nixos/chrony: clean up, rework to be a little closer to upstream
Most importantly, this sets PrivateTmp, ProtectHome, and ProtectSystem so that Chrony flaws are mitigated, should they occur. Moving to ProtectSystem=full however, requires moving the chrony key files under /var/lib/chrony -- which should be fine, anyway. This also ensures ConditionCapability=CAP_SYS_TIME is set, ensuring that chronyd will only be launched in an environment where such a capability can be granted. Signed-off-by: Austin Seipp <aseipp@pobox.com>
This commit is contained in:
parent
6ebad0821f
commit
0ce90d58cc
|
@ -3,12 +3,10 @@
|
||||||
with lib;
|
with lib;
|
||||||
|
|
||||||
let
|
let
|
||||||
|
cfg = config.services.chrony;
|
||||||
|
|
||||||
stateDir = "/var/lib/chrony";
|
stateDir = "/var/lib/chrony";
|
||||||
|
keyFile = "${stateDir}/chrony.keys";
|
||||||
keyFile = "/etc/chrony.keys";
|
|
||||||
|
|
||||||
cfg = config.services.chrony;
|
|
||||||
|
|
||||||
configFile = pkgs.writeText "chrony.conf" ''
|
configFile = pkgs.writeText "chrony.conf" ''
|
||||||
${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
|
${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
|
||||||
|
@ -19,7 +17,6 @@ let
|
||||||
}
|
}
|
||||||
|
|
||||||
driftfile ${stateDir}/chrony.drift
|
driftfile ${stateDir}/chrony.drift
|
||||||
|
|
||||||
keyfile ${keyFile}
|
keyfile ${keyFile}
|
||||||
|
|
||||||
${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
|
${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
|
||||||
|
@ -27,18 +24,11 @@ let
|
||||||
${cfg.extraConfig}
|
${cfg.extraConfig}
|
||||||
'';
|
'';
|
||||||
|
|
||||||
chronyFlags = "-n -m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
|
chronyFlags = "-m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
|
||||||
|
|
||||||
in
|
in
|
||||||
|
|
||||||
{
|
{
|
||||||
|
|
||||||
###### interface
|
|
||||||
|
|
||||||
options = {
|
options = {
|
||||||
|
|
||||||
services.chrony = {
|
services.chrony = {
|
||||||
|
|
||||||
enable = mkOption {
|
enable = mkOption {
|
||||||
default = false;
|
default = false;
|
||||||
description = ''
|
description = ''
|
||||||
|
@ -83,15 +73,9 @@ in
|
||||||
description = "Extra flags passed to the chronyd command.";
|
description = "Extra flags passed to the chronyd command.";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
###### implementation
|
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
# Make chronyc available in the system path
|
|
||||||
environment.systemPackages = [ pkgs.chrony ];
|
environment.systemPackages = [ pkgs.chrony ];
|
||||||
|
|
||||||
users.groups = singleton
|
users.groups = singleton
|
||||||
|
@ -113,26 +97,30 @@ in
|
||||||
{ description = "chrony NTP daemon";
|
{ description = "chrony NTP daemon";
|
||||||
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
wants = [ "time-sync.target" ];
|
wants = [ "time-sync.target" ];
|
||||||
before = [ "time-sync.target" ];
|
before = [ "time-sync.target" ];
|
||||||
after = [ "network.target" ];
|
after = [ "network.target" ];
|
||||||
conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
|
conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
|
||||||
|
|
||||||
path = [ pkgs.chrony ];
|
path = [ pkgs.chrony ];
|
||||||
|
|
||||||
preStart =
|
preStart = ''
|
||||||
''
|
mkdir -m 0755 -p ${stateDir}
|
||||||
mkdir -m 0755 -p ${stateDir}
|
touch ${keyFile}
|
||||||
touch ${keyFile}
|
chmod 0640 ${keyFile}
|
||||||
chmod 0640 ${keyFile}
|
chown chrony:chrony ${stateDir} ${keyFile}
|
||||||
chown chrony:chrony ${stateDir} ${keyFile}
|
'';
|
||||||
'';
|
|
||||||
|
|
||||||
serviceConfig =
|
serviceConfig =
|
||||||
{ ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
|
{ Type = "forking";
|
||||||
|
ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
|
||||||
|
|
||||||
|
ProtectHome = "yes";
|
||||||
|
ProtectSystem = "full";
|
||||||
|
PrivateTmp = "yes";
|
||||||
|
|
||||||
|
ConditionCapability = "CAP_SYS_TIME";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue