From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1281828-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 8518A1382C5
for <garchives@archives.gentoo.org>; Fri, 14 May 2021 11:32:02 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id C4414E0875;
Fri, 14 May 2021 11:32:01 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 8002DE0875
for <gentoo-commits@lists.gentoo.org>; Fri, 14 May 2021 11:32:01 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 5C455335C77
for <gentoo-commits@lists.gentoo.org>; Fri, 14 May 2021 11:32:00 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id BADB9643
for <gentoo-commits@lists.gentoo.org>; Fri, 14 May 2021 11:31:58 +0000 (UTC)
From: "Sam James" <sam@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" <sam@gentoo.org>
Message-ID: <1620991816.052a738de98495c1a0c93f92e4c77abb9b93602d.sam@gentoo>
Subject: [gentoo-commits] repo/gentoo:master commit in: net-misc/chrony/
X-VCS-Repository: repo/gentoo
X-VCS-Files: net-misc/chrony/chrony-9999.ebuild
X-VCS-Directories: net-misc/chrony/
X-VCS-Committer: sam
X-VCS-Committer-Name: Sam James
X-VCS-Revision: 052a738de98495c1a0c93f92e4c77abb9b93602d
X-VCS-Branch: master
Date: Fri, 14 May 2021 11:31:58 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: de16bc27-f9d5-4173-a695-283edbe44f63
X-Archives-Hash: 568958e3b4a2324bb597d2aff8e7c093
commit: 052a738de98495c1a0c93f92e4c77abb9b93602d
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Fri May 14 11:30:16 2021 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri May 14 11:30:16 2021 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=052a738d
net-misc/chrony: sync live ebuild
Signed-off-by: Sam James <sam <AT> gentoo.org>
net-misc/chrony/chrony-9999.ebuild | 51 +++++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 15 deletions(-)
diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-9999.ebuild
index c615418eb65..d3e68c8d012 100644
--- a/net-misc/chrony/chrony-9999.ebuild
+++ b/net-misc/chrony/chrony-9999.ebuild
@@ -70,12 +70,12 @@ if [[ ${PV} == "9999" ]] ; then
REQUIRED_USE+=" html"
BDEPEND+=" virtual/w3m"
else
- BDEPEND+=" verify-sig? ( app-crypt/openpgp-keys-mlichvar )"
+ BDEPEND+=" verify-sig? ( >=app-crypt/openpgp-keys-mlichvar-20210513 )"
fi
PATCHES=(
"${FILESDIR}"/${PN}-3.5-pool-vendor-gentoo.patch
- "${FILESDIR}"/${PN}-3.5-r3-systemd-gentoo.patch
+ "${FILESDIR}"/${PN}-4.1-systemd-gentoo.patch
)
src_prepare() {
@@ -85,7 +85,7 @@ src_prepare() {
-e 's:/etc/chrony\.conf:/etc/chrony/chrony.conf:g' \
doc/* examples/* || die
- cp "${FILESDIR}"/chronyd.conf "${T}"/chronyd.conf || die
+ cp "${FILESDIR}"/chronyd.conf-r3 "${T}"/chronyd.conf || die
}
src_configure() {
@@ -97,7 +97,7 @@ src_configure() {
if ! use seccomp ; then
sed -i \
- -e 's/ -F 0//' \
+ -e 's/ -F 2//' \
"${T}"/chronyd.conf examples/chronyd.service || die
fi
@@ -192,17 +192,24 @@ src_install() {
}
pkg_preinst() {
- HAD_CAPS=false
- HAD_SECCOMP=false
+ HAD_CAPS=0
+ HAD_SECCOMP=0
+ HAD_PRE_NEW_SECCOMP_LEVEL=0
# See https://dev.gentoo.org/~zmedico/portage/doc/portage.html#package-ebuild-phases-after-2.1.5
# in "Ebuild Phases" for an explanation of why we need to save the variable beforehand
if has_version 'net-misc/chrony[caps]' ; then
- HAD_CAPS=true
+ HAD_CAPS=1
fi
if has_version 'net-misc/chrony[seccomp]' ; then
- HAD_SECCOMP=true
+ HAD_SECCOMP=1
+ fi
+
+ if has_version '>=net-misc/chrony-4.1[seccomp]' ; then
+ # This version introduced a new filter level: -F 2
+ # It's a limited set of seccomp filters designed to be 'bare minimum'
+ HAD_PRE_NEW_SECCOMP_LEVEL=1
fi
}
@@ -210,22 +217,36 @@ pkg_postinst() {
tmpfiles_process chronyd.conf
if [[ -n "${REPLACING_VERSIONS}" ]] ; then
- if use caps && ! ${HAD_CAPS} ; then
+ if use caps && ! [[ ${HAD_CAPS} -eq 1 ]] ; then
# bug #719876
ewarn "Please adjust permissions on ${EROOT}/var/{lib,log}/chrony to be owned by ntp:ntp"
ewarn "e.g. chown -R ntp:ntp ${EROOT}/var/{lib,log}/chrony"
ewarn "This is necessary for chrony to drop privileges"
- elif ! use caps && ! ${HAD_CAPS} ; then
+ elif ! use caps && [[ ${HAD_CAPS} -eq 0 ]] ; then
ewarn "Please adjust permissions on ${EROOT}/var/{lib,log}/chrony to be owned by root:root"
fi
fi
- # TODO: Will try to re-enable before final release ideally?
- # bug #783915
- if [[ ! ${HAD_SECCOMP} ]] && use seccomp ; then
- elog "To enable seccomp in enforcing mode, please modify:"
+ # See bug #783915 for general discussion on enabling seccomp filtering
+ # by default.
+ local show_seccomp_enable_msg=0
+
+ # Was seccomp disabled before and now enabled?
+ if [[ ${HAD_SECCOMP} -eq 0 ]] && use seccomp ; then
+ show_seccomp_enable_msg=1
+ fi
+
+ # Are we coming from an old version without the new 'minimal' filter?
+ # (-F 2)
+ if [[ ${HAD_PRE_NEW_SECCOMP_LEVEL} -eq 0 ]] ; then
+ show_seccomp_enable_msg=1
+ fi
+
+ if [[ ${show_seccomp_enable_msg} -eq 1 ]] ; then
+ elog "To enable seccomp in a stricter mode, please modify:"
elog "- /etc/conf.d/chronyd for OpenRC"
elog "- systemctl edit chronyd for systemd"
- elog "to use -F 1 or -F -1 instead of -F 0 (see man chronyd)"
+ elog "By default, we now use -F 2 which is a baseline/minimal filter."
+ elog "to use -F 1 or -F -1 instead of -F 2 (see man chronyd)"
fi
}