Commit Graph

47 Commits

Author SHA1 Message Date
Fabrice Fontaine
251c5f3398 package/chrony: bump to version 4.1
Drop patch (already in version)

https://git.tuxfamily.org/chrony/chrony.git/tree/NEWS?id=4.1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-12-12 16:50:12 +01:00
Fabrice Fontaine
6d4c9437c6 package/chrony: add SELinux module
Support for chrony is added by the services/chronyd module in the
SELinux refpolicy.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-21 23:47:19 +02:00
James Hilliard
c2db53caca package/{chrony, ntp, openntpd}: turn off DNSSEC validation
We have a chicken and egg problem: validation of DNSSEC signatures
doesn't work without a correct clock, but to set the correct clock we
need to contact NTP servers which requires resolving a hostname, which
would normally require DNSSEC validation.

Let's break the cycle by excluding NTP hostname resolution from
validation for now.

Details:
abf4e5c1d3

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-16 22:58:08 +02:00
Fabrice Fontaine
7a7cb59ced package/chrony: add CHRONY_CPE_ID_VENDOR
cpe:2.3🅰️tuxfamily:chrony is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atuxfamily%3Achrony

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-06-05 21:38:20 +02:00
Baruch Siach
70e0546a4e package/chrony: fix build with kernel headers older than 3.15
Add a patch to make renameat2 system call reference conditional.

Fixes:
http://autobuild.buildroot.net/results/bb6/bb638ed011aea379c7f780187dafe2615753e2ae/
http://autobuild.buildroot.net/results/5ef/5ef11bace60950b35b4a593d734a20df088c79aa/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-29 09:28:05 +01:00
Mark Corbin
37f24f5580 package/chrony: bump to version 4.0
Update chrony to version 4.0 and add/remove configuration of
features as necessary.

Remove support for readline. Add support for nettle and
gnutls (required for NTS support). Add pkg-config support (for
nss, nettle and gnutls).

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-01-19 21:56:41 +01:00
Peter Korsgaard
15484553f3 package/chrony: security bump to version 3.5.1
Fixes the following security issues:

CVE-2020-14367: Insecure writing of pidfile
-------------------------------------------

When chronyd is configured to save the pidfile in a directory where the
chrony user has write permissions (e.g. /var/run/chrony - the default
since chrony-3.4), an attacker that compromised the chrony user account
could create a symbolic link at the location of the pidfile to make
chronyd starting with root privileges follow the symlink and write its
process ID to a file for which the chrony user doesn't have write
permissions, causing a denial of service, or data loss.

This issue was reported by Matthias Gerstner of SUSE.

For further details, see the oss-security posting:
https://www.openwall.com/lists/oss-security/2020/08/21/1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-08-23 15:30:55 +02:00
Jérémy Rosen
3e092163e5 package: rely on systemctl preset-all for buildroot-provided services
All the packages in this list have the following properties
* units are provided by buildroot in the package directory
* the SYSTEMD_INSTALL_INIT_HOOK is exactly equivalent to what the
  [Install] section of the unit does

The fix removes the soflinking in the .mk file

Signed-off-by: Jérémy Rosen <jeremy.rosen@smile.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2019-12-18 18:27:41 +01:00
Peter Korsgaard
baadfbcc02 package/chrony: use libedit for command line editing
chrony is licensed under GPL-2.0, which is not license compatible with
readline (GPL-3.0+), so remove the optional readline handling and replace
with libedit instead.

While we are at it, also explicitly disable the libedit backend when not
available.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2019-11-13 21:10:12 +01:00
Robert Hancock
4cef093f66 package/chrony: add option for debug logging
Add a BR2_PACKAGE_CHRONY_DEBUG_LOGGING config option to allow enabling
compiled-in support for debug logging in Chrony.

Signed-off-by: Robert Hancock <hancock@sedsystems.ca>
[Arnout: don't enable by default]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-10-27 21:51:02 +01:00
Fabrice Fontaine
ebbfb5e55e package/chrony: drop musl patch
This patch is not needed as musl defines SCM_TIMESTAMPING_PKTINFO since
version 1.1.19 and
https://git.musl-libc.org/cgit/musl/commit/?id=c35a8bf456ca6ef74e3cc7c4d8f63572bc1e1167

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-15 09:19:43 +02:00
Fabrice Fontaine
d063e00ea8 package/chrony: bump to version 3.5
Remove second patch (already in version)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-15 09:19:38 +02:00
Matt Weber
590e9e05b6 packages: update sysv S* scripts to 644
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-02-08 11:35:22 +01:00
Giulio Benetti
67f3d9bdfa chrony: fix build failure due to missing inclusion of util.h
During build package stops with linker error:
hash_intmd5.o: In function `HSH_Hash':
hash_intmd5.c:(.text+0x963): undefined reference to `MIN'

This is due to missing util.h inclusion.
util.h contains MIN() macro definition.

Add upstream patch:
https://git.tuxfamily.org/chrony/chrony.git/commit/?id=948ecf84314f78da82e0e2b07b6570ca9cff86c8
to add #include "util.h" in hash_intmd5.c

Fixes:
http://autobuild.buildroot.net/results/8f0/8f0d53b1d5a899e56540c859b908cbc1eaa223d5/
http://autobuild.buildroot.net/results/3c6/3c609f94aff182c9ab47ef8ec4b9de03a4d20ffb/
http://autobuild.buildroot.net/results/f1f/f1fcae399fb640c19cf88c9333a92cbfab547932/

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-09-27 13:57:34 +02:00
Ferdinand van Aartsen
3d5675d480 chrony: bump to version 3.4
Patch 0002-util-fall-back-to-reading-dev-urandom-when-getrandom.patch
was applied upstream in this version, so it can be deleted.

Signed-off-by: Ferdinand van Aartsen <ferdinand@ombud.nl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-09-23 17:10:17 +02:00
Peter Korsgaard
d9937b62e0 chrony: backport upstream patch to fix blocking on getrandom() at startup with recent kernels
chrony calls getrandom() at startup if available, so it needs a workaround
for the blocking behaviour on recent (4.14.39+), similar to what was done
for util-linux in commit c4d86707cd (util-linux: add two upstream patches
to fix blocking on getrandom() with recent kernels).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-08-09 22:11:39 +02:00
Peter Korsgaard
424db89a26 chrony: S49chrony: drop /etc/chrony.conf check
With CHRONY_ARGS in /etc/default/chrony, chrony may asked to use an
alternative configuration file (with the -f option), so drop the explicit
/etc/chrony.conf check.

In case the configuration file isn't present chrony will anyway loudly
complain which is preferable to this silent failure:

chronyd -f /non/existing/file.conf
Could not open configuration file /non/existing/file.conf : No such file or directory

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-05-28 20:20:59 +02:00
Peter Korsgaard
9977053659 chrony: S49chrony: support a defaults file
For specifying custom options to chrony.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-05-28 20:20:46 +02:00
Baruch Siach
b6f7e4de52 chrony: fix build with musl
The SCM_TIMESTAMPING_PKTINFO macro is missing from the socket.h header
that musl libc provides as of version 1.1.16 that we currently use in
Buildroot. Patch the code to add this macro locally until we update
musl.

Fixes:
http://autobuild.buildroot.net/results/aab/aab3210d6d0c60fb07415d9bbdb09f2d4091446c/
http://autobuild.buildroot.net/results/fc8/fc8440db025f51c176240ca127bc68a367add21c/

Cc: Nathan Lynch <ntl@pobox.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-11-15 23:11:16 +01:00
Peter Korsgaard
8fca8c1551 chrony: bump version to 3.2
Also add a hash for the license file while we're at it.

[Peter: use tuxfamily.org URL for annoucement]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-09-20 19:33:01 +02:00
Peter Korsgaard
883eb058af chrony: add optional seccomp support
seccomp support has been available since chrony-2.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-09-20 19:31:17 +02:00
Rahul Bedarkar
af31c309e7 boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+
We want to use SPDX identifier for license strings as much as possible.
SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+.

This change is done by using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g'

Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-04-01 15:16:38 +02:00
Bernd Kuhls
d93676d2f0 package/chrony: bump version to 3.1
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-05 12:09:59 +01:00
Peter Korsgaard
43cf567710 chrony: bump version to 2.4.1
Fixes a crash issue with smoothtime directive.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-12-05 21:29:01 +01:00
James Knight
40a60b7545 chrony: enable pps support
Chrony has the ability to support PPS. Its enablement is determined
primarily from the existence of `sys/timepps.h`. This file is provided
from the pps-tools package. Adjusting Chrony's Makefile to depend on the
pps-tools package if a developer has included pps-tools as part of a
build. Relates to 2cfc966f43.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-11-26 14:59:36 +01:00
Christian Stewart
7ce32aa271 package/chrony: fix systemd service
Fixes the systemd service, the binary is located at /usr/sbin not
/usr/bin.

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-07-15 13:00:56 +02:00
Peter Korsgaard
f2bb4233fa chrony: bump to version 2.4
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-06-07 21:29:51 +02:00
Peter Korsgaard
dc208df5b9 chrony: bump version
From the release notes:

Enhancements
------------
* Add support for NTP and command response rate limiting
* Add support for dropping root privileges on Mac OS X, FreeBSD, Solaris
* Add require and trust options for source selection
* Enable logchange by default (1 second threshold)
* Set RTC on Mac OS X with rtcsync directive
* Allow binding to NTP port after dropping root privileges on NetBSD
* Drop CAP_NET_BIND_SERVICE capability on Linux when NTP port is disabled
* Resolve names in separate process when seccomp filter is enabled
* Replace old records in client log when memory limit is reached
* Don't reveal local time and synchronisation state in client packets
* Don't keep client sockets open for longer than necessary
* Ignore poll in KoD RATE packets as ntpd doesn't always set it correctly
* Warn when using keys shorter than 80 bits
* Add keygen command to generate random keys easily
* Add serverstats command to report NTP and command packet statistics

Bug fixes
---------
* Fix clock correction after making step on Mac OS X
* Fix building on Solaris

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-04-28 14:12:21 +02:00
Bernd Kuhls
e0b2041d44 package/chrony: add optional support for libcap
When libcap was compiled before, chrony will use it as optional
dependency:

$ output/host/usr/bin/x86_64-linux-readelf -a output/target/usr/sbin/chronyd | grep NEEDED
 0x0000000000000001 (NEEDED)             Shared library: [libm.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libcap.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.1]

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-02-21 16:06:32 +01:00
James Knight
1b6e76a3a1 chrony: security bump to version 2.2.1
Fixes:

CVE-2016-1567: Impersonation between authenticated peers.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-02-11 23:16:16 +01:00
James Knight
6cf1554e71 chrony: bump to version 2.2
With the new version, documentation is not generated part of the main
build. This removes the need to alter the Makefile to remove the invoke
on the `chrony.txt` target. Cleanup also explicitly disabling seccomp
(since its experimental) and tomcrypt (Buildroot does not have
libtomcrypt at this time).

[Thomas: use tabs for indentation in the definition of
CHRONY_CONF_OPTS.]

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-11-19 22:14:56 +01:00
Maxime Hadjinlian
0f75b2635e package: Replace 'echo -n' by 'printf'
'echo -n' is not a POSIX construct (no flag support), we shoud use
'printf', especially in init script.

This patch was generated by the following command line:
git grep -l 'echo -n' -- `git ls-files | grep -v 'patch'` | xargs sed -i 's/echo -n/printf/'

Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-10-04 00:56:41 +02:00
Peter Korsgaard
85467bb616 chrony: S49chrony: fix starting message
Purely cosmetical. The OK/FAIL should go on the same line as "Starting ..".

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-09-24 20:50:00 +02:00
Maxime Hadjinlian
03663adb82 package: Fix source path for systemd's service
Otherwise the link would appear broken in output/target it's not that
big a deal but at least it's coherent with what we already have.

Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-13 22:27:39 +02:00
Alex Suykov
c6946f24cc chrony: systemd support
systemd has its own NTP daemon, which must be disabled before
starting chrony. Possible (but unlikely) conflict with openntpd
is not marked in either package.

Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-13 18:08:26 +02:00
Gustavo Zacarias
79ce08bbdc packages: remove non-IPv6 dependencies and tweaks
Now that IPv6 is mandatory remove package dependencies and conditionals
for it.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-04-22 23:06:35 +02:00
Peter Korsgaard
08b1c66517 chrony: bump version
And add hash file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-12-29 15:55:17 +01:00
Thomas De Schampheleire
aaffd209fa packages: rename FOO_CONF_OPT into FOO_CONF_OPTS
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.

Sed command used:
   find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'

Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-10-04 18:54:16 +02:00
Gustavo Zacarias
2dbdd7c1df chrony: disable docs build
Needs makeinfo and we don't care about docs. Fixes:
http://autobuild.buildroot.net/results/fd0/fd03a86ed670c765d9f0a1ed6cc913079e030fc9/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-09-01 22:11:35 +02:00
Peter Korsgaard
21a85fd02a chrony: bump version
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-08-12 23:52:36 +02:00
Peter Korsgaard
d016a6a30d chrony: add sysv initscript
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-08-12 18:02:46 +02:00
Jerzy Grzegorek
c7f4b96471 package: remove the trailing slash sign from <PKG>_SITE variable
Since the trailing slash is stripped from $($(PKG)_SITE) by pkg-generic.mk:

$(call DOWNLOAD,$($(PKG)_SITE:/=)/$($(PKG)_SOURCE))

so it is redundant.
This patch removes it from $(PKG)_SITE variable for BR consistency.

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2014-07-31 23:17:46 +02:00
Peter Korsgaard
f68c4ab872 chrony: bump version
Fixes CVE-2014-0021: Amplification in chrony control protocol

In the chrony control protocol some replies are significantly larger than
their requests, which allows an attacker to use it in an amplification
attack.  With hosts allowed by cmdallow (only localhost by default) the
maximum amplification factor is 9.2.  Hosts that are not allowed receive a
small reply with error status, which allows amplification of up to 1.5.

To fix the problem, the protocol has been modified to require padding in the
request packet, so replies are never larger than their requests.  Also,
chronyd no longer sends replies with error status to hosts that are not
allowed by cmdallow.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2014-03-11 16:46:42 +01:00
Thomas De Schampheleire
eb7bd9ef61 packages: remove uninstall commands
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-12-06 09:40:40 +01:00
Jerzy Grzegorek
cbcbed4a24 chrony: bump to version 1.29
Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2013-10-10 23:01:03 +02:00
Alexandre Belloni
8dfd59d114 Normalize separator size to 80
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-06-06 22:30:24 +02:00
Nathan Lynch
f183c7362c chrony: new package
Signed-off-by: Nathan Lynch <ntl@pobox.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
2013-05-07 23:04:08 +02:00