Achim Gratz writes: >> Our philosophy in situations like this is to go for the high-security option >> even if it needs a little more one-time setup, like a chmod or a udev rule. > > I'll try that tomorrow as well. I have these devices set up by udev > anyway, so I only need to figure out how to tell it to give them a > different group.
Adding 'GROUP="ntp"' to the udev rules setting up the device symlinks correctly changes the actual device files' group to ntp and lets ntpd use these devices while --enable-early-droproot is configured. [what markup language is INSTALL in?] --- a/INSTALL +++ b/INSTALL @@ -226,6 +226,15 @@ of options. refclocks are enabled with `--refclock=<n1,n2,n3..> or --refclock=all' `waf configure --list' will print a list of available refclocks. +=== --enable-early-droproot === + +Drop root privileges as early as possible. This requires the refclock +devices to be owned by the same owner or group that ntpd will be +running under (most likely that group will be named "ntp") so that it +can still open the devices. This can be accomplished by adding +`GROUP="ntp"` or `OWNER="ntp"` to the udev rules that create the +device symlinks for the refclocks. + == Developer options == --enable-debug-gdb:: Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ SD adaptations for KORG EX-800 and Poly-800MkII V0.9: http://Synth.Stromeko.net/Downloads.html#KorgSDada _______________________________________________ devel mailing list [email protected] http://lists.ntpsec.org/mailman/listinfo/devel
