Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ntp: fix a missed syscall in seccomp #41831

Merged
merged 1 commit into from Jun 11, 2018
Merged

ntp: fix a missed syscall in seccomp #41831

merged 1 commit into from Jun 11, 2018

Conversation

cleverca22
Copy link
Contributor

ntpd uses openat to adjust the drift file, which it only does after a few hours of uptime
that syscall was missed in the previous PR that was fixing ntp

Motivation for this change

without these changes, ntpd will crash after a few hours of uptime

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@cleverca22
ntp: fix a missed syscall in seccomp
f115afa 
ntpd uses openat to adjust the drift file, which it only does after a few hours of uptime
@GrahamcOfBorg
Copy link

No attempt on x86_64-darwin (full log)

The following builds were skipped because they don't evaluate on x86_64-darwin: ntp

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

@GrahamcOfBorg
Copy link

Success on x86_64-linux (full log)

Attempted: ntp

Partial log (click to expand)

shrinking /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin/ntpq
shrinking /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin/ntp-keygen
shrinking /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin/ntptime
shrinking /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin/tickadj
gzipping man pages under /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/share/man/
strip is /nix/store/21ymadblbmsbb2bk4q7gl4kjasp8zmgd-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/libexec  /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin  /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/sbin
patching script interpreter paths in /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11
checking for references to /build in /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11...
moving /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/sbin/* to /nix/store/d4j8jg29rha73mfpc9a30jark64mr2bz-ntp-4.2.8p11/bin

Mic92
Mic92 reviewed Jun 11, 2018
View reviewed changes
pkgs/tools/networking/ntp/seccomp.patch
SCMP_SYS(select),
SCMP_SYS(setitimer),
SCMP_SYS(setsid),
+ SCMP_SYS(setsockopt),
+ SCMP_SYS(openat),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could try in parallel to send this patch upstream?

@Mic92 Mic92 merged commit c9206cd into NixOS:master Jun 11, 2018
@cleverca22 cleverca22 deleted the fix-ntpd-openat branch June 11, 2018 11:13
@GrahamcOfBorg
Copy link

Success on aarch64-linux (full log)

Attempted: ntp

Partial log (click to expand)

shrinking /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/bin/ntpdate
shrinking /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/bin/ntpd
shrinking /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/bin/sntp
gzipping man pages under /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/share/man/
strip is /nix/store/qg2agrqkf240s656d207zqhipl0bc2id-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/libexec  /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/bin  /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/sbin
patching script interpreter paths in /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11
checking for references to /build in /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11...
moving /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/sbin/* to /nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11/bin
/nix/store/hfbszfn6dlq8r35x4ajv40fksp3hlf86-ntp-4.2.8p11

@cleverca22 cleverca22 mentioned this pull request Jun 11, 2018
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mic92 Mic92 Mic92 left review comments

Assignees
No one assigned
Labels
10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@cleverca22 @GrahamcOfBorg @Mic92