[ntp:bk-ntp-stable-send] BitKeeper diffs

Harlan Stenn stenn at whimsy.udel.edu
Sun Feb 4 14:29:10 PST 2007


#### ChangeSet ####
2007-02-04 17:56:17+00:00, kardel at pogo.udel.edu 
  ntpd.c:
    comment clarification about capabilities used

==== ntpd/ntpd.c ====
2007-02-04 17:55:31+00:00, kardel at pogo.udel.edu +4 -7
  comment clarification about capabilities used

--- 1.83/ntpd/ntpd.c	2007-02-04 12:45:55 -05:00
+++ 1.84/ntpd/ntpd.c	2007-02-04 12:55:31 -05:00
@@ -932,11 +932,6 @@ getgroup:	
 	
 #ifndef HAVE_LINUX_CAPABILITIES
 		/*
-		 * TODO:
-		 * need to add more strategys for other systems that can bind to privileged ports
-		 * without being "root"
-		 */
-		/*
 		 * for now assume that the privilege to bind to privileged ports
 		 * is associated with running with uid 0 - should be refined on
 		 * ports that allow binding to NTP_PORT with uid != 0
@@ -951,8 +946,10 @@ getgroup:	
 
 #ifdef HAVE_LINUX_CAPABILITIES
 		do {
-			/*  We may be running under non-root uid now, but we still hold full root privileges!
-			 *  We drop all of them, except for the crucial one: cap_sys_time:
+			/*
+			 *  We may be running under non-root uid now, but we still hold full root privileges!
+			 *  We drop all of them, except for the crucial one or two: cap_sys_time and
+			 *  cap_net_bind_service if doing dynamic interface tracking.
 			 */
 			cap_t caps;
 			char *captext = interface_interval ?

#### ChangeSet ####
2007-02-04 17:47:20+00:00, kardel at pogo.udel.edu 
  ntpd.c:
    Bug 765:
    use Linux capability mechanism to allow dynamic interface tracking to continue in 
    unprivileged mode.

==== ntpd/ntpd.c ====
2007-02-04 17:45:55+00:00, kardel at pogo.udel.edu +11 -1
  Bug 765:
  use Linux capability mechanism to allow dynamic interface tracking to continue in 
  unprivileged mode.

--- 1.82/ntpd/ntpd.c	2006-09-23 13:23:04 -04:00
+++ 1.83/ntpd/ntpd.c	2007-02-04 12:45:55 -05:00
@@ -930,12 +930,19 @@ getgroup:	
 			exit (-1);
 		}
 	
+#ifndef HAVE_LINUX_CAPABILITIES
+		/*
+		 * TODO:
+		 * need to add more strategys for other systems that can bind to privileged ports
+		 * without being "root"
+		 */
 		/*
 		 * for now assume that the privilege to bind to privileged ports
 		 * is associated with running with uid 0 - should be refined on
 		 * ports that allow binding to NTP_PORT with uid != 0
 		 */
 		disable_dynamic_updates |= (sw_uid != 0);  /* also notifies routing message listener */
+#endif
 
 		if (disable_dynamic_updates && interface_interval) {
 			interface_interval = 0;
@@ -948,7 +955,10 @@ getgroup:	
 			 *  We drop all of them, except for the crucial one: cap_sys_time:
 			 */
 			cap_t caps;
-			if( ! ( caps = cap_from_text( "cap_sys_time=ipe" ) ) ) {
+			char *captext = interface_interval ?
+			       	"cap_sys_time,cap_net_bind_service=ipe" :
+			       	"cap_sys_time=ipe";
+			if( ! ( caps = cap_from_text( captext ) ) ) {
 				msyslog( LOG_ERR, "cap_from_text() failed: %m" );
 				exit(-1);
 			}


More information about the bk-ntp-stable-send mailing list