committing changes in /etc made by "apt install chrony"

Packages with configuration changes:
+chrony 4.0-8+deb11u2 armhf

Package changes:
+chrony 4.0-8+deb11u2 armhf

.etckeeper

@@ -521,6 +521,7 @@ maybe chmod 0644 'apparmor.d/local/usr.lib.libreoffice.program.oosplash'
 maybe chmod 0644 'apparmor.d/local/usr.lib.libreoffice.program.senddoc'
 maybe chmod 0644 'apparmor.d/local/usr.lib.libreoffice.program.soffice.bin'
 maybe chmod 0644 'apparmor.d/local/usr.lib.libreoffice.program.xpdfimport'
+maybe chmod 0644 'apparmor.d/local/usr.sbin.chronyd'
 maybe chmod 0644 'apparmor.d/local/usr.sbin.cups-browsed'
 maybe chmod 0644 'apparmor.d/local/usr.sbin.cupsd'
 maybe chmod 0644 'apparmor.d/local/usr.sbin.named'
@@ -552,6 +553,7 @@ maybe chmod 0644 'apparmor.d/usr.lib.libreoffice.program.oosplash'
 maybe chmod 0644 'apparmor.d/usr.lib.libreoffice.program.senddoc'
 maybe chmod 0644 'apparmor.d/usr.lib.libreoffice.program.soffice.bin'
 maybe chmod 0644 'apparmor.d/usr.lib.libreoffice.program.xpdfimport'
+maybe chmod 0644 'apparmor.d/usr.sbin.chronyd'
 maybe chmod 0644 'apparmor.d/usr.sbin.cups-browsed'
 maybe chmod 0644 'apparmor.d/usr.sbin.cupsd'
 maybe chmod 0644 'apparmor.d/usr.sbin.mariadbd'
@@ -623,6 +625,13 @@ maybe chmod 0644 'chromium/master_preferences'
 maybe chmod 0755 'chromium/policies'
 maybe chmod 0755 'chromium/policies/managed'
 maybe chmod 0755 'chromium/policies/recommended'
+maybe chmod 0755 'chrony'
+maybe chmod 0644 'chrony/chrony.conf'
+maybe chmod 0640 'chrony/chrony.keys'
+maybe chmod 0755 'chrony/conf.d'
+maybe chmod 0644 'chrony/conf.d/README'
+maybe chmod 0755 'chrony/sources.d'
+maybe chmod 0644 'chrony/sources.d/README'
 maybe chmod 0755 'cifs-utils'
 maybe chmod 0755 'config.txt'
 maybe chmod 0755 'console-setup'
@@ -729,6 +738,7 @@ maybe chmod 0755 'default'
 maybe chmod 0644 'default/avahi-daemon'
 maybe chmod 0644 'default/bluetooth'
 maybe chmod 0600 'default/cacerts'
+maybe chmod 0644 'default/chrony'
 maybe chmod 0644 'default/console-setup'
 maybe chmod 0644 'default/crda'
 maybe chmod 0644 'default/cron'
@@ -1252,6 +1262,7 @@ maybe chmod 0755 'dhcp/dhclient-enter-hooks.d'
 maybe chmod 0644 'dhcp/dhclient-enter-hooks.d/resolvconf'
 maybe chmod 0755 'dhcp/dhclient-enter-hooks.d/samba'
 maybe chmod 0755 'dhcp/dhclient-exit-hooks.d'
+maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/chrony'
 maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes'
 maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/rfc3442-classless-routes.dpkg-new'
 maybe chmod 0644 'dhcp/dhclient-exit-hooks.d/timesyncd'
@@ -1665,6 +1676,7 @@ maybe chmod 0755 'init.d/alsa-utils'
 maybe chmod 0755 'init.d/apparmor'
 maybe chmod 0755 'init.d/avahi-daemon'
 maybe chmod 0755 'init.d/bluetooth'
+maybe chmod 0755 'init.d/chrony'
 maybe chmod 0755 'init.d/console-setup.sh'
 maybe chmod 0755 'init.d/cron'
 maybe chmod 0755 'init.d/cups'
@@ -1864,6 +1876,7 @@ maybe chmod 0644 'logrotate.d/alternatives'
 maybe chmod 0644 'logrotate.d/apt'
 maybe chmod 0644 'logrotate.d/bootlog'
 maybe chmod 0644 'logrotate.d/btmp'
+maybe chmod 0644 'logrotate.d/chrony'
 maybe chmod 0644 'logrotate.d/cups-daemon'
 maybe chmod 0644 'logrotate.d/dpkg'
 maybe chmod 0644 'logrotate.d/fail2ban'
@@ -1925,6 +1938,7 @@ maybe chmod 0755 'network/if-down.d'
 maybe chmod 0755 'network/if-down.d/bind9'
 maybe chmod 0755 'network/if-down.d/resolvconf'
 maybe chmod 0755 'network/if-post-down.d'
+maybe chmod 0755 'network/if-post-down.d/chrony'
 maybe chmod 0755 'network/if-post-down.d/wireless-tools'
 maybe chmod 0755 'network/if-pre-up.d'
 maybe chmod 0755 'network/if-pre-up.d/ethtool'
@@ -1932,6 +1946,7 @@ maybe chmod 0755 'network/if-pre-up.d/wireless-tools'
 maybe chmod 0755 'network/if-up.d'
 maybe chmod 0755 'network/if-up.d/000resolvconf'
 maybe chmod 0755 'network/if-up.d/bind9'
+maybe chmod 0755 'network/if-up.d/chrony'
 maybe chmod 0755 'network/if-up.d/ethtool'
 maybe chmod 0644 'network/interfaces'
 maybe chmod 0755 'network/interfaces.d'
@@ -2167,9 +2182,11 @@ maybe chmod 0755 'ppp'
 maybe chmod 0755 'ppp/ip-down.d'
 maybe chmod 0755 'ppp/ip-down.d/000resolvconf'
 maybe chmod 0755 'ppp/ip-down.d/bind9'
+maybe chmod 0755 'ppp/ip-down.d/chrony'
 maybe chmod 0755 'ppp/ip-up.d'
 maybe chmod 0755 'ppp/ip-up.d/000resolvconf'
 maybe chmod 0755 'ppp/ip-up.d/bind9'
+maybe chmod 0755 'ppp/ip-up.d/chrony'
 maybe chmod 0644 'profile'
 maybe chmod 0755 'profile.d'
 maybe chmod 0644 'profile.d/Z97-byobu.sh'

apparmor.d/usr.sbin.chronyd

@@ -0,0 +1,81 @@
+# Last Modified: Sat Jan 20 10:45:05 2018
+#include <tunables/global>
+
+/usr/sbin/chronyd flags=(attach_disconnected) {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  # For /run/chrony to be created
+  capability chown,
+
+  # Give “root” the ability to read and write the PID file
+  capability dac_override,
+  capability dac_read_search,
+
+  # Needed to support HW timestamping
+  capability net_admin,
+
+  # Needed to allow NTP server sockets to be bound to a privileged port
+  capability net_bind_service,
+
+  # Needed to allow an NTP socket to be bound to a device using the
+  # SO_BINDTODEVICE socket option on kernels before 5.7
+  capability net_raw,
+
+  # Needed to drop privileges
+  capability setgid,
+  capability setuid,
+
+  # Needed to set the SCHED_FIFO real-time scheduler at the specified priority
+  # using the '-P' option
+  capability sys_nice,
+
+  # Needed to lock chronyd into RAM
+  capability sys_resource,
+
+  # Needed to set the system/real-time clock
+  capability sys_time,
+
+  /usr/sbin/chronyd mr,
+
+  /etc/chrony/{,**} r,
+  /var/lib/chrony/{,*} rw,
+  /var/log/chrony/{,*} rw,
+  @{run}/chrony/{,*} rw,
+  @{run}/chrony-dhcp/{,*} r,
+
+  # Using the “tempcomp” directive gives chronyd the ability to improve
+  # the stability and accuracy of the clock by compensating the temperature
+  # changes measured by a sensor close to the oscillator.
+  @{sys}/class/hwmon/hwmon[0-9]*/temp[0-9]*_input r,
+  @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/hwmon[0-9]*/temp[0-9]*_input r,
+
+  # Support all paths suggested in the man page (LP: #1771028). Assume these
+  # are common use cases; others should be set as local include (see below).
+  # Configs using a 'chrony.' prefix like the tempcomp config file example
+  /etc/chrony.* r,
+  # Example gpsd socket is outside @{run}/chrony/
+  @{run}/chrony.tty{,*}.sock rw,
+  # To sign replies to MS-SNTP clients by the smbd daemon
+  /var/lib/samba/ntp_signd/socket rw,
+
+  # rtc
+  /etc/adjtime r,
+  /dev/rtc{,[0-9]*} rw,
+
+  # gps devices
+  /dev/pps[0-9]* rw,
+  /dev/ptp[0-9]* rw,
+
+  # Allow reading the chronyd configuration file that timemaster(8) generates
+  @{run}/timemaster/chrony.conf r,
+
+  # For use with clocks that report via shared memory (e.g. gpsd),
+  # you may need to give ntpd access to all of shared memory, though
+  # this can be considered dangerous. See https://launchpad.net/bugs/722815
+  # for details. To enable, add this to local/usr.sbin.chronyd:
+  #     capability ipc_owner,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.chronyd>
+}

chrony/chrony.conf

@@ -0,0 +1,47 @@
+# Welcome to the chrony configuration file. See chrony.conf(5) for more
+# information about usable directives.
+
+# Include configuration files found in /etc/chrony/conf.d.
+confdir /etc/chrony/conf.d
+
+# Use Debian vendor zone.
+pool 2.debian.pool.ntp.org iburst
+
+# Use time sources from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Use NTP sources found in /etc/chrony/sources.d.
+sourcedir /etc/chrony/sources.d
+
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/chrony.drift
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
+rtcsync
+
+# Step the system clock instead of slewing it if the adjustment is larger than
+# one second, but only in the first three clock updates.
+makestep 1 3
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+# This directive must be commented out when using time sources serving
+# leap-smeared time.
+leapsectz right/UTC

chrony/chrony.keys

@@ -0,0 +1,10 @@
+# This file is solely used for NTP authentication with symmetric keys
+# as defined by RFC 1305 and RFC 5905.
+#
+# It can contain ID/key pairs which can be generated using the “keygen” option
+# from “chronyc”; for example:
+# chronyc keygen 1 SHA256 256 >> /etc/chrony/chrony.keys
+# would generate a 256-bit SHA-256 key using ID 1.
+#
+# A list of supported hash functions and output encoding is available by
+# consulting the "keyfile" directive in the chrony.conf(5) man page.

chrony/conf.d/README

@@ -0,0 +1,7 @@
+Files found under the /etc/chrony/conf.d directory with the .conf suffix are
+parsed in the lexicographical order of the file names when chronyd starts up.
+This enables a fragmented configuration of chronyd.
+
+Although those files can contain any directives listed in chrony.conf(5),
+it would be wiser to add NTP sources in the /etc/chrony/sources.d
+directory. Please read /etc/chrony/sources.d/README for more information.

chrony/sources.d/README

@@ -0,0 +1,11 @@
+Only NTP sources can be specified in the /etc/chrony/sources.d directory.
+Files in this directory must end with the ".sources" suffix, and can only
+contain the "peer", "pool" and "server" directives.
+
+There is no need to restart chronyd for these time sources to be usable,
+running 'chronyc reload sources' is sufficient.
+
+Example:
+
+# echo 'server 192.0.2.1 iburst' > /etc/chrony/sources.d/local-ntp-server.sources
+# chronyc reload sources

default/chrony

@@ -0,0 +1,6 @@
+# This is a configuration file for /etc/init.d/chrony and
+# /lib/systemd/system/chrony.service; it allows you to pass various options to
+# the chrony daemon without editing the init script or service file.
+
+# Options to pass to chrony.
+DAEMON_OPTS="-F 1"

group

@@ -72,3 +72,4 @@ pihole:x:995:www-data
 pihole-sync:x:1001:
 tvdisplay:x:1002:
 mysql:x:127:
+_chrony:x:128:

group-

@@ -68,6 +68,7 @@ geoclue:x:125:
 systemd-coredump:x:996:
 jgdye:x:1000:
 bind:x:126:
-pihole:x:995:
+pihole:x:995:www-data
 pihole-sync:x:1001:
 tvdisplay:x:1002:
+mysql:x:127:

gshadow

@@ -72,3 +72,4 @@ pihole:!::
 pihole-sync:!::
 tvdisplay:!::
 mysql:!::
+_chrony:!::

gshadow-

@@ -71,3 +71,4 @@ bind:!::
 pihole:!::
 pihole-sync:!::
 tvdisplay:!::
+mysql:!::

init.d/chrony

@@ -0,0 +1,69 @@
+#! /bin/sh
+#
+# Written by Miquel van Smoorenburg <miquels@drinkel.ow.org>.
+# Modified for Debian GNU/Linux by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+# Modified for Debian by Christoph Lameter <clameter@debian.org>
+# Modified for chrony by John Hasler <jhasler@debian.org> 1998-2012
+# Modified for Debian by Vincent Blut <vincent.debian@free.fr>
+
+### BEGIN INIT INFO
+# Provides:          chrony
+# Required-Start:    $remote_fs
+# Required-Stop:     $remote_fs
+# Should-Start:      $syslog $network $named $time
+# Should-Stop:       $syslog $network $named $time
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Controls chronyd NTP time daemon
+# Description:       Chronyd is the NTP time daemon in the Chrony package
+### END INIT INFO
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+DAEMON=/usr/sbin/chronyd
+NAME="chronyd"
+DESC="time daemon"
+PIDFILE=/run/chrony/chronyd.pid
+
+[ -x "$DAEMON" ] || exit 0
+
+. /lib/lsb/init-functions
+
+# Override this variable by editing /etc/default/chrony.
+DAEMON_OPTS=""
+if [ -f /etc/default/chrony ]; then
+    . /etc/default/chrony
+fi
+
+case "$1" in
+    start)
+        if $0 status > /dev/null ; then
+            log_success_msg "$NAME is already running"
+        else
+            log_daemon_msg "Starting $DESC" "$NAME"
+            start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS
+            log_end_msg $?
+        fi
+        ;;
+
+    stop)
+        log_daemon_msg "Stopping $DESC" "$NAME"
+        start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON
+        log_end_msg $?
+        ;;
+
+    restart|force-reload)
+        $0 stop
+        $0 start
+        ;;
+
+    status)
+        status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $?
+        ;;
+
+    *)
+        log_action_msg "Usage: /etc/init.d/chrony {start|stop|restart|force-reload|status}"
+        exit 1
+        ;;
+esac
+
+exit 0

logrotate.d/chrony

@@ -0,0 +1,8 @@
+/var/log/chrony/*.log {
+    missingok
+    nocreate
+    sharedscripts
+    postrotate
+        /usr/bin/chronyc cyclelogs > /dev/null 2>&1 || true
+    endscript
+}

network/if-post-down.d/chrony

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -x /usr/sbin/chronyd ] || exit 0
+
+if [ -e /run/chrony/chronyd.pid ]; then
+    chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0

network/if-up.d/chrony

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -x /usr/sbin/chronyd ] || exit 0
+
+if [ -e /run/chrony/chronyd.pid ]; then
+    chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0

passwd

@@ -40,3 +40,4 @@ pihole:x:999:995::/home/pihole:/usr/sbin/nologin
 pihole-sync:x:1001:1001:Pihole Sync User,,,:/home/pihole-sync:/bin/bash
 tvdisplay:x:1002:1002:User for GUI,,,:/home/tvdisplay:/bin/bash
 mysql:x:118:127:MySQL Server,,,:/nonexistent:/bin/false
+_chrony:x:119:128:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin

passwd-

@@ -39,4 +39,5 @@ bind:x:117:126::/var/cache/bind:/usr/sbin/nologin
 pihole:x:999:995::/home/pihole:/usr/sbin/nologin
 pihole-sync:x:1001:1001:Pihole Sync User,,,:/home/pihole-sync:/bin/bash
 tvdisplay:x:1002:1002:User for GUI,,,:/home/tvdisplay:/bin/bash
-mysql:x:118:127::/nonexistent:/bin/false
+mysql:x:118:127:MySQL Server,,,:/nonexistent:/bin/false
+_chrony:x:119:128::/var/lib/chrony:/usr/sbin/nologin

ppp/ip-down.d/chrony

@@ -0,0 +1,13 @@
+#!/bin/sh
+# This script tells chronyd that the connection is down
+# so that it won't try to contact the server. 
+# John Hasler <jhasler@debian.org>  1998-2003
+# Any possessor of a copy of this program may treat it as if it
+# were in the public domain.  I waive all rights.
+# Modified by Vincent Blut <vincent.debian@free.fr>
+
+if [ -e /run/chrony/chronyd.pid ]; then
+    chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0

ppp/ip-up.d/chrony

@@ -0,0 +1,12 @@
+#!/bin/sh
+# This script tells chronyd that the connection is up so that it can
+# contact the server.  John Hasler <jhasler@debian.org> 1998-2003
+# Any possessor of a copy of this program may treat it as if it
+# were in the public domain.  I waive all rights.
+# Modified by Vincent Blut <vincent.debian@free.fr>
+
+if [ -e /run/chrony/chronyd.pid ]; then
+    chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0

rc0.d/K01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc1.d/K01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc2.d/S01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc3.d/S01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc4.d/S01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc5.d/S01chrony

@@ -0,0 +1 @@
+../init.d/chrony

rc6.d/K01chrony

@@ -0,0 +1 @@
+../init.d/chrony

shadow

@@ -40,3 +40,4 @@ pihole:!:18964::::::
 pihole-sync:$y$j9T$nwhfs/LBZJ9v9IXAmd24D.$vNn5BvbMGMoz69atUOPYpQNooSEPx1lGEXgSZTW05X6:19156:0:99999:7:::
 tvdisplay:$y$j9T$Th/Yl2X5wdClwV/EXWFEa1$aMHTMzcZ0kBwKXxyWp/yJlQ/8Un4Zp2XMhEj2wcvsnD:18965:0:99999:7:::
 mysql:!:19205:0:99999:7:::
+_chrony:*:19263:0:99999:7:::

shadow-

@@ -40,3 +40,4 @@ pihole:!:18964::::::
 pihole-sync:$y$j9T$nwhfs/LBZJ9v9IXAmd24D.$vNn5BvbMGMoz69atUOPYpQNooSEPx1lGEXgSZTW05X6:19156:0:99999:7:::
 tvdisplay:$y$j9T$Th/Yl2X5wdClwV/EXWFEa1$aMHTMzcZ0kBwKXxyWp/yJlQ/8Un4Zp2XMhEj2wcvsnD:18965:0:99999:7:::
 mysql:!:19205:0:99999:7:::
+_chrony:*:19263:0:99999:7:::

systemd/system/chronyd.service

@@ -0,0 +1 @@
+/lib/systemd/system/chrony.service

systemd/system/multi-user.target.wants/chrony.service

@@ -0,0 +1 @@
+/lib/systemd/system/chrony.service

systemd/system/systemd-timesyncd.service

@@ -0,0 +1 @@
+/dev/null