Changeset View
Standalone View
etc/rc.d/ntpd
#!/bin/sh | #!/bin/sh | ||||
# | # | ||||
# $FreeBSD$ | # $FreeBSD$ | ||||
# | # | ||||
# PROVIDE: ntpd | # PROVIDE: ntpd | ||||
# REQUIRE: DAEMON ntpdate FILESYSTEMS devfs | # REQUIRE: DAEMON ntpdate FILESYSTEMS devfs | ||||
# BEFORE: LOGIN | # BEFORE: LOGIN | ||||
# KEYWORD: nojail shutdown | # KEYWORD: nojail shutdown | ||||
. /etc/rc.subr | . /etc/rc.subr | ||||
name="ntpd" | name="ntpd" | ||||
desc="Network Time Protocol daemon" | desc="Network Time Protocol daemon" | ||||
rcvar="ntpd_enable" | rcvar="ntpd_enable" | ||||
command="/usr/sbin/${name}" | command="/usr/sbin/${name}" | ||||
pidfile="/var/run/${name}.pid" | |||||
extra_commands="fetch needfetch" | extra_commands="fetch needfetch" | ||||
fetch_cmd="ntpd_fetch_leapfile" | fetch_cmd="ntpd_fetch_leapfile" | ||||
needfetch_cmd="ntpd_needfetch_leapfile" | needfetch_cmd="ntpd_needfetch_leapfile" | ||||
start_precmd="ntpd_precmd" | start_precmd="ntpd_precmd" | ||||
_ntp_tmp_leapfile="/var/run/ntpd.leap-seconds.list" | _ntp_tmp_leapfile="/var/run/ntpd.leap-seconds.list" | ||||
_ntp_default_dir="/var/db/ntp" | |||||
_ntp_default_driftfile="${_ntp_default_dir}/ntpd.drift" | |||||
_ntp_old_driftfile="/var/db/ntpd.drift" | |||||
pidfile="${_ntp_default_dir}/${name}.pid" | |||||
load_rc_config $name | load_rc_config $name | ||||
ntpd_precmd() | can_run_nonroot() | ||||
{ | { | ||||
rc_flags="-c ${ntpd_config} ${ntpd_flags}" | # If the admin set what uid to use, we don't change it. | ||||
if [ -n "${ntpd_user}" ]; then | |||||
if checkyesno ntpd_sync_on_start; then | return 1 | ||||
rc_flags="-g $rc_flags" | |||||
fi | fi | ||||
ntpd_init_leapfile | # If the admin set any command line options involving files, we | ||||
# may not be able to access them as user ntpd. | |||||
case "${rc_flags}" in | |||||
*-f* | *--driftfile* | *-i* | *--jaildir* | \ | |||||
*-k* | *--keyfile* | *-l* | *--logfile* | \ | |||||
*-p* | *--pidfile* | *-s* | *--statsdir* ) | |||||
return 1;; | |||||
esac | |||||
if [ ! -f $ntp_db_leapfile ]; then | # If the admin set any options in ntp.conf involving files, | ||||
ntpd_fetch_leapfile | # we may not be able to access them as user ntpd. | ||||
local fileopts="^[ \t]*crypto|^[ \t]*driftfile|^[ \t]*key|^[ \t]*logfile|^[ \t]*statsdir" | |||||
grep -E -q "${fileopts}" "${ntpd_config}" && return 1 | |||||
# Try to set up the the MAC ntpd policy so ntpd can run with reduced | |||||
# privileges. Detect whether MAC is compiled into the kernel, load | |||||
# the policy module if not already present, then check whether the | |||||
# policy has been disabled via tunable or sysctl. | |||||
[ -n "$(sysctl -qn security.mac.version)" ] || return 1 | |||||
sysctl -qn security.mac.ntpd >/dev/null || kldload -qn mac_ntpd || return 1 | |||||
[ "$(sysctl -qn security.mac.ntpd.enabled)" == "1" ] || return 1 | |||||
# On older existing systems, the ntp dir may by owned by root, change | |||||
# it to ntpd to give the daemon create/write access to the driftfile. | |||||
ian: Oops, typo here, already fixed locally; it'll be nullfs on the next rev. | |||||
if [ "$(stat -f %u ${_ntp_default_dir})" = "0" ]; then | |||||
chown ntpd:ntpd "${_ntp_default_dir}" || return 1 | |||||
chmod 0755 "${_ntp_default_dir}" || return 1 | |||||
logger -s -t "rc.d/ntpd" -p daemon.notice \ | |||||
"${_ntp_default_dir} updated to owner ntpd:ntpd, mode 0755" | |||||
fi | fi | ||||
if [ -z "$ntpd_chrootdir" ]; then | # If the driftfile exists in the standard location for older existing | ||||
return 0; | # systems, move it into the ntp dir and fix the ownership if we can. | ||||
if [ -f "${_ntp_old_driftfile}" ] && [ ! -L "${_ntp_old_driftfile}" ]; then | |||||
mv "${_ntp_old_driftfile}" "${_ntp_default_driftfile}" && | |||||
chown ntpd:ntpd "${_ntp_default_driftfile}" || return 1 | |||||
logger -s -t "rc.d/ntpd" -p daemon.notice \ | |||||
"${_ntp_default_driftfile} updated to owner ntpd:ntpd" | |||||
logger -s -t "rc.d/ntpd" -p daemon.notice \ | |||||
"${_ntp_old_driftfile} moved to ${_ntp_default_driftfile}" | |||||
fi | fi | ||||
} | |||||
# If running in a chroot cage, ensure that the appropriate files | ntpd_precmd() | ||||
# exist inside the cage, as well as helper symlinks into the cage | { | ||||
# from outside. | local driftopt | ||||
# | |||||
# As this is called after the is_running and required_dir checks | # If we can run as a non-root user, switch uid to ntpd and use the | ||||
# are made in run_rc_command(), we can safely assume ${ntpd_chrootdir} | # new default location for the driftfile inside the ntpd-owned dir. | ||||
# exists and ntpd isn't running at this point (unless forcestart | # Otherwise, figure out what to do about the driftfile option. If set | ||||
# is used). | # by the admin, we don't add the option. If the file exists in the old | ||||
# | # default location we use that, else we use the new default location. | ||||
if [ ! -c "${ntpd_chrootdir}/dev/clockctl" ]; then | if can_run_nonroot; then | ||||
rm -f "${ntpd_chrootdir}/dev/clockctl" | _user="ntpd" | ||||
( cd /dev ; /bin/pax -rw -pe clockctl "${ntpd_chrootdir}/dev" ) | driftopt="-f ${_ntp_default_driftfile}" | ||||
elif [ -z "${rc_flags##*-f*}" ] || | |||||
[ -z "${rc_flags##*--driftfile*}" ] || | |||||
grep -q "^[ \t]*driftfile" "${ntpd_config}"; then | |||||
driftopt="" # admin set the option, we don't need to add it. | |||||
elif [ -f "${_ntp_old_driftfile}" ]; then | |||||
driftopt="-f ${_ntp_old_driftfile}" | |||||
else | |||||
driftopt="-f ${_ntp_default_driftfile}" | |||||
fi | fi | ||||
ln -fs "${ntpd_chrootdir}/var/db/ntp.drift" /var/db/ntp.drift | |||||
ln -fs "${ntpd_chrootdir}${_ntp_tmp_leapfile}" ${_ntp_tmp_leapfile} | |||||
# Change run_rc_commands()'s internal copy of $ntpd_flags | # Set command_args based on the various config vars. | ||||
# | command_args="-p ${pidfile} -c ${ntpd_config} ${driftopt}" | ||||
rc_flags="-u ntpd:ntpd -i ${ntpd_chrootdir} $rc_flags" | if checkyesno ntpd_sync_on_start; then | ||||
command_args="${command_args} -g" | |||||
Done Inline ActionsIf MAC is not present, should it be treated as a fail (e.g. else return 1;;)? delphij: If MAC is not present, should it be treated as a fail (e.g. else return 1;;)? | |||||
Not Done Inline ActionsOh, good catch. This got screwed up on the latest refactoring. Fixed now, and this time tested as well. :) ian: Oh, good catch. This got screwed up on the latest refactoring. Fixed now, and this time… | |||||
fi | |||||
# Make sure the leapfile is ready to use. | |||||
Done Inline ActionsI think a message to syslog to inform the sysadmin that directory permissions have changed should address any POLA concerns. What do you think of daemon.notice? Also to stderr, logger -s. cy: I think a message to syslog to inform the sysadmin that directory permissions have changed… | |||||
ntpd_init_leapfile | |||||
if [ ! -f "${ntp_db_leapfile}" ]; then | |||||
ntpd_fetch_leapfile | |||||
fi | |||||
} | } | ||||
current_ntp_ts() { | current_ntp_ts() { | ||||
Done Inline ActionsSimilarly, inform the sysadmin that files are being moved. cy: Similarly, inform the sysadmin that files are being moved.
| |||||
# Seconds between 1900-01-01 and 1970-01-01 | # Seconds between 1900-01-01 and 1970-01-01 | ||||
# echo $(((70*365+17)*86400)) | # echo $(((70*365+17)*86400)) | ||||
ntp_to_unix=2208988800 | ntp_to_unix=2208988800 | ||||
echo $(($(date -u +%s)+$ntp_to_unix)) | echo $(($(date -u +%s)+$ntp_to_unix)) | ||||
} | } | ||||
get_ntp_leapfile_ver() { | get_ntp_leapfile_ver() { | ||||
Show All 27 Lines | else | ||||
verbose=: | verbose=: | ||||
fi | fi | ||||
ntp_ver_no_src=$(get_ntp_leapfile_ver $ntp_src_leapfile) | ntp_ver_no_src=$(get_ntp_leapfile_ver $ntp_src_leapfile) | ||||
ntp_expiry_src=$(get_ntp_leapfile_expiry $ntp_src_leapfile) | ntp_expiry_src=$(get_ntp_leapfile_expiry $ntp_src_leapfile) | ||||
ntp_ver_no_db=$(get_ntp_leapfile_ver $ntp_db_leapfile) | ntp_ver_no_db=$(get_ntp_leapfile_ver $ntp_db_leapfile) | ||||
ntp_expiry_db=$(get_ntp_leapfile_expiry $ntp_db_leapfile) | ntp_expiry_db=$(get_ntp_leapfile_expiry $ntp_db_leapfile) | ||||
$verbose ntp_src_leapfile version is $ntp_ver_no_src expires $ntp_expiry_src | $verbose ntp_src_leapfile version is $ntp_ver_no_src expires $ntp_expiry_src | ||||
$verbose ntp_db_leapfile version is $ntp_ver_no_db expires $ntp_expiry_db | $verbose ntp_db_leapfile version is $ntp_ver_no_db expires $ntp_expiry_db | ||||
Done Inline ActionsThis is not related to this review. I have no objection but it needs to be committed in a separate commit. cy: This is not related to this review. I have no objection but it needs to be committed in a… | |||||
Done Inline ActionsOoops, yeah, leftover debugging unrelated to these changes, but I do think I'll commit it on it's own since it's useful. ian: Ooops, yeah, leftover debugging unrelated to these changes, but I do think I'll commit it on… | |||||
Done Inline ActionsThanks. cy: Thanks. | |||||
if [ "$ntp_ver_no_src" -gt "$ntp_ver_no_db" -o \ | if [ "$ntp_ver_no_src" -gt "$ntp_ver_no_db" -o \ | ||||
"$ntp_ver_no_src" -eq "$ntp_ver_no_db" -a \ | "$ntp_ver_no_src" -eq "$ntp_ver_no_db" -a \ | ||||
"$ntp_expiry_src" -gt "$ntp_expiry_db" ]; then | "$ntp_expiry_src" -gt "$ntp_expiry_db" ]; then | ||||
$verbose replacing $ntp_db_leapfile with $ntp_src_leapfile | $verbose replacing $ntp_db_leapfile with $ntp_src_leapfile | ||||
cp -p $ntp_src_leapfile $ntp_db_leapfile | cp -p $ntp_src_leapfile $ntp_db_leapfile | ||||
ntp_ver_no_db=$ntp_ver_no_src | ntp_ver_no_db=$ntp_ver_no_src | ||||
else | else | ||||
Show All 19 Lines | ntpd_fetch_leapfile() { | ||||
fi | fi | ||||
if ntpd_needfetch_leapfile ; then | if ntpd_needfetch_leapfile ; then | ||||
for url in $ntp_leapfile_sources ; do | for url in $ntp_leapfile_sources ; do | ||||
$verbose fetching $url | $verbose fetching $url | ||||
fetch $ntp_leapfile_fetch_opts -o $_ntp_tmp_leapfile $url && break | fetch $ntp_leapfile_fetch_opts -o $_ntp_tmp_leapfile $url && break | ||||
done | done | ||||
ntp_ver_no_tmp=$(get_ntp_leapfile_ver $_ntp_tmp_leapfile) | ntp_ver_no_tmp=$(get_ntp_leapfile_ver $_ntp_tmp_leapfile) | ||||
ntp_expiry_tmp=$(get_ntp_leapfile_expiry $_ntp_tmp_leapfile) | ntp_expiry_tmp=$(get_ntp_leapfile_expiry $_ntp_tmp_leapfile) | ||||
Done Inline ActionsWhy the name change? cy: Why the name change? | |||||
Done Inline ActionsI was getting lost in the maze of similar-named ntp-related rcvars, so I decided to name all the ones that are local to this script (rather than coming from rc.conf) to start with an underbar. I might just commit this alone too, so that it doesn't clutter up the next rev of the main diff. ian: I was getting lost in the maze of similar-named ntp-related rcvars, so I decided to name all… | |||||
Done Inline ActionsYes, alone so it doesn't confuse this change with unrelated changes. Thanks again. cy: Yes, alone so it doesn't confuse this change with unrelated changes.
Thanks again. | |||||
if [ "$ntp_expiry_tmp" -gt "$ntp_expiry_db" -o \ | if [ "$ntp_expiry_tmp" -gt "$ntp_expiry_db" -o \ | ||||
"$ntp_expiry_tmp" -eq "$ntp_expiry_db" -a \ | "$ntp_expiry_tmp" -eq "$ntp_expiry_db" -a \ | ||||
"$ntp_ver_no_tmp" -gt "$ntp_ver_no_db" ]; then | "$ntp_ver_no_tmp" -gt "$ntp_ver_no_db" ]; then | ||||
$verbose using $url as $ntp_db_leapfile | $verbose using $url as $ntp_db_leapfile | ||||
mv -f $_ntp_tmp_leapfile $ntp_db_leapfile || | mv -f $_ntp_tmp_leapfile $ntp_db_leapfile || | ||||
$verbose "warning: cannot replace $ntp_db_leapfile (read-only fs?)" | $verbose "warning: cannot replace $ntp_db_leapfile (read-only fs?)" | ||||
else | else | ||||
$verbose using existing $ntp_db_leapfile | $verbose using existing $ntp_db_leapfile | ||||
fi | fi | ||||
fi | fi | ||||
} | } | ||||
run_rc_command "$1" | run_rc_command "$1" |
Oops, typo here, already fixed locally; it'll be nullfs on the next rev.