nixos/chrony: clean up, rework to be a little closer to upstream

Most importantly, this sets PrivateTmp, ProtectHome, and ProtectSystem
so that Chrony flaws are mitigated, should they occur.

Moving to ProtectSystem=full however, requires moving the chrony key
files under /var/lib/chrony -- which should be fine, anyway.

This also ensures ConditionCapability=CAP_SYS_TIME is set, ensuring
that chronyd will only be launched in an environment where such a
capability can be granted.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
This commit is contained in:
Austin Seipp 2018-09-24 00:21:52 -05:00
parent 6ebad0821f
commit 0ce90d58cc

View file

@ -3,12 +3,10 @@
with lib; with lib;
let let
cfg = config.services.chrony;
stateDir = "/var/lib/chrony"; stateDir = "/var/lib/chrony";
keyFile = "${stateDir}/chrony.keys";
keyFile = "/etc/chrony.keys";
cfg = config.services.chrony;
configFile = pkgs.writeText "chrony.conf" '' configFile = pkgs.writeText "chrony.conf" ''
${concatMapStringsSep "\n" (server: "server " + server) cfg.servers} ${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
@ -19,7 +17,6 @@ let
} }
driftfile ${stateDir}/chrony.drift driftfile ${stateDir}/chrony.drift
keyfile ${keyFile} keyfile ${keyFile}
${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"} ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
@ -27,18 +24,11 @@ let
${cfg.extraConfig} ${cfg.extraConfig}
''; '';
chronyFlags = "-n -m -u chrony -f ${configFile} ${toString cfg.extraFlags}"; chronyFlags = "-m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
in in
{ {
###### interface
options = { options = {
services.chrony = { services.chrony = {
enable = mkOption { enable = mkOption {
default = false; default = false;
description = '' description = ''
@ -83,15 +73,9 @@ in
description = "Extra flags passed to the chronyd command."; description = "Extra flags passed to the chronyd command.";
}; };
}; };
}; };
###### implementation
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Make chronyc available in the system path
environment.systemPackages = [ pkgs.chrony ]; environment.systemPackages = [ pkgs.chrony ];
users.groups = singleton users.groups = singleton
@ -113,26 +97,30 @@ in
{ description = "chrony NTP daemon"; { description = "chrony NTP daemon";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
wants = [ "time-sync.target" ]; wants = [ "time-sync.target" ];
before = [ "time-sync.target" ]; before = [ "time-sync.target" ];
after = [ "network.target" ]; after = [ "network.target" ];
conflicts = [ "ntpd.service" "systemd-timesyncd.service" ]; conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
path = [ pkgs.chrony ]; path = [ pkgs.chrony ];
preStart = preStart = ''
'' mkdir -m 0755 -p ${stateDir}
mkdir -m 0755 -p ${stateDir} touch ${keyFile}
touch ${keyFile} chmod 0640 ${keyFile}
chmod 0640 ${keyFile} chown chrony:chrony ${stateDir} ${keyFile}
chown chrony:chrony ${stateDir} ${keyFile} '';
'';
serviceConfig = serviceConfig =
{ ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}"; { Type = "forking";
ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
ProtectHome = "yes";
ProtectSystem = "full";
PrivateTmp = "yes";
ConditionCapability = "CAP_SYS_TIME";
}; };
}; };
}; };
} }