Compare commits

..

4 commits

Author SHA1 Message Date
Miroslav Lichvar
4755f5c734 4.6.1-1 2024-10-08 15:48:07 +02:00
Miroslav Lichvar
ae5528322b update to 4.6.1 2024-10-08 15:47:45 +02:00
Miroslav Lichvar
d2eb69700d 4.6-1 2024-09-03 10:36:45 +02:00
Fedora Release Engineering
bd5c061d02 update to 4.6 2024-09-03 10:36:31 +02:00
10 changed files with 65 additions and 328 deletions

6
.gitignore vendored
View file

@ -1,3 +1,3 @@
/chrony-4.8-tar-gz-asc.txt
/chrony-4.8.tar.gz
/clknetsim-6ee99f50dec8.tar.gz
/chrony-4.6.1.tar.gz
/chrony-4.6.1-tar-gz-asc.txt
/clknetsim-64df92.tar.gz

15
chrony-defconfig.patch Normal file
View file

@ -0,0 +1,15 @@
diff --git a/examples/chrony.conf.example2 b/examples/chrony.conf.example2
index 03e7d47b..bf2bbdda 100644
--- a/examples/chrony.conf.example2
+++ b/examples/chrony.conf.example2
@@ -37,8 +37,8 @@ ntsdumpdir /var/lib/chrony
# Insert/delete leap seconds by slewing instead of stepping.
#leapsecmode slew
-# Set the TAI-UTC offset of the system clock.
-#leapseclist /usr/share/zoneinfo/leap-seconds.list
+# Get TAI-UTC offset and leap seconds from the system tz database.
+#leapsectz right/UTC
# Specify directory for log files.
logdir /var/log/chrony

View file

@ -1,194 +0,0 @@
commit 03875f1ea5c4c0eeeb30a7d1fc5fdd53236f4ac2
Author: Miroslav Lichvar <mlichvar@redhat.com>
Date: Tue Oct 21 14:06:38 2025 +0200
sys_linux: allow ioctl(TCGETS2) in seccomp filter
Add TCGETS2 to the list of allowed ioctls. It seems to be called by the
latest glibc version from isatty(), which is called from libpcsclite
used by gnutls in an NTS-KE session.
Include the linux termios header instead of glibc header to get a usable
definition of TCGETS2.
diff --git a/sys_linux.c b/sys_linux.c
index ca5540f2..e20e459d 100644
--- a/sys_linux.c
+++ b/sys_linux.c
@@ -48,7 +48,7 @@
#ifdef FEAT_SCFILTER
#include <sys/prctl.h>
#include <seccomp.h>
-#include <termios.h>
+#include <linux/termios.h>
#ifdef FEAT_PPS
#include <linux/pps.h>
#endif
@@ -615,7 +615,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
const static int fcntls[] = { F_GETFD, F_SETFD, F_GETFL, F_SETFL };
const static unsigned long ioctls[] = {
- FIONREAD, TCGETS, TIOCGWINSZ,
+ FIONREAD, TCGETS, TCGETS2, TIOCGWINSZ,
#if defined(FEAT_PHC) || defined(HAVE_LINUX_TIMESTAMPING)
PTP_EXTTS_REQUEST, PTP_SYS_OFFSET,
#ifdef PTP_PIN_SETFUNC
commit 3c39afa13c769452d4c340bfc987e229b7c9caeb
Author: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed Oct 22 10:53:11 2025 +0200
sys_linux: fix building with older compilers and some archs
The recent replacement of <termios.h> with <linux/termios.h> to get
TCGETS2 seems to work only with compilers (or C standards) that allow
the same structure to be defined multiple times. There is a conflict
between <sys/ioctl.h> and <linux/termios.h>.
Another problem is that TCGETS2 is not used on some archs like ppc64.
Switch back to <termios.h> and move TCGETS2 to a list in a separate
file where it can be compiled without <sys/ioctl.h>.
Fixes: 03875f1ea5c4 ("sys_linux: allow ioctl(TCGETS2) in seccomp filter")
diff --git a/configure b/configure
index 195b1ed7..ca64475d 100755
--- a/configure
+++ b/configure
@@ -808,6 +808,7 @@ then
# a time and the async resolver would block the main thread
priv_ops="NAME2IPADDRESS RELOADDNS"
EXTRA_LIBS="$EXTRA_LIBS -lseccomp"
+ EXTRA_OBJECTS="$EXTRA_OBJECTS sys_linux_scmp.o"
fi
if [ "x$priv_ops" != "x" ]; then
diff --git a/sys_linux.c b/sys_linux.c
index e20e459d..89eec950 100644
--- a/sys_linux.c
+++ b/sys_linux.c
@@ -48,7 +48,7 @@
#ifdef FEAT_SCFILTER
#include <sys/prctl.h>
#include <seccomp.h>
-#include <linux/termios.h>
+#include <termios.h>
#ifdef FEAT_PPS
#include <linux/pps.h>
#endif
@@ -63,6 +63,7 @@
#endif
#include "sys_linux.h"
+#include "sys_linux_scmp.h"
#include "sys_timex.h"
#include "conf.h"
#include "local.h"
@@ -615,7 +616,7 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
const static int fcntls[] = { F_GETFD, F_SETFD, F_GETFL, F_SETFL };
const static unsigned long ioctls[] = {
- FIONREAD, TCGETS, TCGETS2, TIOCGWINSZ,
+ FIONREAD, TCGETS, TIOCGWINSZ,
#if defined(FEAT_PHC) || defined(HAVE_LINUX_TIMESTAMPING)
PTP_EXTTS_REQUEST, PTP_SYS_OFFSET,
#ifdef PTP_PIN_SETFUNC
@@ -728,6 +729,14 @@ SYS_Linux_EnableSystemCallFilter(int level, SYS_ProcessContext context)
SCMP_A1(SCMP_CMP_EQ, ioctls[i])) < 0)
goto add_failed;
}
+
+ /* Allow selected ioctls that need to be specified in a separate
+ file to avoid conflicting headers (e.g. TCGETS2) */
+ for (i = 0; SYS_Linux_GetExtraScmpIoctl(i) != 0; i++) {
+ if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 1,
+ SCMP_A1(SCMP_CMP_EQ, SYS_Linux_GetExtraScmpIoctl(i))) < 0)
+ goto add_failed;
+ }
}
if (seccomp_load(ctx) < 0)
diff --git a/sys_linux_scmp.c b/sys_linux_scmp.c
new file mode 100644
index 00000000..a907a97d
--- /dev/null
+++ b/sys_linux_scmp.c
@@ -0,0 +1,44 @@
+/*
+ chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar 2025
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ **********************************************************************
+
+ =======================================================================
+
+ Lists of values that are needed in seccomp filters but need to
+ be compiled separately from sys_linux.c due to conflicting headers.
+ */
+
+#include <linux/termios.h>
+
+#include "sys_linux_scmp.h"
+
+unsigned long
+SYS_Linux_GetExtraScmpIoctl(int index)
+{
+ const unsigned long ioctls[] = {
+#ifdef TCGETS2
+ /* Conflict between <linux/termios.h> and <sys/ioctl.h> */
+ TCGETS2,
+#endif
+ 0
+ };
+
+ return ioctls[index];
+}
diff --git a/sys_linux_scmp.h b/sys_linux_scmp.h
new file mode 100644
index 00000000..62a9d548
--- /dev/null
+++ b/sys_linux_scmp.h
@@ -0,0 +1,28 @@
+/*
+ chronyd/chronyc - Programs for keeping computer clocks accurate.
+
+ **********************************************************************
+ * Copyright (C) Miroslav Lichvar 2025
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ **********************************************************************
+
+ =======================================================================
+
+ Header file for lists that are needed in seccomp filters but need to
+ be compiled separately from sys_linux.c due to conflicting headers.
+ */
+
+extern unsigned long SYS_Linux_GetExtraScmpIoctl(int index);

View file

@ -1,18 +0,0 @@
diff -up chrony-4.7/examples/chronyd.service.servicedirs chrony-4.7/examples/chronyd.service
--- chrony-4.7/examples/chronyd.service.servicedirs 2025-06-11 15:06:19.000000000 +0200
+++ chrony-4.7/examples/chronyd.service 2025-07-10 12:06:57.354215498 +0200
@@ -10,7 +10,13 @@ Type=notify
PIDFile=/run/chrony/chronyd.pid
Environment="OPTIONS="
EnvironmentFile=-/etc/sysconfig/chronyd
-ExecStart=/usr/sbin/chronyd -n $OPTIONS
+ExecStart=!/usr/sbin/chronyd -n $OPTIONS
+
+User=chrony
+LogsDirectory=chrony
+LogsDirectoryMode=0750
+StateDirectory=chrony
+StateDirectoryMode=0750
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE

View file

@ -1,5 +1,5 @@
%global _hardened_build 1
%global clknetsim_ver 6ee99f50dec8
%global clknetsim_ver 64df92
%bcond_without debug
%bcond_without nts
@ -8,8 +8,8 @@
%endif
Name: chrony
Version: 4.8
Release: 3%{?dist}
Version: 4.6.1
Release: 1%{?dist}
Summary: An NTP client/server
License: GPL-2.0-only
@ -25,10 +25,8 @@ Source10: https://gitlab.com/chrony/clknetsim/-/archive/master/clknetsim-%
# add distribution-specific bits to DHCP dispatcher
Patch1: chrony-nm-dispatcher-dhcp.patch
# let systemd create /var/lib/chrony and /var/log/chrony
Patch2: chrony-servicedirs.patch
# update seccomp filter for new glibc
Patch3: chrony-seccomp.patch
# revert upstream changes in packaged configuration examples
Patch2: chrony-defconfig.patch
BuildRequires: libcap-devel libedit-devel nettle-devel pps-tools-devel
BuildRequires: gcc gcc-c++ make bison systemd gnupg2
@ -38,9 +36,12 @@ BuildRequires: gcc gcc-c++ make bison systemd gnupg2
%{?systemd_requires}
%{?sysusers_requires_compat}
# Needed by the leapseclist directive in default chrony.conf
# Needed by the leapsectz directive in default chrony.conf
Requires: tzdata
# Old NetworkManager expects the dispatcher scripts in a different place
Conflicts: NetworkManager < 1.20
# suggest drivers for hardware reference clocks
Suggests: ntp-refclock
@ -60,20 +61,19 @@ service to other computers in the network.
%setup -q -n %{name}-%{version}%{?prerelease} -a 10
%{?gitpatch:%patch -P 0 -p1}
%patch -P 1 -p1 -b .nm-dispatcher-dhcp
%patch -P 2 -p1 -b .servicedirs
%patch -P 3 -p1 -b .seccomp
%patch -P 2 -p1 -b .defconfig
%{?gitpatch: echo %{version}-%{gitpatch} > version.txt}
# review changes in packaged configuration files and scripts
md5sum -c <<-EOF | (! grep -v 'OK$')
5530d6e60f84b76c27495485d2510bac examples/chrony-wait.service
3f2ddca6065c3e8f4565d7422739795a examples/chrony.conf.example2
2d01b94bc1a7b7fb70cbee831488d121 examples/chrony.conf.example2
6a3178c4670de7de393d9365e2793740 examples/chrony.logrotate
c3992e2f985550739cd1cd95f98c9548 examples/chrony.nm-dispatcher.dhcp
4e85d36595727318535af3387411070c examples/chrony.nm-dispatcher.onoffline
607c82f56639486f52c31105632909eb examples/chronyd.service
5ddbb8a8055f587cb6b0b462ca73ea46 examples/chronyd-restricted.service
c11159b78b89684eca773db6236a9855 examples/chronyd.service
46fa3e2d42c8eb9c42e71095686c90ed examples/chronyd-restricted.service
EOF
# don't allow packaging without vendor zone
@ -81,10 +81,10 @@ test -n "%{vendorzone}"
# use example chrony.conf as the default config with some modifications:
# - use our vendor zone (2.*pool.ntp.org names include IPv6 addresses)
# - enable leapseclist to get TAI-UTC offset and leap seconds
# - enable leapsectz to get TAI-UTC offset and leap seconds from tzdata
# - use NTP servers from DHCP
sed -e 's|^\(pool \)\(pool.ntp.org\)|\12.%{vendorzone}\2|' \
-e 's|#\(leapseclist\)|\1|' \
-e 's|#\(leapsectz\)|\1|' \
-e 's|^pool.*pool.ntp.org.*|&\n\n# Use NTP servers from DHCP.\nsourcedir /run/chrony-dhcp|' \
< examples/chrony.conf.example2 > chrony.conf
@ -108,7 +108,6 @@ mv clknetsim-*-%{clknetsim_ver}* test/simulation/clknetsim
--chronyrundir=/run/chrony \
--docdir=%{_docdir} \
--with-ntp-era=$(date -d '1970-01-01 00:00:00+00:00' +'%s') \
--with-chronyc-user=chrony \
--with-user=chrony \
--with-hwclockfile=%{_sysconfdir}/adjtime \
--with-pidfile=/run/chrony/chronyd.pid \
@ -203,56 +202,18 @@ fi
%{_unitdir}/chrony*.service
%{_sysusersdir}/chrony.conf
%{_mandir}/man[158]/%{name}*.[158]*
%ghost %dir %attr(750,chrony,chrony) %{_localstatedir}/lib/chrony
%dir %attr(750,chrony,chrony) %{_localstatedir}/lib/chrony
%ghost %attr(-,chrony,chrony) %{_localstatedir}/lib/chrony/drift
%ghost %attr(-,chrony,chrony) %{_localstatedir}/lib/chrony/rtc
%ghost %dir %attr(750,chrony,chrony) %{_localstatedir}/log/chrony
%dir %attr(750,chrony,chrony) %{_localstatedir}/log/chrony
%changelog
* Tue Oct 21 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.8-3
- update seccomp filter for new glibc (#2405310)
* Mon Sep 08 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.8-2
- drop root privileges in chronyc by default
* Wed Aug 27 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.8-1
- update to 4.8
* Thu Aug 14 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.8-0.1.pre1
- update to 4.8-pre1
* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.7-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Thu Jul 10 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.7-2
- let systemd create /var/lib/chrony and /var/log/chrony (#2372944)
- drop workaround for broken build on aarch64
- drop old conflict with NetworkManager
* Wed Jun 11 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.7-1
- update to 4.7
* Thu May 22 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.7-0.2.pre1
- add workaround for broken build on aarch64
* Wed May 21 2025 Miroslav Lichvar <mlichvar@redhat.com> 4.7-0.1.pre1
- update to 4.7-pre1
* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.6.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Tue Oct 08 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.6.1-1
- update to 4.6.1
* Mon Sep 02 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.6-1
* Tue Sep 03 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.6-1
- update to 4.6
* Tue Jul 30 2024 Miroslav Lichvar <mlichvar@redhat.com> 4.6-0.1.pre1
- update to 4.6-pre1
* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.5-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

View file

@ -4,8 +4,8 @@ product_versions:
decision_context: bodhi_update_push_testing
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional}
#Rawhide
--- !Policy
product_versions:
@ -13,13 +13,15 @@ product_versions:
decision_context: bodhi_update_push_stable
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional}
#gating rhel
--- !Policy
product_versions:
- rhel-*
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional}
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation}
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional}

View file

@ -1,47 +0,0 @@
/tier1-internal:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/tier1/internal
adjust:
enabled: false
when: distro == centos-stream, fedora
because: They don't have access to internal repos.
/tier1-public:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/tier1/public
/tier2-tier3-internal:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/tier2-tier3/internal
adjust:
enabled: false
when: distro == centos-stream, fedora
because: They don't have access to internal repos.
/tier2-tier3-public:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/tier2-tier3/public
/others-internal:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/others/internal
adjust:
enabled: false
when: distro == centos-stream, fedora
because: They don't have access to internal repos.
/others-public:
plan:
import:
url: https://gitlab.com/redhat/centos-stream/tests/chrony.git
name: /plans/others/public

6
plans/public.fmf Normal file
View file

@ -0,0 +1,6 @@
summary: Test plan with all Fedora tests
discover:
how: fmf
url: https://src.fedoraproject.org/tests/chrony.git
execute:
how: tmt

12
plans/tier1-internal.fmf Normal file
View file

@ -0,0 +1,12 @@
summary: CI plan, picks internal Tier1 tests, runs in beakerlib.
discover:
- name: rhel
how: fmf
filter: 'tier: 1'
url: git://pkgs.devel.redhat.com/tests/chrony
execute:
how: tmt
adjust:
enabled: false
when: distro == centos-stream, fedora
because: They don't have access to internal repos.

View file

@ -1,3 +1,3 @@
SHA512 (chrony-4.8-tar-gz-asc.txt) = df7f4e06f74a4b8c9a49e8fe57ea02e0324c5683d036412c32192a09f08e08f33537609cef8df0b4302bfcd63332b3092f33f40c8d02857c93ecea13822b5b47
SHA512 (chrony-4.8.tar.gz) = 949b796bb34db32a5c1b9e6b53be6a22e51c59f24a316d585b8a52a52ab1f61bdf0378dc58b282bb0ba4fac1f05e1e99fbe37cb4259aa2b359e7bf679c176aab
SHA512 (clknetsim-6ee99f50dec8.tar.gz) = 2621d1c44b84b42fcdf644f236ff90dab9f8a8407a138c8719c53dd9c4f21480db3b4ba598116aa1b9d6bd1fa02fc410d85a43baf55ddf8ad47fc09aba4c4477
SHA512 (chrony-4.6.1.tar.gz) = 646ae08f2587366236796f2399d8ab3eb570979e0d82f5d13f5cec49939054c876cc93dc20c8d38e105fd3500e1720d05a223a15076783cd882d0de43afd9c7e
SHA512 (chrony-4.6.1-tar-gz-asc.txt) = 992b706636bf3a7eb6d502562a4990c9d8e20e5f3011d2cdb2ceb32220e9a1c2bfa6eca767212cee49b811823872602dc33f9e7201a7f9a93cc9c90e81b1db49
SHA512 (clknetsim-64df92.tar.gz) = 3253e6823b66f23f63203aad0ea22c25cf9d1f5af789722662f4d383111cb2c1816cb23d2fa06171a65b102ae82a5371376becb029d7c9b163b0aee710374c02