From 1a5fdc7d595448c42381602f5934c6053c86ccd8 Mon Sep 17 00:00:00 2001 From: Gorden Mende Date: Wed, 1 Dec 2021 13:23:48 +0100 Subject: [PATCH] committing changes in /etc made by "apt install ntp" Packages with configuration changes: +ntp 1:4.2.8p15+dfsg-1 armhf Package changes: +libevent-core-2.1-7 2.1.12-stable-1 armhf +libevent-pthreads-2.1-7 2.1.12-stable-1 armhf +libopts25 1:5.18.16-4 armhf +ntp 1:4.2.8p15+dfsg-1 armhf +sntp 1:4.2.8p15+dfsg-1 armhf --- .etckeeper | 15 ++++ NetworkManager/dispatcher.d/ntp | 12 +++ apparmor.d/local/usr.sbin.ntpd | 0 apparmor.d/tunables/ntpd | 15 ++++ apparmor.d/usr.sbin.ntpd | 86 +++++++++++++++++++ .../network-interface-security/usr.sbin.ntpd | 1 + cron.daily/ntp | 39 +++++++++ default/ntp | 1 + dhcp/dhclient-exit-hooks.d/ntp | 64 ++++++++++++++ group | 1 + group- | 1 + gshadow | 1 + gshadow- | 1 + init.d/ntp | 72 ++++++++++++++++ ntp.conf | 60 +++++++++++++ passwd | 1 + passwd- | 2 + rc2.d/S01ntp | 1 + rc3.d/S01ntp | 1 + rc4.d/S01ntp | 1 + rc5.d/S01ntp | 1 + .../multi-user.target.wants/ntp.service | 1 + systemd/system/systemd-timesyncd.service | 1 + 23 files changed, 378 insertions(+) create mode 100755 NetworkManager/dispatcher.d/ntp create mode 100644 apparmor.d/local/usr.sbin.ntpd create mode 100644 apparmor.d/tunables/ntpd create mode 100644 apparmor.d/usr.sbin.ntpd create mode 120000 apparmor/init/network-interface-security/usr.sbin.ntpd create mode 100755 cron.daily/ntp create mode 100644 default/ntp create mode 100644 dhcp/dhclient-exit-hooks.d/ntp create mode 100755 init.d/ntp create mode 100644 ntp.conf create mode 120000 rc2.d/S01ntp create mode 120000 rc3.d/S01ntp create mode 120000 rc4.d/S01ntp create mode 120000 rc5.d/S01ntp create mode 120000 systemd/system/multi-user.target.wants/ntp.service create mode 120000 systemd/system/systemd-timesyncd.service diff --git a/.etckeeper b/.etckeeper index 07b8f78b..b319a207 100755 --- a/.etckeeper +++ b/.etckeeper @@ -62,6 +62,9 @@ maybe chmod 0644 'ImageMagick-6/type-ghostscript.xml' maybe chmod 0644 'ImageMagick-6/type-urw-base35.xml' maybe chmod 0644 'ImageMagick-6/type-windows.xml' maybe chmod 0644 'ImageMagick-6/type.xml' +maybe chmod 0755 'NetworkManager' +maybe chmod 0755 'NetworkManager/dispatcher.d' +maybe chmod 0755 'NetworkManager/dispatcher.d/ntp' maybe chmod 0755 'X11' maybe chmod 0755 'X11/Xsession.d' maybe chmod 0644 'X11/Xsession.d/20dbus_xdg-runtime' @@ -70,10 +73,17 @@ maybe chmod 0755 'X11/xkb' maybe chmod 0644 'adduser.conf' maybe chmod 0755 'alternatives' maybe chmod 0644 'alternatives/README' +maybe chmod 0755 'apparmor' maybe chmod 0755 'apparmor.d' maybe chmod 0755 'apparmor.d/local' maybe chmod 0644 'apparmor.d/local/usr.bin.man' +maybe chmod 0644 'apparmor.d/local/usr.sbin.ntpd' +maybe chmod 0755 'apparmor.d/tunables' +maybe chmod 0644 'apparmor.d/tunables/ntpd' maybe chmod 0644 'apparmor.d/usr.bin.man' +maybe chmod 0644 'apparmor.d/usr.sbin.ntpd' +maybe chmod 0755 'apparmor/init' +maybe chmod 0755 'apparmor/init/network-interface-security' maybe chmod 0755 'apt' maybe chmod 0755 'apt/apt.conf.d' maybe chmod 0644 'apt/apt.conf.d/01autoremove' @@ -163,6 +173,7 @@ maybe chmod 0755 'cron.daily/dpkg' maybe chmod 0755 'cron.daily/etckeeper' maybe chmod 0755 'cron.daily/logrotate' maybe chmod 0755 'cron.daily/man-db' +maybe chmod 0755 'cron.daily/ntp' maybe chmod 0755 'cron.hourly' maybe chmod 0644 'cron.hourly/.placeholder' maybe chmod 0755 'cron.hourly/fake-hwclock' @@ -199,6 +210,7 @@ maybe chmod 0644 'default/netfilter-persistent' maybe chmod 0644 'default/networking' maybe chmod 0644 'default/nfs-common' maybe chmod 0644 'default/nss' +maybe chmod 0644 'default/ntp' maybe chmod 0644 'default/raspberrypi-kernel' maybe chmod 0644 'default/rng-tools-debian' maybe chmod 0644 'default/rpcbind' @@ -213,6 +225,7 @@ maybe chmod 0644 'dhcp/debug' maybe chmod 0755 'dhcp/dhclient-enter-hooks.d' maybe chmod 0644 'dhcp/dhclient-enter-hooks.d/resolvconf' maybe chmod 0755 'dhcp/dhclient-exit-hooks.d' +maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/ntp' maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes' maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/timesyncd' maybe chmod 0644 'dhcp/dhclient.conf' @@ -355,6 +368,7 @@ maybe chmod 0755 'init.d/kmod' maybe chmod 0755 'init.d/netfilter-persistent' maybe chmod 0755 'init.d/networking' maybe chmod 0755 'init.d/nfs-common' +maybe chmod 0755 'init.d/ntp' maybe chmod 0755 'init.d/paxctld' maybe chmod 0755 'init.d/procps' maybe chmod 0755 'init.d/raspi-config' @@ -474,6 +488,7 @@ maybe chmod 0644 'network/interfaces.new' maybe chmod 0644 'networks' maybe chmod 0755 'nftables.conf' maybe chmod 0644 'nsswitch.conf' +maybe chmod 0644 'ntp.conf' maybe chmod 0755 'opt' maybe chmod 0644 'pam.conf' maybe chmod 0755 'pam.d' diff --git a/NetworkManager/dispatcher.d/ntp b/NetworkManager/dispatcher.d/ntp new file mode 100755 index 00000000..1775eaf6 --- /dev/null +++ b/NetworkManager/dispatcher.d/ntp @@ -0,0 +1,12 @@ +#!/bin/sh + +old_ntp_servers="unknown and invalid" +new_ntp_servers=$DHCP4_NTP_SERVERS +case "$2" in + up|vpn-up) reason=BOUND; ;; + down|vpn-down) reason=RELEASE; ;; + *) exit 0; ;; +esac + +test -f /etc/dhcp/dhclient-exit-hooks.d/ntp || exit 0 +. /etc/dhcp/dhclient-exit-hooks.d/ntp diff --git a/apparmor.d/local/usr.sbin.ntpd b/apparmor.d/local/usr.sbin.ntpd new file mode 100644 index 00000000..e69de29b diff --git a/apparmor.d/tunables/ntpd b/apparmor.d/tunables/ntpd new file mode 100644 index 00000000..1fc2d8fa --- /dev/null +++ b/apparmor.d/tunables/ntpd @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2005 Novell/SUSE +# Copyright (C) 2011 Canonical, Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +#Add your ntpd devices here eg. if you have a DCF clock +# @{NTPD_DEVICE}="/dev/ttyS1" +@{NTPD_DEVICE}="/dev/null" diff --git a/apparmor.d/usr.sbin.ntpd b/apparmor.d/usr.sbin.ntpd new file mode 100644 index 00000000..0977d0d6 --- /dev/null +++ b/apparmor.d/usr.sbin.ntpd @@ -0,0 +1,86 @@ +# vim:syntax=apparmor +# Updated for Ubuntu by: Jamie Strandboge +# ------------------------------------------------------------------ +# +# Copyright (C) 2002-2005 Novell/SUSE +# Copyright (C) 2009-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +#include +#include +/usr/sbin/ntpd flags=(attach_disconnected) { + #include + #include + #include + + capability ipc_lock, + capability net_bind_service, + capability setgid, + capability setuid, + capability sys_chroot, + capability sys_resource, + capability sys_time, + capability sys_nice, + + # ntp uses AF_INET, AF_INET6 and AF_UNSPEC + network dgram, + network stream, + + @{PROC}/net/if_inet6 r, + @{PROC}/*/net/if_inet6 r, + @{NTPD_DEVICE} rw, + # pps devices are almost exclusively used with NTP + /dev/pps[0-9]* rw, + + /{,s}bin/ r, + /usr/{,s}bin/ r, + /usr/local/{,s}bin/ r, + /usr/sbin/ntpd rmix, + + /etc/ntp.conf r, + /etc/ntp.conf.dhcp r, + /etc/ntpd.conf r, + /etc/ntpd.conf.tmp r, + /run/ntp.conf.dhcp r, + + /etc/ntp.keys r, + /etc/ntp/** r, + + /etc/ntp.drift rwl, + /etc/ntp.drift.TEMP rwl, + /etc/ntp/drift* rwl, + /var/lib/ntp/*drift rw, + /var/lib/ntp/*drift.TEMP rw, + + /var/log/ntp w, + /var/log/ntp.log w, + /var/log/ntpd w, + /var/log/ntpstats/clockstats* rwl, + /var/log/ntpstats/loopstats* rwl, + /var/log/ntpstats/peerstats* rwl, + /var/log/ntpstats/protostats* rwl, + /var/log/ntpstats/rawstats* rwl, + /var/log/ntpstats/sysstats* rwl, + + /{,var/}run/ntpd.pid w, + + # to be able to check for running ntpdate + /run/lock/ntpdate wk, + + # To sign replies to MS-SNTP clients by the smbd daemon /var/lib/samba + /var/lib/samba/ntp_signd/socket rw, + + # For use with clocks that report via shared memory (e.g. gpsd), + # you may need to give ntpd access to all of shared memory, though + # this can be considered dangerous. See https://launchpad.net/bugs/722815 + # for details. To enable, add this to local/usr.sbin.ntpd: + # capability ipc_owner, + + # Site-specific additions and overrides. See local/README for details. + #include +} diff --git a/apparmor/init/network-interface-security/usr.sbin.ntpd b/apparmor/init/network-interface-security/usr.sbin.ntpd new file mode 120000 index 00000000..dbd958f8 --- /dev/null +++ b/apparmor/init/network-interface-security/usr.sbin.ntpd @@ -0,0 +1 @@ +../../../apparmor.d/usr.sbin.ntpd \ No newline at end of file diff --git a/cron.daily/ntp b/cron.daily/ntp new file mode 100755 index 00000000..1fe08153 --- /dev/null +++ b/cron.daily/ntp @@ -0,0 +1,39 @@ +#!/bin/sh + +# The default Debian ntp.conf enables logging of various statistics to +# the /var/log/ntpstats directory. The daemon automatically changes +# to a new datestamped set of files at midnight, so all we need to do +# is delete old ones, and compress the ones we're keeping so disk +# usage is controlled. + +statsdir=$(cat /etc/ntp.conf | grep -v '^#' | sed -nr 's/^statsdir[[:space:]]+([^[:space:]]+).*$/\1/p') + +if [ -n "$statsdir" ] && [ -d "$statsdir" ]; then + # only keep a week's depth of these. Delete only files exactly + # within the directory and do not descend into subdirectories + # to avoid security risks on platforms where find is not using + # fts-library. + find "$statsdir" -maxdepth 1 -type f -name "*stats*" -mtime +7 -delete + + # compress whatever is left to save space but make sure to really + # do it only in the expected directory. + cd "$statsdir" || exit 1 + ls -d -- *stats.???????? > /dev/null 2>&1 + if [ $? -eq 0 ]; then + # Note that gzip won't compress the file names that + # are hard links to the live/current files, so this + # compresses yesterday and previous, leaving the live + # log alone. We suppress the warnings gzip issues + # about not compressing the linked file. + gzip --best --quiet -- *stats.???????? + return=$? + case $return in + 2) + exit 0 # squash all warnings + ;; + *) + exit $return # but let real errors through + ;; + esac + fi +fi diff --git a/default/ntp b/default/ntp new file mode 100644 index 00000000..af78139b --- /dev/null +++ b/default/ntp @@ -0,0 +1 @@ +NTPD_OPTS='-g' diff --git a/dhcp/dhclient-exit-hooks.d/ntp b/dhcp/dhclient-exit-hooks.d/ntp new file mode 100644 index 00000000..eedf6d92 --- /dev/null +++ b/dhcp/dhclient-exit-hooks.d/ntp @@ -0,0 +1,64 @@ +NTP_CONF=/etc/ntp.conf +NTP_DHCP_CONF=/run/ntp.conf.dhcp + + +ntp_server_restart() { + invoke-rc.d ntp try-restart +} + + +ntp_servers_setup_remove() { + if [ ! -e $NTP_DHCP_CONF ]; then + return + fi + rm -f $NTP_DHCP_CONF + ntp_server_restart +} + + +ntp_servers_setup_add() { + if [ -e $NTP_DHCP_CONF ] && [ "$new_ntp_servers" = "$old_ntp_servers" ]; then + return + fi + + if [ -z "$new_ntp_servers" ]; then + ntp_servers_setup_remove + return + fi + + tmp=$(mktemp "$NTP_DHCP_CONF.XXXXXX") || return + chmod --reference=$NTP_CONF $tmp + chown --reference=$NTP_CONF $tmp + + ( + echo "# This file was copied from $NTP_CONF with the server options changed" + echo "# to reflect the information sent by the DHCP server. Any changes made" + echo "# here will be lost at the next DHCP event. Edit $NTP_CONF instead." + echo + echo "# NTP server entries received from DHCP server" + for server in $new_ntp_servers; do + echo "server $server iburst" + done + echo + sed '/^[[:space:]]*\(server\|peer\|pool\)[[:space:]]/d' $NTP_CONF + ) >>$tmp + + mv $tmp $NTP_DHCP_CONF + + ntp_server_restart +} + + +ntp_servers_setup() { + case $reason in + BOUND|RENEW|REBIND|REBOOT) + ntp_servers_setup_add + ;; + EXPIRE|FAIL|RELEASE|STOP) + ntp_servers_setup_remove + ;; + esac +} + + +ntp_servers_setup diff --git a/group b/group index f08d00b2..3bdd8108 100644 --- a/group +++ b/group @@ -57,3 +57,4 @@ gpio:x:997:pi systemd-coredump:x:996: wheel:x:1001:pi docker:x:995: +ntp:x:114: diff --git a/group- b/group- index 35e07ebb..f08d00b2 100644 --- a/group- +++ b/group- @@ -56,3 +56,4 @@ i2c:x:998:pi gpio:x:997:pi systemd-coredump:x:996: wheel:x:1001:pi +docker:x:995: diff --git a/gshadow b/gshadow index 7acc6fec..ac5821f8 100644 --- a/gshadow +++ b/gshadow @@ -57,3 +57,4 @@ gpio:!::pi systemd-coredump:!*:: wheel:!::pi docker:!:: +ntp:!:: diff --git a/gshadow- b/gshadow- index d605d9dd..7acc6fec 100644 --- a/gshadow- +++ b/gshadow- @@ -56,3 +56,4 @@ i2c:!::pi gpio:!::pi systemd-coredump:!*:: wheel:!::pi +docker:!:: diff --git a/init.d/ntp b/init.d/ntp new file mode 100755 index 00000000..0e599ab2 --- /dev/null +++ b/init.d/ntp @@ -0,0 +1,72 @@ +#!/bin/sh + +### BEGIN INIT INFO +# Provides: ntp +# Required-Start: $network $remote_fs $syslog +# Required-Stop: $network $remote_fs $syslog +# Default-Start: 2 3 4 5 +# Default-Stop: +# Short-Description: Start NTP daemon +### END INIT INFO + +PATH=/sbin:/bin:/usr/sbin:/usr/bin + +. /lib/lsb/init-functions + +DAEMON=/usr/sbin/ntpd +PIDFILE=/var/run/ntpd.pid + +test -x $DAEMON || exit 0 + +if [ -r /etc/default/ntp ]; then + . /etc/default/ntp +fi + +if [ -e /run/ntp.conf.dhcp ]; then + NTPD_OPTS="$NTPD_OPTS -c /run/ntp.conf.dhcp" +fi + + +RUNASUSER=ntp +UGID=$(getent passwd $RUNASUSER | cut -f 3,4 -d:) || true +if test "$(uname -s)" = "Linux"; then + NTPD_OPTS="$NTPD_OPTS -u $UGID" +fi + +case $1 in + start) + log_daemon_msg "Starting NTP server" "ntpd" + if [ -z "$UGID" ]; then + log_failure_msg "user \"$RUNASUSER\" does not exist" + exit 1 + fi + start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --startas $DAEMON -- -p $PIDFILE $NTPD_OPTS + log_end_msg $? + ;; + stop) + log_daemon_msg "Stopping NTP server" "ntpd" + start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --retry=TERM/30/KILL/5 --exec $DAEMON + log_end_msg $? + rm -f $PIDFILE + ;; + restart|force-reload) + $0 stop && sleep 2 && $0 start + ;; + try-restart) + if $0 status >/dev/null; then + $0 restart + else + exit 0 + fi + ;; + reload) + exit 3 + ;; + status) + status_of_proc $DAEMON "NTP server" + ;; + *) + echo "Usage: $0 {start|stop|restart|try-restart|force-reload|status}" + exit 2 + ;; +esac diff --git a/ntp.conf b/ntp.conf new file mode 100644 index 00000000..d473b432 --- /dev/null +++ b/ntp.conf @@ -0,0 +1,60 @@ +# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help + +driftfile /var/lib/ntp/ntp.drift + +# Leap seconds definition provided by tzdata +leapfile /usr/share/zoneinfo/leap-seconds.list + +# Enable this if you want statistics to be logged. +#statsdir /var/log/ntpstats/ + +statistics loopstats peerstats clockstats +filegen loopstats file loopstats type day enable +filegen peerstats file peerstats type day enable +filegen clockstats file clockstats type day enable + + +# You do need to talk to an NTP server or two (or three). +#server ntp.your-provider.example + +# pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will +# pick a different set every time it starts up. Please consider joining the +# pool: +pool 0.debian.pool.ntp.org iburst +pool 1.debian.pool.ntp.org iburst +pool 2.debian.pool.ntp.org iburst +pool 3.debian.pool.ntp.org iburst + + +# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for +# details. The web page +# might also be helpful. +# +# Note that "restrict" applies to both servers and clients, so a configuration +# that might be intended to block requests from certain clients could also end +# up blocking replies from your own upstream servers. + +# By default, exchange time with everybody, but don't allow configuration. +restrict -4 default kod notrap nomodify nopeer noquery limited +restrict -6 default kod notrap nomodify nopeer noquery limited + +# Local users may interrogate the ntp server more closely. +restrict 127.0.0.1 +restrict ::1 + +# Needed for adding pool entries +restrict source notrap nomodify noquery + +# Clients from this (example!) subnet have unlimited access, but only if +# cryptographically authenticated. +#restrict 192.168.123.0 mask 255.255.255.0 notrust + + +# If you want to provide time to your local subnet, change the next line. +# (Again, the address is an example only.) +#broadcast 192.168.123.255 + +# If you want to listen to time broadcasts on your local subnet, de-comment the +# next lines. Please do this only if you trust everybody on the network! +#disable auth +#broadcastclient diff --git a/passwd b/passwd index cb1b8680..7880a149 100644 --- a/passwd +++ b/passwd @@ -27,3 +27,4 @@ statd:x:106:65534::/var/lib/nfs:/usr/sbin/nologin sshd:x:107:65534::/run/sshd:/usr/sbin/nologin avahi:x:108:113:Avahi mDNS daemon,,,:/run/avahi-daemon:/usr/sbin/nologin systemd-coredump:x:996:996:systemd Core Dumper:/:/usr/sbin/nologin +ntp:x:109:114::/nonexistent:/usr/sbin/nologin diff --git a/passwd- b/passwd- index da14a150..7880a149 100644 --- a/passwd- +++ b/passwd- @@ -26,3 +26,5 @@ _rpc:x:105:65534::/run/rpcbind:/usr/sbin/nologin statd:x:106:65534::/var/lib/nfs:/usr/sbin/nologin sshd:x:107:65534::/run/sshd:/usr/sbin/nologin avahi:x:108:113:Avahi mDNS daemon,,,:/run/avahi-daemon:/usr/sbin/nologin +systemd-coredump:x:996:996:systemd Core Dumper:/:/usr/sbin/nologin +ntp:x:109:114::/nonexistent:/usr/sbin/nologin diff --git a/rc2.d/S01ntp b/rc2.d/S01ntp new file mode 120000 index 00000000..33b559d4 --- /dev/null +++ b/rc2.d/S01ntp @@ -0,0 +1 @@ +../init.d/ntp \ No newline at end of file diff --git a/rc3.d/S01ntp b/rc3.d/S01ntp new file mode 120000 index 00000000..33b559d4 --- /dev/null +++ b/rc3.d/S01ntp @@ -0,0 +1 @@ +../init.d/ntp \ No newline at end of file diff --git a/rc4.d/S01ntp b/rc4.d/S01ntp new file mode 120000 index 00000000..33b559d4 --- /dev/null +++ b/rc4.d/S01ntp @@ -0,0 +1 @@ +../init.d/ntp \ No newline at end of file diff --git a/rc5.d/S01ntp b/rc5.d/S01ntp new file mode 120000 index 00000000..33b559d4 --- /dev/null +++ b/rc5.d/S01ntp @@ -0,0 +1 @@ +../init.d/ntp \ No newline at end of file diff --git a/systemd/system/multi-user.target.wants/ntp.service b/systemd/system/multi-user.target.wants/ntp.service new file mode 120000 index 00000000..8ab79abc --- /dev/null +++ b/systemd/system/multi-user.target.wants/ntp.service @@ -0,0 +1 @@ +/lib/systemd/system/ntp.service \ No newline at end of file diff --git a/systemd/system/systemd-timesyncd.service b/systemd/system/systemd-timesyncd.service new file mode 120000 index 00000000..dc1dc0cd --- /dev/null +++ b/systemd/system/systemd-timesyncd.service @@ -0,0 +1 @@ +/dev/null \ No newline at end of file