Bug 2135578 - Threat model finding: running chrony as non root user.
Summary: Threat model finding: running chrony as non root user.
Keywords:
Status: ASSIGNED
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: chrony
Version: 9.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Lichvar
QA Contact: rhel-cs-infra-services-qe
URL:
Whiteboard:
Depends On: 2231078
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-10-18 03:03 UTC by Wade Mealing
Modified: 2023-08-15 07:12 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-136794 0 None None None 2022-10-18 03:13:41 UTC

Comment 1 Miroslav Lichvar 2023-01-12 15:33:47 UTC
The upstream repository now includes chronyd-restricted.service, which starts chronyd without root and can be used with minimal NTP/NTS configurations. It will be included in our package, but probably not enabled by default as that would break more advanced configurations.

I also looked into a possibility of using a generator to switch between these two or possibly more different services according to the chrony configuration, but there seems to be a major usability issue that the generators run only on boot and systemctl daemon-reload, which would cause problems when the configuration is modified and the service restarted restarted without reboot or the systemd reload.

Comment 2 Miroslav Lichvar 2023-08-10 13:50:02 UTC
This issue will be fixed with rebase to chrony-4.4 (bug #2231078), which will add the chronyd-restricted service as an alternative to the less restricted chronyd.service.


Note You need to log in before you can comment on or make changes to this bug.