This adds a little extra security by using seccomp.
Signed-off-by: Bruno Thomsen <[email protected]>
---
Note: this patch requires my chrony patch series
version 3 before apply.
rules/chrony.in | 8 ++++++++
rules/chrony.make | 3 ++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/rules/chrony.in b/rules/chrony.in
index 2f906d2ce..f50b86442 100644
--- a/rules/chrony.in
+++ b/rules/chrony.in
@@ -6,6 +6,7 @@ menuconfig CHRONY
prompt "chrony "
select LIBC_M
select LIBCAP
+ select LIBSECCOMP if CHRONY_SECCOMP
select NETTLE if CHRONY_USE_NETTLE
help
This will install the Chrony NTPD Daemon (chronyd)
@@ -29,6 +30,13 @@ config CHRONY_USE_NETTLE
Use nettle crypto library for stronger keys than MD5 in
NTP authentication.
+config CHRONY_SECCOMP
+ bool
+ default y
+ prompt "Enable seccomp sandboxing"
+ help
+ Enables seccomp sandboxing to reduce the attack surface.
+
config CHRONY_ADVANCED_COMMAND
bool
prompt "Enable advanced monitoring command"
diff --git a/rules/chrony.make b/rules/chrony.make
index 4d6f58f3b..f5e40dfb8 100644
--- a/rules/chrony.make
+++ b/rules/chrony.make
@@ -55,7 +55,8 @@ CHRONY_CONF_OPT := \
--disable-pps \
$(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \
--with-user=chrony \
- --without-seccomp
+ $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \
+ $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp)
# ----------------------------------------------------------------------------
# Install
--
2.26.2
_______________________________________________
ptxdist mailing list
[email protected]
To unsubscribe, send a mail with subject "unsubscribe" to
[email protected]
