Bug 117894

Summary:	/etc/init.d/ntpd should call ntpdate with -U ntp
Product:	Red Hat Enterprise Linux 3	Reporter:	Jordan Russell <jr-redhatbugs2>
Component:	ntp	Assignee:	Miroslav Lichvar <mlichvar>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	low
Version:	3.0
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:	RHBA-2007-0414	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-06-11 18:51:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jordan Russell 2004-03-09 19:21:39 UTC

Description of problem:
/etc/init.d/ntpd calls ntpdate as follows:

  /usr/sbin/ntpdate -s -b -p 8 $tickers

It's missing "-U ntp", so ntpdate ends up running with root 
privileges. Running network programs with root privileges when they 
aren't needed of course isn't good for security.

Version-Release number of selected component (if applicable):
ntp-4.1.2-4

How reproducible:
Always

Steps to Reproduce:
n/a

Actual Results:  ntpdate runs as 'root'

Expected Results:  ntpdate runs as 'ntp'

Additional info:

ntpd is run with "-U ntp" (see /etc/sysconfig/ntpd) so this issue is 
specific to the ntpdate call.

Comment 1 Harald Hoyer 2004-03-10 08:36:53 UTC

ntpdate has not been patched to drop root privileges, yet...

Comment 2 Jordan Russell 2004-03-10 08:45:10 UTC

Hmm?

I can run "ntpdate -U ntp ..." by hand and it works.

Also "man ntpdate" mentions the -U option.

Comment 3 Harald Hoyer 2004-03-10 08:55:52 UTC

oops... forgot about that :) ... ok, then you are right :)

Comment 7 Lubomir Kundrak 2007-02-13 17:07:28 UTC

Removing Security keyword, because there's no known exploit vector.

Comment 12 Red Hat Bugzilla 2007-06-11 18:51:43 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2007-0414.html