Bug 1122012 - SHM refclock allows only two units with owner-only access
Summary: SHM refclock allows only two units with owner-only access
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ntp
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Lichvar
QA Contact: Jakub Prokes
Depends On:
Blocks: 1191019 1122015
TreeView+ depends on / blocked
Reported: 2014-07-22 11:07 UTC by Miroslav Lichvar
Modified: 2015-11-19 08:37 UTC (History)
4 users (show)

Fixed In Version: ntp-4.2.6p5-20.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1122015 (view as bug list)
Last Closed: 2015-11-19 08:37:30 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Network Time Protocol 2627 0 None None None Never
Red Hat Product Errata RHSA-2015:2231 0 normal SHIPPED_LIVE Moderate: ntp security, bug fix, and enhancement update 2015-11-19 09:03:04 UTC

Description Miroslav Lichvar 2014-07-22 11:07:33 UTC
Description of problem:
Currently, the permissions of the shared memory segment created by the SHM refclock are set from the unit number. Units 0 and 1 are created with owner-only access, units 2 and above have world access. This is a problem in applications where more units than two are needed and world access would be a security problem.

Upstream bug report with a patch:

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. add "server" to ntp.conf
2. restart ntpd
3. run ipcs
4. check permission of the memory segment with key 0x4e545032

Actual results:

Expected results:

Additional info:

Comment 6 errata-xmlrpc 2015-11-19 08:37:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.