1.\" Copyright (c) 2018 Ian Lepore <ian@FreeBSD.org> 2.\" 3.\" Redistribution and use in source and binary forms, with or without 4.\" modification, are permitted provided that the following conditions 5.\" are met: 6.\" 1. Redistributions of source code must retain the above copyright 7.\" notice, this list of conditions and the following disclaimer. 8.\" 2. Redistributions in binary form must reproduce the above copyright 9.\" notice, this list of conditions and the following disclaimer in the 10.\" documentation and/or other materials provided with the distribution. 11.\" 12.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 13.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 14.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 15.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 16.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 17.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 19.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 20.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 21.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 22.\" SUCH DAMAGE. 23.\" 24.\" $FreeBSD$ 25.\" 26.Dd July 20, 2018 27.Dt MAC_NTPD 4 28.Os 29.Sh NAME 30.Nm mac_ntpd 31.Nd "policy allowing ntpd to run as non-root user" 32.Sh SYNOPSIS 33To compile the ntpd policy into your kernel, place the following lines 34in your kernel configuration file: 35.Bd -ragged -offset indent 36.Cd "options MAC" 37.Cd "options MAC_NTPD" 38.Ed 39.Pp 40Alternately, to load the ntpd policy module at boot time, 41place the following line in your kernel configuration file: 42.Bd -ragged -offset indent 43.Cd "options MAC" 44.Ed 45.Pp 46and in 47.Xr loader.conf 5 : 48.Bd -literal -offset indent 49mac_ntpd_load="YES" 50.Ed 51.Sh DESCRIPTION 52The 53.Nm 54policy grants any process running as user 55.Sq ntpd 56(uid 123) the privileges needed to manipulate 57system time, and to (re-)bind to the privileged NTP port. 58.Pp 59When 60.Xr ntpd 8 61is started with 62.Sq Fl u Ar <user>[:group] 63on the command line, it performs all initializations requiring root 64privileges, then drops root privileges by switching to the given user id. 65From that point on, the only privileges it requires are the ability 66to manipulate system time, and the ability to re-bind a UDP socket 67to the NTP port (port 123) after a network interface change. 68.Pp 69With the 70.Nm 71policy active, it may also be possible to start ntpd as a non-root user, 72because the default ntpd options don't require any additional root 73privileges beyond those granted by the policy. 74.Pp 75.Ss Privileges Granted 76The exact set of kernel privileges granted to any process running 77with the configured uid is: 78.Bl -inset -compact -offset indent 79.It Dv PRIV_ADJTIME 80.It Dv PRIV_CLOCK_SETTIME 81.It Dv PRIV_NTP_ADJTIME 82.It Dv PRIV_NETINET_RESERVEDPORT 83.It Dv PRIV_NETINET_REUSEPORT 84.El 85.Pp 86.Ss Runtime Configuration 87The following 88.Xr sysctl 8 89MIBs are available for fine-tuning this MAC policy. 90All 91.Xr sysctl 8 92variables can also be set as 93.Xr loader 8 94tunables in 95.Xr loader.conf 5 . 96.Bl -tag -width indent 97.It Va security.mac.ntpd.enabled 98Enable the 99.Nm 100policy. 101(Default: 1). 102.It Va security.mac.ntpd.uid 103The numeric uid of the ntpd user. 104(Default: 123). 105.El 106.Sh SEE ALSO 107.Xr mac 4 , 108.Xr ntpd 8 109.Sh HISTORY 110MAC first appeared in 111.Fx 5.0 112and 113.Nm 114first appeared in 115.Fx 12.0 . 116