1.\" Copyright (c) 2018 Ian Lepore <ian@FreeBSD.org> 2.\" 3.\" Redistribution and use in source and binary forms, with or without 4.\" modification, are permitted provided that the following conditions 5.\" are met: 6.\" 1. Redistributions of source code must retain the above copyright 7.\" notice, this list of conditions and the following disclaimer. 8.\" 2. Redistributions in binary form must reproduce the above copyright 9.\" notice, this list of conditions and the following disclaimer in the 10.\" documentation and/or other materials provided with the distribution. 11.\" 12.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 13.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 14.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 15.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 16.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 17.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 19.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 20.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 21.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 22.\" SUCH DAMAGE. 23.\" 24.\" $FreeBSD$ 25.\" 26.Dd July 20, 2018 27.Dt MAC_NTPD 4 28.Os 29.Sh NAME 30.Nm mac_ntpd 31.Nd "policy allowing ntpd to run as non-root user" 32.Sh SYNOPSIS 33To compile the ntpd policy into your kernel, place the following lines 34in your kernel configuration file: 35.Bd -ragged -offset indent 36.Cd "options MAC" 37.Cd "options MAC_NTPD" 38.Ed 39.Pp 40Alternately, to load the ntpd policy module at boot time, 41place the following line in your kernel configuration file: 42.Bd -ragged -offset indent 43.Cd "options MAC" 44.Ed 45.Pp 46and in 47.Xr loader.conf 5 : 48.Bd -literal -offset indent 49mac_ntpd_load="YES" 50.Ed 51.Sh DESCRIPTION 52The 53.Nm 54policy grants any process running as user 55.Sq ntpd 56(uid 123) the privileges needed to manipulate 57system time, and to (re-)bind to the privileged NTP port. 58.Pp 59When 60.Xr ntpd 8 61is started with 62.Sq Fl u Ar <user>[:group] 63on the command line, it performs all initializations requiring root 64privileges, then drops root privileges by switching to the given user id. 65From that point on, the only privileges it requires are the ability 66to manipulate system time, and the ability to re-bind a UDP socket 67to the NTP port (port 123) after a network interface change. 68.Pp 69With the 70.Nm 71policy active, it may also be possible to start ntpd as a non-root user, 72because the default ntpd options don't require any additional root 73privileges beyond those granted by the policy. 74.Ss Privileges Granted 75The exact set of kernel privileges granted to any process running 76with the configured uid is: 77.Bl -inset -compact -offset indent 78.It Dv PRIV_ADJTIME 79.It Dv PRIV_CLOCK_SETTIME 80.It Dv PRIV_NTP_ADJTIME 81.It Dv PRIV_NETINET_RESERVEDPORT 82.It Dv PRIV_NETINET_REUSEPORT 83.El 84.Ss Runtime Configuration 85The following 86.Xr sysctl 8 87MIBs are available for fine-tuning this MAC policy. 88All 89.Xr sysctl 8 90variables can also be set as 91.Xr loader 8 92tunables in 93.Xr loader.conf 5 . 94.Bl -tag -width indent 95.It Va security.mac.ntpd.enabled 96Enable the 97.Nm 98policy. 99(Default: 1). 100.It Va security.mac.ntpd.uid 101The numeric uid of the ntpd user. 102(Default: 123). 103.El 104.Sh SEE ALSO 105.Xr mac 4 , 106.Xr ntpd 8 107.Sh HISTORY 108MAC first appeared in 109.Fx 5.0 110and 111.Nm 112first appeared in 113.Fx 12.0 . 114