Re: [Devil-linux-develop] NTPD chroot

[Zsiros Z. <zs...@ma...>]

2005-02-02, sze keltezéssel 19:06-kor Heiko Zuerker ezt írta:
> Hey,
> 
> > I'm  trying to create an NTPD jail config, but the included ntpd in DL
> > 1.2.2 doesn't support chrooting.
> > Does anybody know where can I find a more-or-less (preferably more :-)
> > official chroot patch for ntpd-4.2.0?
> >
> > I tried to search it on google, but it was unsuccessfull...
> > What patch source can accept the main development team?
> 
> For cases like this we have the 'compartment' tool included, which takes
> care of chroot, setting capabilities and stuff like that.
> Take a look at what I did for Lotus Notes. Take a look at those files:
> /etc/sysconfig/jail/DOMINO
> /etc/init.d/domino

I found this utility and I'm using it for Postfix but the compiled ntpd
binary in DL does not support chrooting. The ntpd in DL produces the
following "help":

root@devil:~ # ntpd -h
ntpd: unknown option -h
usage: ntpd [ -abdgmnqx ] [ -c config_file ] [ -e e_delay ]
                [ -f freq_file ] [ -k key_file ] [ -l log_file ]
                [ -p pid_file ] [ -r broad_delay ] [ -s statdir ]
                [ -t trust_key ] [ -v sys_var ] [ -V default_sysvar ]
                [ -P fixed_process_priority ]

But in my old RH9:

[root@ubul ~]# ntpd -h
ntpd: unknown option -h
usage: ntpd [ -abdgmnqx ] [ -c config_file ] [ -e e_delay ]
                [ -f freq_file ] [ -k key_file ] [ -l log_file ]
                [ -p pid_file ] [ -r broad_delay ] [ -s statdir ]
                [ -t trust_key ] [ -v sys_var ] [ -V default_sysvar ]
                [ -T chroot_dir ] [ -U server_user ]
                [ -P fixed_process_priority ]

There is the -T to chroot ntpd and -U option to drop root privileges
after starting.

On next link I found that the 4.2.0 version does not support chrooting:
http://lists.ntp.isc.org/pipermail/questions/2004-February/003323.html

I'm a bit confused because I'm not sure about this chroot patch, is it
required to use ntp with compartment?

Zsolt