commit: 8378a79d9aa538e3df9df159d45b4e80a4d19f5d Author: layman <layman <AT> localhost> AuthorDate: Sat May 23 21:22:06 2020 +0000 Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org> CommitDate: Thu May 28 12:43:05 2020 +0000 URL: https://gitweb.gentoo.org/proj/musl.git/commit/?id=8378a79d
Adding ebuild for a current stable version of chrony (based on ebuild from gentoo/main repository). Successfully tested at a couple of different arm64-musl-hardened installations. Signed-off-by: Anthony G. Basile <blueness <AT> gentoo.org> net-misc/chrony/Manifest | 1 + net-misc/chrony/chrony-3.5-r4.ebuild | 167 +++++++++++++++++++++ .../files/chrony-3.5-pool-vendor-gentoo.patch | 16 ++ .../files/chrony-3.5-r3-systemd-gentoo.patch | 12 ++ net-misc/chrony/files/chronyd.conf-r1 | 12 ++ net-misc/chrony/files/chronyd.init-r2 | 70 +++++++++ 6 files changed, 278 insertions(+) diff --git a/net-misc/chrony/Manifest b/net-misc/chrony/Manifest index f4828b8..32e4543 100644 --- a/net-misc/chrony/Manifest +++ b/net-misc/chrony/Manifest @@ -1 +1,2 @@ DIST chrony-3.2.tar.gz 433882 SHA256 329f6718dd8c3ece3eee78be1f4821cbbeb62608e7d23f25da293cfa433c4116 SHA512 496af5bed91600f268c1a0fa577bb8c7785e485f78598b666829c674e94770c16548cec4289a2ae9d0a51191d2705eda00886cb6cccae3828aa201a49d4783a4 WHIRLPOOL b8a9045c81970653393c2afadece1e3a5e093c893b7ac3bae061bbd40bc043439e426df8da6598e36ef9589b4dd402419199307a9bfa48df526206952814667e +DIST chrony-3.5.tar.gz 458226 BLAKE2B 611f21e36c6e745208e00eba988519fcd912c6c0c3518c953591f43224dc3da79f627027a6cd4bf9c4227e9f8659a69adbdb634252ff3920d2ef677e32012456 SHA512 c4f6376a44d71b6ac2b6d86e3d6fb4348642faeef7f3f3a4d6431627b5645efcc868b005cc398c8292bc3b63a1161fbd1a042c6ac2a0595843f908fe32eed90c diff --git a/net-misc/chrony/chrony-3.5-r4.ebuild b/net-misc/chrony/chrony-3.5-r4.ebuild new file mode 100644 index 0000000..0ee9240 --- /dev/null +++ b/net-misc/chrony/chrony-3.5-r4.ebuild @@ -0,0 +1,167 @@ +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 +inherit systemd tmpfiles toolchain-funcs + +DESCRIPTION="NTP client and server programs" +HOMEPAGE="https://chrony.tuxfamily.org/"; +SRC_URI="https://download.tuxfamily.org/${PN}/${P/_/-}.tar.gz"; +LICENSE="GPL-2" +SLOT="0" + +KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86" +IUSE=" + +adns +caps +cmdmon html ipv6 libedit +ntp +phc pps readline +refclock +rtc + +seccomp selinux +" +REQUIRED_USE=" + ?? ( libedit readline ) +" + +CDEPEND=" + caps? ( acct-group/ntp acct-user/ntp sys-libs/libcap ) + libedit? ( dev-libs/libedit ) + readline? ( >=sys-libs/readline-4.1-r4:= ) + seccomp? ( sys-libs/libseccomp ) +" +DEPEND=" + ${CDEPEND} + html? ( dev-ruby/asciidoctor ) + pps? ( net-misc/pps-tools ) +" +RDEPEND=" + ${CDEPEND} + selinux? ( sec-policy/selinux-chronyd ) +" + +RESTRICT=test + +S="${WORKDIR}/${P/_/-}" + +PATCHES=( + "${FILESDIR}"/${PN}-3.2-no-glob_magic.patch + "${FILESDIR}"/${PN}-3.5-pool-vendor-gentoo.patch + "${FILESDIR}"/${PN}-3.5-r3-systemd-gentoo.patch +) + +src_prepare() { + default + sed -i \ + -e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \ + doc/* examples/* || die + + # Copy for potential user fixup + cp "${FILESDIR}"/chronyd.conf-r1 "${T}"/chronyd.conf + cp examples/chronyd.service "${T}"/chronyd.service + + # Set config for privdrop + if ! use caps; then + sed -i \ + -e 's/-u ntp//' \ + "${T}"/chronyd.conf "${T}"/chronyd.service || die + fi +} + +src_configure() { + tc-export CC + + local CHRONY_EDITLINE + # ./configure legend: + # --disable-readline : disable line editing entirely + # --without-readline : do not use sys-libs/readline (enabled by default) + # --without-editline : do not use dev-libs/libedit (enabled by default) + if ! use readline && ! use libedit; then + CHRONY_EDITLINE='--disable-readline' + else + CHRONY_EDITLINE+=" $(usex readline '' --without-readline)" + CHRONY_EDITLINE+=" $(usex libedit '' --without-editline)" + fi + + # not an autotools generated script + local myconf=( + $(use_enable seccomp scfilter) + $(usex adns '' --disable-asyncdns) + $(usex caps '' --disable-linuxcaps) + $(usex cmdmon '' --disable-cmdmon) + $(usex ipv6 '' --disable-ipv6) + $(usex ntp '' --disable-ntp) + $(usex phc '' --disable-phc) + $(usex pps '' --disable-pps) + $(usex refclock '' --disable-refclock) + $(usex rtc '' --disable-rtc) + ${CHRONY_EDITLINE} + ${EXTRA_ECONF} + --chronysockdir="${EPREFIX}/run/chrony" + --disable-sechash + --docdir="${EPREFIX}/usr/share/doc/${PF}" + --mandir="${EPREFIX}/usr/share/man" + --prefix="${EPREFIX}/usr" + --sysconfdir="${EPREFIX}/etc/chrony" + --with-pidfile="${EPREFIX}/run/chrony/chronyd.pid" + --without-nss + --without-tomcrypt + ) + + # print the ./configure call to aid in future debugging + echo bash ./configure "${myconf[@]}" >&2 + bash ./configure "${myconf[@]}" || die +} + +src_compile() { + emake all docs $(usex html '' 'ADOC=true') +} + +src_install() { + default + + newinitd "${FILESDIR}"/chronyd.init-r2 chronyd + newconfd "${T}"/chronyd.conf chronyd + + insinto /etc/${PN} + newins examples/chrony.conf.example1 chrony.conf + + docinto examples + dodoc examples/*.example* + + newtmpfiles - chronyd.conf <<<"d /run/chrony 0750 $(usex caps 'ntp ntp' 'root root')" + + if use html; then + docinto html + dodoc doc/*.html + fi + + keepdir /var/{lib,log}/chrony + + if use caps; then + # Prepare a directory for the chrony.drift file (a la ntpsec) + # Ensures the environment is sane on new installs + fowners ntp:ntp /var/{lib,log}/chrony + fperms 770 /var/lib/chrony + fi + + insinto /etc/logrotate.d + newins "${FILESDIR}"/chrony-2.4-r1.logrotate chrony + + systemd_dounit "${T}"/chronyd.service + systemd_dounit examples/chrony-wait.service + systemd_enable_ntpunit 50-chrony chronyd.service +} + +pkg_preinst() { + HAD_CAPS=false + + if has_version 'net-misc/chrony[caps]'; then + HAD_CAPS=true + fi +} + +pkg_postinst() { + tmpfiles_process chronyd.conf + + if [[ -n ${REPLACING_VERSIONS} ]] && use caps && ! ${HAD_CAPS}; then + ewarn "Please adjust permissions on ${EROOT}/var/{lib,log}/chrony to be owned by ntp:ntp" + ewarn "e.g. chown -R ntp:ntp ${EROOT}/var/{lib,log}/chrony" + ewarn "This is necessary for chrony to drop privileges" + fi +} diff --git a/net-misc/chrony/files/chrony-3.5-pool-vendor-gentoo.patch b/net-misc/chrony/files/chrony-3.5-pool-vendor-gentoo.patch new file mode 100644 index 0000000..817a410 --- /dev/null +++ b/net-misc/chrony/files/chrony-3.5-pool-vendor-gentoo.patch @@ -0,0 +1,16 @@ +- Use the Gentoo pool +- Use the server directive instead of the pool directive so we get four time + sources and not twelve. + +--- a/examples/chrony.conf.example1 ++++ b/examples/chrony.conf.example1 +@@ -1,5 +1,8 @@ + # Use public NTP servers from the pool.ntp.org project. +-pool pool.ntp.org iburst ++server 0.gentoo.pool.ntp.org iburst ++server 1.gentoo.pool.ntp.org iburst ++server 2.gentoo.pool.ntp.org iburst ++server 3.gentoo.pool.ntp.org iburst + + # Record the rate at which the system clock gains/losses time. + driftfile /var/lib/chrony/drift diff --git a/net-misc/chrony/files/chrony-3.5-r3-systemd-gentoo.patch b/net-misc/chrony/files/chrony-3.5-r3-systemd-gentoo.patch new file mode 100644 index 0000000..7c46b6d --- /dev/null +++ b/net-misc/chrony/files/chrony-3.5-r3-systemd-gentoo.patch @@ -0,0 +1,12 @@ +--- a/examples/chronyd.service ++++ b/examples/chronyd.service +@@ -8,8 +8,7 @@ + [Service] + Type=forking + PIDFile=/run/chrony/chronyd.pid +-EnvironmentFile=-/etc/sysconfig/chronyd +-ExecStart=/usr/sbin/chronyd $OPTIONS ++ExecStart=/usr/sbin/chronyd -u ntp + PrivateTmp=yes + ProtectHome=yes + ProtectSystem=full diff --git a/net-misc/chrony/files/chronyd.conf-r1 b/net-misc/chrony/files/chronyd.conf-r1 new file mode 100644 index 0000000..c641d98 --- /dev/null +++ b/net-misc/chrony/files/chronyd.conf-r1 @@ -0,0 +1,12 @@ +# /etc/conf.d/chronyd + +CFGFILE="/etc/chrony/chrony.conf" + +# Configuration dependant options : +# -s - Set system time from RTC if rtcfile directive present +# -r - Reload sample histories if dumponexit directive present +# +# The combination of "-s -r" allows chronyd to perform long term averaging of +# the gain or loss rate across system reboots and shutdowns. + +ARGS="-u ntp" diff --git a/net-misc/chrony/files/chronyd.init-r2 b/net-misc/chrony/files/chronyd.init-r2 new file mode 100644 index 0000000..4892a57 --- /dev/null +++ b/net-misc/chrony/files/chronyd.init-r2 @@ -0,0 +1,70 @@ +#!/sbin/openrc-run +# Copyright 1999-2018 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +depend() { + use dns +} + +checkconfig() { + # Note that /etc/chrony/chrony.keys is *NOT* checked. This + # is because the user may have specified another key + # file, and we don't want to force the user to use that + # exact name for the key file. + if [ ! -f "${CFGFILE}" ] ; then + eerror "Please create ${CFGFILE} and the" + eerror "chrony key file (usually /etc/chrony/chrony.keys)" + eerror "by using the" + eerror "" + eerror " chrony.conf.example" + eerror " chrony.keys.example" + eerror "" + eerror "files (from the documentation directory)" + eerror "as templates." + return 1 + else + # Actually, I tried it, and chrony seems to ignore the pidfile + # option. I'm going to leave it here anyway, since you never + # know if it might be handy + PIDFILE=`awk '/^ *pidfile/{print $2}' "${CFGFILE}"` + [ -z "${PIDFILE}" ] && PIDFILE=/run/chrony/chronyd.pid + fi + return 0 +} + +setxtrarg() { + if [ -c /dev/rtc ]; then + grep -q '^rtcfile' "${CFGFILE}" && ARGS="${ARGS} -s" + fi + grep -q '^dumponexit$' "${CFGFILE}" && ARGS="${ARGS} -r" + return 0 +} + +start() { + checkconfig || return $? + setxtrarg + + [ -n "${PIDFILE}" ] || PIDFILE=/run/chronyd.pid + + ebegin "Starting chronyd" + start-stop-daemon \ + --start \ + --quiet \ + --exec /usr/sbin/chronyd \ + --pidfile "${PIDFILE}" \ + -- -f "${CFGFILE}" ${ARGS} + eend $? "Failed to start chronyd" +} + +stop() { + checkconfig || return $? + + [ -n "${PIDFILE}" ] || PIDFILE=/run/chronyd.pid + + ebegin "Stopping chronyd" + start-stop-daemon \ + --stop \ + --quiet \ + --pidfile "${PIDFILE}" + eend $? "Failed to stop chronyd" +}
