64_t drop, bool right_now) {
|
||||||
r = 0;
|
r = 0;
|
||||||
|
|
||||||
finish:
|
finish:
|
||||||
cap_set_proc(after_cap);
|
if (cap_set_proc(after_cap) < 0)
|
||||||
|
return -errno;
|
||||||
|
|
||||||
return r;
|
return r;
|
||||||
}
|
}
|
||||||
|
|
|
@ -33,6 +33,9 @@
|
||||||
#include <sys/timex.h>
|
#include <sys/timex.h>
|
||||||
#include <sys/socket.h>
|
#include <sys/socket.h>
|
||||||
#include <resolv.h>
|
#include <resolv.h>
|
||||||
|
#include <sys/prctl.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <grp.h>
|
||||||
|
|
||||||
#include "missing.h"
|
#include "missing.h"
|
||||||
#include "util.h"
|
#include "util.h"
|
||||||
|
@ -49,6 +52,7 @@
|
||||||
#include "sd-network.h"
|
#include "sd-network.h"
|
||||||
#include "event-util.h"
|
#include "event-util.h"
|
||||||
#include "network-util.h"
|
#include "network-util.h"
|
||||||
|
#include "capability.h"
|
||||||
#include "timesyncd.h"
|
#include "timesyncd.h"
|
||||||
|
|
||||||
#define TIME_T_MAX (time_t)((1UL << ((sizeof(time_t) << 3) - 1)) - 1)
|
#define TIME_T_MAX (time_t)((1UL << ((sizeof(time_t) << 3) - 1)) - 1)
|
||||||
|
@ -1138,6 +1142,80 @@ static int manager_network_monitor_listen(Manager *m) {
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int drop_priviliges(void) {
|
||||||
|
static const cap_value_t bits[] = {
|
||||||
|
CAP_SYS_TIME,
|
||||||
|
};
|
||||||
|
|
||||||
|
_cleanup_cap_free_ cap_t d = NULL;
|
||||||
|
const char *name = "systemd-timesync";
|
||||||
|
uid_t uid;
|
||||||
|
gid_t gid;
|
||||||
|
int r;
|
||||||
|
|
||||||
|
/* Unfortunately we cannot leave privilige dropping to PID 1
|
||||||
|
* here, since we want to run as user but want to keep te
|
||||||
|
* CAP_SYS_TIME capability. Since file capabilities have been
|
||||||
|
* introduced this cannot be done across exec() anymore,
|
||||||
|
* unless our binary has the capability configured in the file
|
||||||
|
* system, which we want to avoid. */
|
||||||
|
|
||||||
|
r = get_user_creds(&name, &uid, &gid, NULL, NULL);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Cannot resolve user name %s: %s", name, strerror(-r));
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (setresgid(gid, gid, gid) < 0) {
|
||||||
|
log_error("Failed change group ID: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (setgroups(0, NULL) < 0) {
|
||||||
|
log_error("Failed to drop auxiliary groups list: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
|
||||||
|
log_error("Failed to enable keep capabilities flag: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = setresuid(uid, uid, uid);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Failed change user ID: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (prctl(PR_SET_KEEPCAPS, 0) < 0) {
|
||||||
|
log_error("Failed to disable keep capabilities flag: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
r = capability_bounding_set_drop(~(1ULL << CAP_SYS_TIME), true);
|
||||||
|
if (r < 0) {
|
||||||
|
log_error("Failed to drop capabilities: %s", strerror(-r));
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
d = cap_init();
|
||||||
|
if (!d)
|
||||||
|
return log_oom();
|
||||||
|
|
||||||
|
if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
|
||||||
|
cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
|
||||||
|
log_error("Failed to enable capabilities bits: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (cap_set_proc(d) < 0) {
|
||||||
|
log_error("Failed to increase capabilities: %m");
|
||||||
|
return -errno;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
int main(int argc, char *argv[]) {
|
int main(int argc, char *argv[]) {
|
||||||
_cleanup_manager_free_ Manager *m = NULL;
|
_cleanup_manager_free_ Manager *m = NULL;
|
||||||
int r;
|
int r;
|
||||||
|
@ -1154,6 +1232,10 @@ int main(int argc, char *argv[]) {
|
||||||
|
|
||||||
umask(0022);
|
umask(0022);
|
||||||
|
|
||||||
|
r = drop_priviliges();
|
||||||
|
if (r < 0)
|
||||||
|
goto out;
|
||||||
|
|
||||||
assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
|
assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0);
|
||||||
|
|
||||||
r = manager_new(&m);
|
r = manager_new(&m);
|
||||||
|
|
|
@ -16,7 +16,9 @@ Type=notify
|
||||||
Restart=always
|
Restart=always
|
||||||
RestartSec=0
|
RestartSec=0
|
||||||
ExecStart=@rootlibexecdir@/systemd-timesyncd
|
ExecStart=@rootlibexecdir@/systemd-timesyncd
|
||||||
CapabilityBoundingSet=CAP_SYS_TIME
|
CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP
|
||||||
|
PrivateTmp=yes
|
||||||
|
PrivateDevices=yes
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=multi-user.target
|
WantedBy=multi-user.target
|
||||||
|
|
Loading…
Reference in a new issue