Thanks, applied as 96db4ea70594b4213770929907262de503c32725. Michael
[sent from post-receive hook] On Mon, 03 Aug 2020 08:30:22 +0200, Bruno Thomsen <[email protected]> wrote: > This adds a little extra security by using seccomp. > > Signed-off-by: Bruno Thomsen <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/rules/chrony.in b/rules/chrony.in > index 2f906d2cec4a..f50b864429b0 100644 > --- a/rules/chrony.in > +++ b/rules/chrony.in > @@ -6,6 +6,7 @@ menuconfig CHRONY > prompt "chrony " > select LIBC_M > select LIBCAP > + select LIBSECCOMP if CHRONY_SECCOMP > select NETTLE if CHRONY_USE_NETTLE > help > This will install the Chrony NTPD Daemon (chronyd) > @@ -29,6 +30,13 @@ config CHRONY_USE_NETTLE > Use nettle crypto library for stronger keys than MD5 in > NTP authentication. > > +config CHRONY_SECCOMP > + bool > + default y > + prompt "Enable seccomp sandboxing" > + help > + Enables seccomp sandboxing to reduce the attack surface. > + > config CHRONY_ADVANCED_COMMAND > bool > prompt "Enable advanced monitoring command" > diff --git a/rules/chrony.make b/rules/chrony.make > index 4d6f58f3ba1e..f5e40dfb8d12 100644 > --- a/rules/chrony.make > +++ b/rules/chrony.make > @@ -55,7 +55,8 @@ CHRONY_CONF_OPT := \ > --disable-pps \ > $(call ptx/ifdef, PTXCONF_GLOBAL_IPV6,,--disable-ipv6) \ > --with-user=chrony \ > - --without-seccomp > + $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,--enable-scfilter,) \ > + $(call ptx/ifdef, PTXCONF_CHRONY_SECCOMP,,--without-seccomp) > > # > ---------------------------------------------------------------------------- > # Install _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
