diff options
| author |   Easwar Hariharan <easwar.hariharan@microsoft.com> | 2021-08-25 15:43:41 -0700 |
|---|---|---|
| committer |   Khem Raj <raj.khem@gmail.com> | 2021-08-26 10:10:57 -0700 |
| commit | 18306e6fccd6cab57823059b21ba17188a5501e3 (patch) | |
| tree | d7452d8ac32357780b40fb49a121a4c4e0e6cef4 /meta-networking | |
| parent | 656ab53e15d0f4051775d9efe48d7ab2be3cadb7 (diff) | |
| download | meta-openembedded-contrib-18306e6fccd6cab57823059b21ba17188a5501e3.tar.gz | |
chrony: Fix privdrop packageconfig
To drop root privileges on Linux-based systems, chrony requires a
standard user to switch to and the use of capabilities. Fix up the
privdrop packageconfig to account for this.
Signed-off-by: Easwar Hariharan <easwar.hariharan@microsoft.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Diffstat (limited to 'meta-networking')
| -rw-r--r-- | meta-networking/recipes-support/chrony/chrony_4.1.bb | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/meta-networking/recipes-support/chrony/chrony_4.1.bb b/meta-networking/recipes-support/chrony/chrony_4.1.bb index 6a450c3e88..f009bae75c 100644 --- a/meta-networking/recipes-support/chrony/chrony_4.1.bb +++ b/meta-networking/recipes-support/chrony/chrony_4.1.bb @@ -47,6 +47,11 @@ DEPENDS = "pps-tools" # chrony does not use GNU Autotools. inherit update-rc.d systemd +# Add chronyd user if privdrop packageconfig is selected +inherit ${@bb.utils.contains('PACKAGECONFIG', 'privdrop', 'useradd', '', d)} +USERADD_PACKAGES = "${@bb.utils.contains('PACKAGECONFIG', 'privdrop', '${PN}', '', d)}" +USERADD_PARAM_${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'privdrop', '--system -d / -M --shell /bin/nologin chronyd;', '', d)}" + # Configuration options: # - For command line editing support in chronyc, you may specify either # 'editline' or 'readline' but not both. editline is smaller, but @@ -68,7 +73,7 @@ PACKAGECONFIG ??= "editline \ PACKAGECONFIG[readline] = "--without-editline,--without-readline,readline" PACKAGECONFIG[editline] = ",--without-editline,libedit" PACKAGECONFIG[sechash] = "--without-tomcrypt,--disable-sechash,nss" -PACKAGECONFIG[privdrop] = ",--disable-privdrop,libcap" +PACKAGECONFIG[privdrop] = "--with-libcap,--disable-privdrop --without-libcap,libcap" PACKAGECONFIG[scfilter] = "--enable-scfilter,--without-seccomp,libseccomp" PACKAGECONFIG[ipv6] = ",--disable-ipv6," PACKAGECONFIG[nss] = "--with-nss,--without-nss,nss" @@ -97,6 +102,10 @@ do_install() { # Config file install -d ${D}${sysconfdir} install -m 644 ${WORKDIR}/chrony.conf ${D}${sysconfdir} + if ${@bb.utils.contains('PACKAGECONFIG', 'privdrop', 'true', 'false', d)}; then + echo "# Define user to drop to after dropping root privileges" >> ${D}${sysconfdir}/chrony.conf + echo "user chronyd" >> ${D}${sysconfdir}/chrony.conf + fi # System V init script install -d ${D}${sysconfdir}/init.d |