From d9d871386087cdad9fd2197976bb00f21b1df081 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Mon, 23 Nov 2020 22:47:43 -0800 Subject: chrony: Upgrade to 4.0 ChangeLog is here [1] Do not install /var/log as it conflicts with basefiles package Collected errors: * check_data_file_clashes: Package chrony wants to install file /var/log But that file is already provided by package * base-files Remove CVE patch since its upstream Forward port arm_eabi.patch patch Make builds reproducible [1] https://chrony.tuxfamily.org/news.html Signed-off-by: Khem Raj --- .../chrony/chrony/CVE-2020-14367.patch | 204 --------------------- .../recipes-support/chrony/chrony/arm_eabi.patch | 77 ++++---- .../recipes-support/chrony/chrony/chronyd | 2 +- .../recipes-support/chrony/chrony_3.5.bb | 139 -------------- .../recipes-support/chrony/chrony_4.0.bb | 138 ++++++++++++++ 5 files changed, 183 insertions(+), 377 deletions(-) delete mode 100644 meta-networking/recipes-support/chrony/chrony/CVE-2020-14367.patch delete mode 100644 meta-networking/recipes-support/chrony/chrony_3.5.bb create mode 100644 meta-networking/recipes-support/chrony/chrony_4.0.bb (limited to 'meta-networking/recipes-support') diff --git a/meta-networking/recipes-support/chrony/chrony/CVE-2020-14367.patch b/meta-networking/recipes-support/chrony/chrony/CVE-2020-14367.patch deleted file mode 100644 index 79df1007e0..0000000000 --- a/meta-networking/recipes-support/chrony/chrony/CVE-2020-14367.patch +++ /dev/null @@ -1,204 +0,0 @@ -From f00fed20092b6a42283f29c6ee1f58244d74b545 Mon Sep 17 00:00:00 2001 -From: Miroslav Lichvar -Date: Thu, 6 Aug 2020 09:31:11 +0200 -Subject: main: create new file when writing pidfile - -When writing the pidfile, open the file with the O_CREAT|O_EXCL flags -to avoid following a symlink and writing the PID to an unexpected file, -when chronyd still has the root privileges. - -The Linux open(2) man page warns about O_EXCL not working as expected on -NFS versions before 3 and Linux versions before 2.6. Saving pidfiles on -a distributed filesystem like NFS is not generally expected, but if -there is a reason to do that, these old kernel and NFS versions are not -considered to be supported for saving files by chronyd. - -This is a minimal backport specific to this issue of the following -commits: -- commit 2fc8edacb810 ("use PATH_MAX") -- commit f4c6a00b2a11 ("logging: call exit() in LOG_Message()") -- commit 7a4c396bba8f ("util: add functions for common file operations") -- commit e18903a6b563 ("switch to new util file functions") - -Reported-by: Matthias Gerstner - -Upstream-Status: Backport [https://git.tuxfamily.org/chrony/chrony.git/commit/?id=f00fed20092b6a42283f29c6ee1f58244d74b545] -CVE: CVE-2020-14367 -Signed-off-by: Anatol Belski - -diff --git a/logging.c b/logging.c -index d2296e0..fd7f900 100644 ---- a/logging.c -+++ b/logging.c -@@ -171,6 +171,7 @@ void LOG_Message(LOG_Severity severity, - system_log = 0; - log_message(1, severity, buf); - } -+ exit(1); - break; - default: - assert(0); -diff --git a/main.c b/main.c -index 6ccf32e..8edb2e1 100644 ---- a/main.c -+++ b/main.c -@@ -281,13 +281,9 @@ write_pidfile(void) - if (!pidfile[0]) - return; - -- out = fopen(pidfile, "w"); -- if (!out) { -- LOG_FATAL("Could not open %s : %s", pidfile, strerror(errno)); -- } else { -- fprintf(out, "%d\n", (int)getpid()); -- fclose(out); -- } -+ out = UTI_OpenFile(NULL, pidfile, NULL, 'W', 0644); -+ fprintf(out, "%d\n", (int)getpid()); -+ fclose(out); - } - - /* ================================================== */ -diff --git a/sysincl.h b/sysincl.h -index 296c5e6..873a3bd 100644 ---- a/sysincl.h -+++ b/sysincl.h -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/util.c b/util.c -index e7e3442..83b3b20 100644 ---- a/util.c -+++ b/util.c -@@ -1179,6 +1179,101 @@ UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid) - - /* ================================================== */ - -+static int -+join_path(const char *basedir, const char *name, const char *suffix, -+ char *buffer, size_t length, LOG_Severity severity) -+{ -+ const char *sep; -+ -+ if (!basedir) { -+ basedir = ""; -+ sep = ""; -+ } else { -+ sep = "/"; -+ } -+ -+ if (!suffix) -+ suffix = ""; -+ -+ if (snprintf(buffer, length, "%s%s%s%s", basedir, sep, name, suffix) >= length) { -+ LOG(severity, "File path %s%s%s%s too long", basedir, sep, name, suffix); -+ return 0; -+ } -+ -+ return 1; -+} -+ -+/* ================================================== */ -+ -+FILE * -+UTI_OpenFile(const char *basedir, const char *name, const char *suffix, -+ char mode, mode_t perm) -+{ -+ const char *file_mode; -+ char path[PATH_MAX]; -+ LOG_Severity severity; -+ int fd, flags; -+ FILE *file; -+ -+ severity = mode >= 'A' && mode <= 'Z' ? LOGS_FATAL : LOGS_ERR; -+ -+ if (!join_path(basedir, name, suffix, path, sizeof (path), severity)) -+ return NULL; -+ -+ switch (mode) { -+ case 'r': -+ case 'R': -+ flags = O_RDONLY; -+ file_mode = "r"; -+ if (severity != LOGS_FATAL) -+ severity = LOGS_DEBUG; -+ break; -+ case 'w': -+ case 'W': -+ flags = O_WRONLY | O_CREAT | O_EXCL; -+ file_mode = "w"; -+ break; -+ case 'a': -+ case 'A': -+ flags = O_WRONLY | O_CREAT | O_APPEND; -+ file_mode = "a"; -+ break; -+ default: -+ assert(0); -+ return NULL; -+ } -+ -+try_again: -+ fd = open(path, flags, perm); -+ if (fd < 0) { -+ if (errno == EEXIST) { -+ if (unlink(path) < 0) { -+ LOG(severity, "Could not remove %s : %s", path, strerror(errno)); -+ return NULL; -+ } -+ DEBUG_LOG("Removed %s", path); -+ goto try_again; -+ } -+ LOG(severity, "Could not open %s : %s", path, strerror(errno)); -+ return NULL; -+ } -+ -+ UTI_FdSetCloexec(fd); -+ -+ file = fdopen(fd, file_mode); -+ if (!file) { -+ LOG(severity, "Could not open %s : %s", path, strerror(errno)); -+ close(fd); -+ return NULL; -+ } -+ -+ DEBUG_LOG("Opened %s fd=%d mode=%c", path, fd, mode); -+ -+ return file; -+} -+ -+/* ================================================== */ -+ - void - UTI_DropRoot(uid_t uid, gid_t gid) - { -diff --git a/util.h b/util.h -index e3d6767..a2481cc 100644 ---- a/util.h -+++ b/util.h -@@ -176,6 +176,17 @@ extern int UTI_CreateDirAndParents(const char *path, mode_t mode, uid_t uid, gid - permissions and its uid/gid must match the specified values. */ - extern int UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid); - -+/* Open a file. The full path of the file is constructed from the basedir -+ (may be NULL), '/' (if basedir is not NULL), name, and suffix (may be NULL). -+ Created files have specified permissions (umasked). Returns NULL on error. -+ The following modes are supported (if the mode is an uppercase character, -+ errors are fatal): -+ r/R - open an existing file for reading -+ w/W - open a new file for writing (remove existing file) -+ a/A - open an existing file for appending (create if does not exist) */ -+extern FILE *UTI_OpenFile(const char *basedir, const char *name, const char *suffix, -+ char mode, mode_t perm); -+ - /* Set process user/group IDs and drop supplementary groups */ - extern void UTI_DropRoot(uid_t uid, gid_t gid); - --- -cgit v0.10.2 - diff --git a/meta-networking/recipes-support/chrony/chrony/arm_eabi.patch b/meta-networking/recipes-support/chrony/chrony/arm_eabi.patch index 187898a6ef..97b44dc7aa 100644 --- a/meta-networking/recipes-support/chrony/chrony/arm_eabi.patch +++ b/meta-networking/recipes-support/chrony/chrony/arm_eabi.patch @@ -18,45 +18,60 @@ Subject: [PATCH] chrony: fix build failure for arma9 Refresh patch for new upstream version. Signed-off-by: Robert Joslyn + + Refreshed for 4.0 + + Signed-off-by: Khem Raj --- sys_linux.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) -diff --git a/sys_linux.c b/sys_linux.c -index 898dc7a..b268ad1 100644 --- a/sys_linux.c +++ b/sys_linux.c -@@ -479,14 +479,14 @@ SYS_Linux_EnableSystemCallFilter(int level) - const int syscalls[] = { - /* Clock */ - SCMP_SYS(adjtimex), SCMP_SYS(clock_gettime), SCMP_SYS(gettimeofday), -- SCMP_SYS(settimeofday), SCMP_SYS(time), -+ SCMP_SYS(settimeofday), +@@ -499,14 +499,12 @@ SYS_Linux_EnableSystemCallFilter(int lev + #endif + SCMP_SYS(gettimeofday), + SCMP_SYS(settimeofday), +- SCMP_SYS(time), + /* Process */ - SCMP_SYS(clone), SCMP_SYS(exit), SCMP_SYS(exit_group), SCMP_SYS(getpid), -- SCMP_SYS(getrlimit), SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn), -+ SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn), - SCMP_SYS(rt_sigprocmask), SCMP_SYS(set_tid_address), SCMP_SYS(sigreturn), - SCMP_SYS(wait4), SCMP_SYS(waitpid), + SCMP_SYS(clone), + SCMP_SYS(exit), + SCMP_SYS(exit_group), + SCMP_SYS(getpid), +- SCMP_SYS(getrlimit), + SCMP_SYS(getuid), + SCMP_SYS(rt_sigaction), + SCMP_SYS(rt_sigreturn), +@@ -519,7 +517,6 @@ SYS_Linux_EnableSystemCallFilter(int lev /* Memory */ -- SCMP_SYS(brk), SCMP_SYS(madvise), SCMP_SYS(mmap), SCMP_SYS(mmap2), -+ SCMP_SYS(brk), SCMP_SYS(madvise), SCMP_SYS(mmap2), - SCMP_SYS(mprotect), SCMP_SYS(mremap), SCMP_SYS(munmap), SCMP_SYS(shmdt), - /* Filesystem */ - SCMP_SYS(_llseek), SCMP_SYS(access), SCMP_SYS(chmod), SCMP_SYS(chown), -@@ -499,14 +499,22 @@ SYS_Linux_EnableSystemCallFilter(int level) - SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), SCMP_SYS(getsockopt), - SCMP_SYS(recv), SCMP_SYS(recvfrom), SCMP_SYS(recvmmsg), SCMP_SYS(recvmsg), - SCMP_SYS(send), SCMP_SYS(sendmmsg), SCMP_SYS(sendmsg), SCMP_SYS(sendto), + SCMP_SYS(brk), + SCMP_SYS(madvise), +- SCMP_SYS(mmap), + SCMP_SYS(mmap2), + SCMP_SYS(mprotect), + SCMP_SYS(mremap), +@@ -573,8 +570,6 @@ SYS_Linux_EnableSystemCallFilter(int lev + SCMP_SYS(sendmsg), + SCMP_SYS(sendto), + SCMP_SYS(shutdown), - /* TODO: check socketcall arguments */ - SCMP_SYS(socketcall), + /* General I/O */ - SCMP_SYS(_newselect), SCMP_SYS(close), SCMP_SYS(open), SCMP_SYS(openat), SCMP_SYS(pipe), - SCMP_SYS(pipe2), SCMP_SYS(poll), SCMP_SYS(ppoll), SCMP_SYS(pselect6), SCMP_SYS(read), -- SCMP_SYS(futex), SCMP_SYS(select), SCMP_SYS(set_robust_list), SCMP_SYS(write), -+ SCMP_SYS(futex), SCMP_SYS(set_robust_list), SCMP_SYS(write), - /* Miscellaneous */ - SCMP_SYS(getrandom), SCMP_SYS(sysinfo), SCMP_SYS(uname), + SCMP_SYS(_newselect), +@@ -597,7 +592,6 @@ SYS_Linux_EnableSystemCallFilter(int lev + #ifdef __NR_futex_time64 + SCMP_SYS(futex_time64), + #endif +- SCMP_SYS(select), + SCMP_SYS(set_robust_list), + SCMP_SYS(write), + +@@ -605,6 +599,15 @@ SYS_Linux_EnableSystemCallFilter(int lev + SCMP_SYS(getrandom), + SCMP_SYS(sysinfo), + SCMP_SYS(uname), + /* not always available */ +#if ! defined(__ARM_EABI__) + SCMP_SYS(time), @@ -66,10 +81,6 @@ index 898dc7a..b268ad1 100644 + /* TODO: check socketcall arguments */ + SCMP_SYS(socketcall), +#endif -+ }; - - const int socket_domains[] = { --- -2.17.1 + const int socket_domains[] = { diff --git a/meta-networking/recipes-support/chrony/chrony/chronyd b/meta-networking/recipes-support/chrony/chrony/chronyd index 04f1b681c4..8c7c167b3c 100644 --- a/meta-networking/recipes-support/chrony/chrony/chronyd +++ b/meta-networking/recipes-support/chrony/chrony/chronyd @@ -15,7 +15,7 @@ PATH=/sbin:/bin:/usr/bin:/usr/sbin DAEMON=/usr/sbin/chronyd -PIDFILE=/var/run/chronyd.pid +PIDFILE=/run/chrony/chronyd.pid test -x $DAEMON -a -r /etc/chrony.conf || exit 0 diff --git a/meta-networking/recipes-support/chrony/chrony_3.5.bb b/meta-networking/recipes-support/chrony/chrony_3.5.bb deleted file mode 100644 index 182ce13ccf..0000000000 --- a/meta-networking/recipes-support/chrony/chrony_3.5.bb +++ /dev/null @@ -1,139 +0,0 @@ -SUMMARY = "Versatile implementation of the Network Time Protocol" -DESCRIPTION = "Chrony can synchronize the system clock with NTP \ -servers, reference clocks (e.g. GPS receiver), and manual input using \ -wristwatch and keyboard. It can also operate as an NTPv4 (RFC 5905) \ -server and peer to provide a time service to other computers in the \ -network. \ -\ -It is designed to perform well in a wide range of conditions, \ -including intermittent network connections, heavily congested \ -networks, changing temperatures (ordinary computer clocks are \ -sensitive to temperature), and systems that do not run continuously, or \ -run on a virtual machine. \ -\ -Typical accuracy between two machines on a LAN is in tens, or a few \ -hundreds, of microseconds; over the Internet, accuracy is typically \ -within a few milliseconds. With a good hardware reference clock \ -sub-microsecond accuracy is possible. \ -\ -Two programs are included in chrony: chronyd is a daemon that can be \ -started at boot time and chronyc is a command-line interface program \ -which can be used to monitor chronyd's performance and to change \ -various operating parameters whilst it is running. \ -\ -This recipe produces two binary packages: 'chrony' which contains chronyd, \ -the configuration file and the init script, and 'chronyc' which contains \ -the client program only." - -HOMEPAGE = "https://chrony.tuxfamily.org/" -SECTION = "net" -LICENSE = "GPLv2" -LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe" - -SRC_URI = "https://download.tuxfamily.org/chrony/chrony-${PV}.tar.gz \ - file://chrony.conf \ - file://chronyd \ - file://arm_eabi.patch \ - file://CVE-2020-14367.patch \ -" - -SRC_URI_append_libc-musl = " \ - file://0001-Fix-compilation-with-musl.patch \ -" -SRC_URI[md5sum] = "5f66338bc940a9b51eede8f391e7bed3" -SRC_URI[sha256sum] = "4e02795b1260a4ec51e6ace84149036305cc9fc340e65edb9f8452aa611339b5" - -DEPENDS = "pps-tools" - -# Note: Despite being built via './configure; make; make install', -# chrony does not use GNU Autotools. -inherit update-rc.d systemd - -# Configuration options: -# - For command line editing support in chronyc, you may specify either -# 'editline' or 'readline' but not both. editline is smaller, but -# many systems already have readline for other purposes so you might want -# to choose that instead. However, beware license incompatibility -# since chrony is GPLv2 and readline versions after 6.0 are GPLv3+. -# You can of course choose neither, but if you're that tight on space -# consider dropping chronyc entirely (you can use it remotely with -# appropriate chrony.conf options). -# - Security-related: -# - 'sechash' is omitted by default because it pulls in nss which is huge. -# - 'privdrop' allows chronyd to run as non-root; would need changes to -# chrony.conf and init script. -# - 'scfilter' enables support for system call filtering, but requires the -# kernel to have CONFIG_SECCOMP enabled. -PACKAGECONFIG ??= "editline \ - ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \ -" -PACKAGECONFIG[readline] = "--without-editline,--without-readline,readline" -PACKAGECONFIG[editline] = ",--without-editline,libedit" -PACKAGECONFIG[sechash] = "--without-tomcrypt,--disable-sechash,nss" -PACKAGECONFIG[privdrop] = ",--disable-privdrop,libcap" -PACKAGECONFIG[scfilter] = "--enable-scfilter,--without-seccomp,libseccomp" -PACKAGECONFIG[ipv6] = ",--disable-ipv6," -PACKAGECONFIG[nss] = "--with-nss,--without-nss,nss" -PACKAGECONFIG[libcap] = "--with-libcap,--without-libcap,libcap" - -# --disable-static isn't supported by chrony's configure script. -DISABLE_STATIC = "" - -do_configure() { - ./configure --sysconfdir=${sysconfdir} --bindir=${bindir} --sbindir=${sbindir} \ - --localstatedir=${localstatedir} --datarootdir=${datadir} \ - ${PACKAGECONFIG_CONFARGS} -} - -do_install() { - # Binaries - install -d ${D}${bindir} - install -m 0755 ${S}/chronyc ${D}${bindir} - install -d ${D}${sbindir} - install -m 0755 ${S}/chronyd ${D}${sbindir} - - # Config file - install -d ${D}${sysconfdir} - install -m 644 ${WORKDIR}/chrony.conf ${D}${sysconfdir} - - # System V init script - install -d ${D}${sysconfdir}/init.d - install -m 755 ${WORKDIR}/chronyd ${D}${sysconfdir}/init.d - - # systemd unit configuration file - install -d ${D}${systemd_unitdir}/system - install -m 0644 ${S}/examples/chronyd.service ${D}${systemd_unitdir}/system/ - - # Variable data (for drift and/or rtc file) - install -d ${D}${localstatedir}/lib/chrony - - # Log files - install -d ${D}${localstatedir}/log/chrony - - # Fix hard-coded paths in config files and init scripts - sed -i -e 's!/var/!${localstatedir}/!g' -e 's!/etc/!${sysconfdir}/!g' \ - -e 's!/usr/sbin/!${sbindir}/!g' -e 's!/usr/bin/!${bindir}/!g' \ - ${D}${sysconfdir}/chrony.conf \ - ${D}${sysconfdir}/init.d/chronyd \ - ${D}${systemd_unitdir}/system/chronyd.service - sed -i 's!^PATH=.*!PATH=${base_sbindir}:${base_bindir}:${sbindir}:${bindir}!' ${D}${sysconfdir}/init.d/chronyd - sed -i 's!^EnvironmentFile=.*!EnvironmentFile=-${sysconfdir}/default/chronyd!' ${D}${systemd_unitdir}/system/chronyd.service -} - -FILES_${PN} = "${sbindir}/chronyd ${sysconfdir} ${localstatedir}" -CONFFILES_${PN} = "${sysconfdir}/chrony.conf" -INITSCRIPT_NAME = "chronyd" -INITSCRIPT_PARAMS = "defaults" -SYSTEMD_PACKAGES = "${PN}" -SYSTEMD_SERVICE_${PN} = "chronyd.service" - -# It's probably a bad idea to run chrony and another time daemon on -# the same system. systemd includes the SNTP client 'timesyncd', which -# will be disabled by chronyd.service, however it will remain on the rootfs -# wasting 150 kB unless you put 'PACKAGECONFIG_remove_pn-systemd = "timesyncd"' -# in a conf file or bbappend somewhere. -RCONFLICTS_${PN} = "ntp ntimed" - -# Separate the client program into its own package -PACKAGES =+ "chronyc" -FILES_chronyc = "${bindir}/chronyc" diff --git a/meta-networking/recipes-support/chrony/chrony_4.0.bb b/meta-networking/recipes-support/chrony/chrony_4.0.bb new file mode 100644 index 0000000000..c8987013bc --- /dev/null +++ b/meta-networking/recipes-support/chrony/chrony_4.0.bb @@ -0,0 +1,138 @@ +SUMMARY = "Versatile implementation of the Network Time Protocol" +DESCRIPTION = "Chrony can synchronize the system clock with NTP \ +servers, reference clocks (e.g. GPS receiver), and manual input using \ +wristwatch and keyboard. It can also operate as an NTPv4 (RFC 5905) \ +server and peer to provide a time service to other computers in the \ +network. \ +\ +It is designed to perform well in a wide range of conditions, \ +including intermittent network connections, heavily congested \ +networks, changing temperatures (ordinary computer clocks are \ +sensitive to temperature), and systems that do not run continuously, or \ +run on a virtual machine. \ +\ +Typical accuracy between two machines on a LAN is in tens, or a few \ +hundreds, of microseconds; over the Internet, accuracy is typically \ +within a few milliseconds. With a good hardware reference clock \ +sub-microsecond accuracy is possible. \ +\ +Two programs are included in chrony: chronyd is a daemon that can be \ +started at boot time and chronyc is a command-line interface program \ +which can be used to monitor chronyd's performance and to change \ +various operating parameters whilst it is running. \ +\ +This recipe produces two binary packages: 'chrony' which contains chronyd, \ +the configuration file and the init script, and 'chronyc' which contains \ +the client program only." + +HOMEPAGE = "https://chrony.tuxfamily.org/" +SECTION = "net" +LICENSE = "GPLv2" +LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe" + +SRC_URI = "https://download.tuxfamily.org/chrony/chrony-${PV}.tar.gz \ + file://chrony.conf \ + file://chronyd \ + file://arm_eabi.patch \ +" + +SRC_URI_append_libc-musl = " \ + file://0001-Fix-compilation-with-musl.patch \ +" +SRC_URI[sha256sum] = "be27ea14c55e7a4434b2fa51d53018c7051c42fa6a3198c9aa6a1658bae0c625" + +DEPENDS = "pps-tools" + +# Note: Despite being built via './configure; make; make install', +# chrony does not use GNU Autotools. +inherit update-rc.d systemd + +# Configuration options: +# - For command line editing support in chronyc, you may specify either +# 'editline' or 'readline' but not both. editline is smaller, but +# many systems already have readline for other purposes so you might want +# to choose that instead. However, beware license incompatibility +# since chrony is GPLv2 and readline versions after 6.0 are GPLv3+. +# You can of course choose neither, but if you're that tight on space +# consider dropping chronyc entirely (you can use it remotely with +# appropriate chrony.conf options). +# - Security-related: +# - 'sechash' is omitted by default because it pulls in nss which is huge. +# - 'privdrop' allows chronyd to run as non-root; would need changes to +# chrony.conf and init script. +# - 'scfilter' enables support for system call filtering, but requires the +# kernel to have CONFIG_SECCOMP enabled. +PACKAGECONFIG ??= "editline \ + ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \ +" +PACKAGECONFIG[readline] = "--without-editline,--without-readline,readline" +PACKAGECONFIG[editline] = ",--without-editline,libedit" +PACKAGECONFIG[sechash] = "--without-tomcrypt,--disable-sechash,nss" +PACKAGECONFIG[privdrop] = ",--disable-privdrop,libcap" +PACKAGECONFIG[scfilter] = "--enable-scfilter,--without-seccomp,libseccomp" +PACKAGECONFIG[ipv6] = ",--disable-ipv6," +PACKAGECONFIG[nss] = "--with-nss,--without-nss,nss" +PACKAGECONFIG[libcap] = "--with-libcap,--without-libcap,libcap" + +# --disable-static isn't supported by chrony's configure script. +DISABLE_STATIC = "" + +do_configure() { + ./configure --sysconfdir=${sysconfdir} --bindir=${bindir} --sbindir=${sbindir} \ + --localstatedir=${localstatedir} --datarootdir=${datadir} \ + --with-ntp-era=$(shell date -d '1970-01-01 00:00:00+00:00' +'%s') \ + --with-pidfile=/run/chrony/chronyd.pid \ + --chronyrundir=/run/chrony \ + --host-system=Linux \ + ${PACKAGECONFIG_CONFARGS} +} + +do_install() { + # Binaries + install -d ${D}${bindir} + install -m 0755 ${S}/chronyc ${D}${bindir} + install -d ${D}${sbindir} + install -m 0755 ${S}/chronyd ${D}${sbindir} + + # Config file + install -d ${D}${sysconfdir} + install -m 644 ${WORKDIR}/chrony.conf ${D}${sysconfdir} + + # System V init script + install -d ${D}${sysconfdir}/init.d + install -m 755 ${WORKDIR}/chronyd ${D}${sysconfdir}/init.d + + # systemd unit configuration file + install -d ${D}${systemd_unitdir}/system + install -m 0644 ${S}/examples/chronyd.service ${D}${systemd_unitdir}/system/ + + # Variable data (for drift and/or rtc file) + install -d ${D}${localstatedir}/lib/chrony + + # Fix hard-coded paths in config files and init scripts + sed -i -e 's!/var/!${localstatedir}/!g' -e 's!/etc/!${sysconfdir}/!g' \ + -e 's!/usr/sbin/!${sbindir}/!g' -e 's!/usr/bin/!${bindir}/!g' \ + ${D}${sysconfdir}/chrony.conf \ + ${D}${sysconfdir}/init.d/chronyd \ + ${D}${systemd_unitdir}/system/chronyd.service + sed -i 's!^PATH=.*!PATH=${base_sbindir}:${base_bindir}:${sbindir}:${bindir}!' ${D}${sysconfdir}/init.d/chronyd + sed -i 's!^EnvironmentFile=.*!EnvironmentFile=-${sysconfdir}/default/chronyd!' ${D}${systemd_unitdir}/system/chronyd.service +} + +FILES_${PN} = "${sbindir}/chronyd ${sysconfdir} ${localstatedir}/lib/chrony ${localstatedir}" +CONFFILES_${PN} = "${sysconfdir}/chrony.conf" +INITSCRIPT_NAME = "chronyd" +INITSCRIPT_PARAMS = "defaults" +SYSTEMD_PACKAGES = "${PN}" +SYSTEMD_SERVICE_${PN} = "chronyd.service" + +# It's probably a bad idea to run chrony and another time daemon on +# the same system. systemd includes the SNTP client 'timesyncd', which +# will be disabled by chronyd.service, however it will remain on the rootfs +# wasting 150 kB unless you put 'PACKAGECONFIG_remove_pn-systemd = "timesyncd"' +# in a conf file or bbappend somewhere. +RCONFLICTS_${PN} = "ntp ntimed" + +# Separate the client program into its own package +PACKAGES =+ "chronyc" +FILES_chronyc = "${bindir}/chronyc" -- cgit 1.2.3-korg