NAME
mac_ntpd —
policy allowing ntpd to run as non-root
user
SYNOPSIS
To compile the ntpd policy into your kernel, place the following lines in your kernel configuration file:
options MAC
options MAC_NTPDAlternately, to load the ntpd policy module at boot time, place the following line in your kernel configuration file:
options MACand in loader.conf(5):
mac_ntpd_load="YES"
DESCRIPTION
The mac_ntpd policy grants any process
running as user ‘ntpd’ (uid 123) the privileges needed to
manipulate system time, and to (re-)bind to the privileged NTP port.
When
ntpd(8) is started with ‘-u
<user>[:group]’ on the command line, it
performs all initializations requiring root privileges, then drops root
privileges by switching to the given user id. From that point on, the only
privileges it requires are the ability to manipulate system time, and the
ability to re-bind a UDP socket to the NTP port (port 123) after a network
interface change.
With the mac_ntpd policy active, it may
also be possible to start ntpd as a non-root user, because the default ntpd
options don't require any additional root privileges beyond those granted by
the policy.
Privileges Granted
The exact set of kernel privileges granted to any process running with the configured uid is:
PRIV_ADJTIMEPRIV_CLOCK_SETTIMEPRIV_NTP_ADJTIMEPRIV_NETINET_RESERVEDPORTPRIV_NETINET_REUSEPORT
Runtime Configuration
The following sysctl(8) MIBs are available for fine-tuning this MAC policy. All sysctl(8) variables can also be set as loader(8) tunables in loader.conf(5).
- security.mac.ntpd.enabled
- Enable the
mac_ntpdpolicy. (Default: 1). - security.mac.ntpd.uid
- The numeric uid of the ntpd user. (Default: 123).
SEE ALSO
HISTORY
MAC first appeared in FreeBSD 5.0 and
mac_ntpd first appeared in FreeBSD
12.0.