* bug#24366: ntpd cannot write to its drift file.
@ 2016-09-04 17:45 John Darrington
2016-09-04 20:22 ` Leo Famulari
0 siblings, 1 reply; 7+ messages in thread
From: John Darrington @ 2016-09-04 17:45 UTC (permalink / raw)
To: 24366
[-- Attachment #1: Type: text/plain, Size: 412 bytes --]
Running the ntpd service I see lots of messages in /var/log/messages like:
Sep 4 13:02:21 localhost ntpd[302]: frequency file /var/run/ntp.drift.TEMP: Permission denied
J'
--
Avoid eavesdropping. Send strong encryted email.
PGP Public key ID: 1024D/2DE827B3
fingerprint = 8797 A26D 0854 2EAB 0285 A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#24366: ntpd cannot write to its drift file.
2016-09-04 17:45 bug#24366: ntpd cannot write to its drift file John Darrington
@ 2016-09-04 20:22 ` Leo Famulari
2016-09-04 20:24 ` John Darrington
0 siblings, 1 reply; 7+ messages in thread
From: Leo Famulari @ 2016-09-04 20:22 UTC (permalink / raw)
To: John Darrington; +Cc: 24366
[-- Attachment #1: Type: text/plain, Size: 363 bytes --]
On Sun, Sep 04, 2016 at 07:45:47PM +0200, John Darrington wrote:
> Running the ntpd service I see lots of messages in /var/log/messages like:
>
> Sep 4 13:02:21 localhost ntpd[302]: frequency file /var/run/ntp.drift.TEMP: Permission denied
Can the user that runs ntpd write to that directory?
Is there a build time configuration that we should tweak?
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#24366: ntpd cannot write to its drift file.
2016-09-04 20:22 ` Leo Famulari
@ 2016-09-04 20:24 ` John Darrington
2016-09-04 20:43 ` Leo Famulari
0 siblings, 1 reply; 7+ messages in thread
From: John Darrington @ 2016-09-04 20:24 UTC (permalink / raw)
To: Leo Famulari; +Cc: 24366, John Darrington
[-- Attachment #1: Type: text/plain, Size: 793 bytes --]
On Sun, Sep 04, 2016 at 04:22:09PM -0400, Leo Famulari wrote:
On Sun, Sep 04, 2016 at 07:45:47PM +0200, John Darrington wrote:
> Running the ntpd service I see lots of messages in /var/log/messages like:
>
> Sep 4 13:02:21 localhost ntpd[302]: frequency file /var/run/ntp.drift.TEMP: Permission denied
Can the user that runs ntpd write to that directory?
No. ntpd runs as its own user. /var/run is owned by root.
Is there a build time configuration that we should tweak?
Not that I'm aware of.
J'
--
Avoid eavesdropping. Send strong encryted email.
PGP Public key ID: 1024D/2DE827B3
fingerprint = 8797 A26D 0854 2EAB 0285 A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#24366: ntpd cannot write to its drift file.
2016-09-04 20:24 ` John Darrington
@ 2016-09-04 20:43 ` Leo Famulari
2016-09-04 21:12 ` John Darrington
2016-09-06 19:05 ` bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for " John Darrington
0 siblings, 2 replies; 7+ messages in thread
From: Leo Famulari @ 2016-09-04 20:43 UTC (permalink / raw)
To: John Darrington; +Cc: 24366
[-- Attachment #1: Type: text/plain, Size: 695 bytes --]
On Sun, Sep 04, 2016 at 10:24:54PM +0200, John Darrington wrote:
> On Sun, Sep 04, 2016 at 04:22:09PM -0400, Leo Famulari wrote:
> On Sun, Sep 04, 2016 at 07:45:47PM +0200, John Darrington wrote:
> > Running the ntpd service I see lots of messages in /var/log/messages like:
> >
> > Sep 4 13:02:21 localhost ntpd[302]: frequency file /var/run/ntp.drift.TEMP: Permission denied
>
> Can the user that runs ntpd write to that directory?
>
> No. ntpd runs as its own user. /var/run is owned by root.
>
> Is there a build time configuration that we should tweak?
>
> Not that I'm aware of.
Hm, how do other distros avoid this problem?
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#24366: ntpd cannot write to its drift file.
2016-09-04 20:43 ` Leo Famulari
@ 2016-09-04 21:12 ` John Darrington
2016-09-06 19:05 ` bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for " John Darrington
1 sibling, 0 replies; 7+ messages in thread
From: John Darrington @ 2016-09-04 21:12 UTC (permalink / raw)
To: Leo Famulari; +Cc: 24366, John Darrington
[-- Attachment #1: Type: text/plain, Size: 1163 bytes --]
On Sun, Sep 04, 2016 at 04:43:53PM -0400, Leo Famulari wrote:
On Sun, Sep 04, 2016 at 10:24:54PM +0200, John Darrington wrote:
> On Sun, Sep 04, 2016 at 04:22:09PM -0400, Leo Famulari wrote:
> On Sun, Sep 04, 2016 at 07:45:47PM +0200, John Darrington wrote:
> > Running the ntpd service I see lots of messages in /var/log/messages like:
> >
> > Sep 4 13:02:21 localhost ntpd[302]: frequency file /var/run/ntp.drift.TEMP: Permission denied
>
> Can the user that runs ntpd write to that directory?
>
> No. ntpd runs as its own user. /var/run is owned by root.
>
> Is there a build time configuration that we should tweak?
>
> Not that I'm aware of.
Hm, how do other distros avoid this problem?
Well the obvious way would be to use a directory which is owned by the ntpd user.
J'
--
Avoid eavesdropping. Send strong encryted email.
PGP Public key ID: 1024D/2DE827B3
fingerprint = 8797 A26D 0854 2EAB 0285 A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for drift file.
2016-09-04 20:43 ` Leo Famulari
2016-09-04 21:12 ` John Darrington
@ 2016-09-06 19:05 ` John Darrington
2016-09-09 14:26 ` Ludovic Courtès
1 sibling, 1 reply; 7+ messages in thread
From: John Darrington @ 2016-09-06 19:05 UTC (permalink / raw)
To: 24366; +Cc: John Darrington
I think this fixes the problem. What do you think?
* gnu/services/networking.scm (ntp-shepherd-service): Create new
directory at startup.
---
gnu/services/networking.scm | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 71f49a0..714dc80 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -271,8 +271,11 @@ Protocol (DHCP) client, on all the non-loopback network interfaces."
(($ <ntp-configuration> ntp servers)
(let ()
;; TODO: Add authentication support.
+ (define %user
+ (getpw "ntpd"))
+
(define config
- (string-append "driftfile /var/run/ntp.drift\n"
+ (string-append "driftfile /var/run/ntpd/ntp.drift\n"
(string-join (map (cut string-append "server " <>)
servers)
"\n")
@@ -294,6 +297,8 @@ restrict -6 ::1\n"))
(documentation "Run the Network Time Protocol (NTP) daemon.")
(requirement '(user-processes networking))
(start #~(make-forkexec-constructor
+ (mkdir-p "/var/run/ntpd")
+ (chown "/var/run/nptd" (passwd:uid %user) (passwd:gid %user))
(list (string-append #$ntp "/bin/ntpd") "-n"
"-c" #$ntpd.conf "-u" "ntpd")))
(stop #~(make-kill-destructor))))))))
--
2.1.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for drift file.
2016-09-06 19:05 ` bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for " John Darrington
@ 2016-09-09 14:26 ` Ludovic Courtès
0 siblings, 0 replies; 7+ messages in thread
From: Ludovic Courtès @ 2016-09-09 14:26 UTC (permalink / raw)
To: John Darrington; +Cc: 24366-done
Fixed in 1c6c0ad067b558fcbebd87e8cb51d342d808163e.
Ludo’.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-09-09 14:28 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-04 17:45 bug#24366: ntpd cannot write to its drift file John Darrington
2016-09-04 20:22 ` Leo Famulari
2016-09-04 20:24 ` John Darrington
2016-09-04 20:43 ` Leo Famulari
2016-09-04 21:12 ` John Darrington
2016-09-06 19:05 ` bug#24366: [PATCH] gnu: Use a directory owned by ntpd user for " John Darrington
2016-09-09 14:26 ` Ludovic Courtès
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).