[chrony-users] Run chronyd as unprivileged user

[Daniel Bechter <daniel.bechter@xxxxxxxxxxxxxxxxx>]

Hey guys

 

My original plan was to run chronyd as an unprivileged user, manually assigning the required capabilities (CAP_SYS_TIME as I only run it as client) via setcap command. Chronyd however complained about not being executed as superuser. Is there any way to run chronyd as unprivileged user from the beginning or are there any ambitions to change the behaviour?

 

Next thing I tried was to run chronyd with the SUID bit set:

 

chown root:time /usr/sbin/chronyd

chmod 4770 /usr/sbin/chronyd

 

Chronyd still complained about not being executed as superuser though. So I looked into the code and made a change to check for the effective UID rather than the real one, see attached patch (on top of 3.3). Everything was fine afterwards. Any chance to get that mainline?

 

Any thoughts about that are highly appreciated.

 

Greets,

Daniel

Attachment: 0001-Chrony-now-checks-for-effective-UID.patch
Description: 0001-Chrony-now-checks-for-effective-UID.patch