You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

82 lines
2.5 KiB

This file contains invisible Unicode characters!

This file contains invisible Unicode characters that may be processed differently from what appears below. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to reveal hidden characters.

# Last Modified: Sat Jan 20 10:45:05 2018
#include <tunables/global>
/usr/sbin/chronyd flags=(attach_disconnected) {
#include <abstractions/base>
#include <abstractions/nameservice>
# For /run/chrony to be created
capability chown,
# Give “root” the ability to read and write the PID file
capability dac_override,
capability dac_read_search,
# Needed to support HW timestamping
capability net_admin,
# Needed to allow NTP server sockets to be bound to a privileged port
capability net_bind_service,
# Needed to allow an NTP socket to be bound to a device using the
# SO_BINDTODEVICE socket option on kernels before 5.7
capability net_raw,
# Needed to drop privileges
capability setgid,
capability setuid,
# Needed to set the SCHED_FIFO real-time scheduler at the specified priority
# using the '-P' option
capability sys_nice,
# Needed to lock chronyd into RAM
capability sys_resource,
# Needed to set the system/real-time clock
capability sys_time,
/usr/sbin/chronyd mr,
/etc/chrony/{,**} r,
/var/lib/chrony/{,*} rw,
/var/log/chrony/{,*} rw,
@{run}/chrony/{,*} rw,
@{run}/chrony-dhcp/{,*} r,
# Using the “tempcomp” directive gives chronyd the ability to improve
# the stability and accuracy of the clock by compensating the temperature
# changes measured by a sensor close to the oscillator.
@{sys}/class/hwmon/hwmon[0-9]*/temp[0-9]*_input r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]*/hwmon[0-9]*/temp[0-9]*_input r,
# Support all paths suggested in the man page (LP: #1771028). Assume these
# are common use cases; others should be set as local include (see below).
# Configs using a 'chrony.' prefix like the tempcomp config file example
/etc/chrony.* r,
# Example gpsd socket is outside @{run}/chrony/
@{run}/chrony.tty{,*}.sock rw,
# To sign replies to MS-SNTP clients by the smbd daemon
/var/lib/samba/ntp_signd/socket rw,
# rtc
/etc/adjtime r,
/dev/rtc{,[0-9]*} rw,
# gps devices
/dev/pps[0-9]* rw,
/dev/ptp[0-9]* rw,
# Allow reading the chronyd configuration file that timemaster(8) generates
@{run}/timemaster/chrony.conf r,
# For use with clocks that report via shared memory (e.g. gpsd),
# you may need to give ntpd access to all of shared memory, though
# this can be considered dangerous. See
# for details. To enable, add this to local/usr.sbin.chronyd:
# capability ipc_owner,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.chronyd>