1 |
commit: 9a5c393d884d5e20f95097feca7f98a3499639e6 |
2 |
Author: Sam James <sam <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Feb 8 14:10:07 2021 +0000 |
4 |
Commit: Sam James <sam <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Feb 8 14:54:02 2021 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9a5c393d |
7 |
|
8 |
net-misc/chrony: add note re changes on USE=seccomp install |
9 |
|
10 |
Users must enable seccomp manually for now at runtime. |
11 |
|
12 |
Package-Manager: Portage-3.0.14, Repoman-3.0.2 |
13 |
Signed-off-by: Sam James <sam <AT> gentoo.org> |
14 |
|
15 |
net-misc/chrony/chrony-4.0-r1.ebuild | 15 ++++++++++++++- |
16 |
net-misc/chrony/chrony-9999.ebuild | 15 ++++++++++++++- |
17 |
2 files changed, 28 insertions(+), 2 deletions(-) |
18 |
|
19 |
diff --git a/net-misc/chrony/chrony-4.0-r1.ebuild b/net-misc/chrony/chrony-4.0-r1.ebuild |
20 |
index e0333b6483f..d663e9cb680 100644 |
21 |
--- a/net-misc/chrony/chrony-4.0-r1.ebuild |
22 |
+++ b/net-misc/chrony/chrony-4.0-r1.ebuild |
23 |
@@ -173,10 +173,16 @@ src_install() { |
24 |
|
25 |
pkg_preinst() { |
26 |
HAD_CAPS=false |
27 |
+ HAD_SECCOMP=false |
28 |
|
29 |
- if has_version 'net-misc/chrony[caps]'; then |
30 |
+ if has_version 'net-misc/chrony[caps]' ; then |
31 |
HAD_CAPS=true |
32 |
fi |
33 |
+ |
34 |
+ if has_version 'net-misc/chrony[seccomp]' ; then |
35 |
+ HAD_SECCOMP=true |
36 |
+ fi |
37 |
+ |
38 |
} |
39 |
|
40 |
pkg_postinst() { |
41 |
@@ -187,4 +193,11 @@ pkg_postinst() { |
42 |
ewarn "e.g. chown -R ntp:ntp ${EROOT}/var/{lib,log}/chrony" |
43 |
ewarn "This is necessary for chrony to drop privileges" |
44 |
fi |
45 |
+ |
46 |
+ if [[ ! ${HAD_SECCOMP} ]] && use seccomp ; then |
47 |
+ elog "To enable seccomp in enforcing mode, please modify:" |
48 |
+ elog "- /etc/conf.d/chronyd for OpenRC" |
49 |
+ elog "- systemctl edit chronyd for systemd" |
50 |
+ elog "to use -F 1 or -F -1 instead of -F 0 (see man chronyd)" |
51 |
+ fi |
52 |
} |
53 |
|
54 |
diff --git a/net-misc/chrony/chrony-9999.ebuild b/net-misc/chrony/chrony-9999.ebuild |
55 |
index e0333b6483f..d663e9cb680 100644 |
56 |
--- a/net-misc/chrony/chrony-9999.ebuild |
57 |
+++ b/net-misc/chrony/chrony-9999.ebuild |
58 |
@@ -173,10 +173,16 @@ src_install() { |
59 |
|
60 |
pkg_preinst() { |
61 |
HAD_CAPS=false |
62 |
+ HAD_SECCOMP=false |
63 |
|
64 |
- if has_version 'net-misc/chrony[caps]'; then |
65 |
+ if has_version 'net-misc/chrony[caps]' ; then |
66 |
HAD_CAPS=true |
67 |
fi |
68 |
+ |
69 |
+ if has_version 'net-misc/chrony[seccomp]' ; then |
70 |
+ HAD_SECCOMP=true |
71 |
+ fi |
72 |
+ |
73 |
} |
74 |
|
75 |
pkg_postinst() { |
76 |
@@ -187,4 +193,11 @@ pkg_postinst() { |
77 |
ewarn "e.g. chown -R ntp:ntp ${EROOT}/var/{lib,log}/chrony" |
78 |
ewarn "This is necessary for chrony to drop privileges" |
79 |
fi |
80 |
+ |
81 |
+ if [[ ! ${HAD_SECCOMP} ]] && use seccomp ; then |
82 |
+ elog "To enable seccomp in enforcing mode, please modify:" |
83 |
+ elog "- /etc/conf.d/chronyd for OpenRC" |
84 |
+ elog "- systemctl edit chronyd for systemd" |
85 |
+ elog "to use -F 1 or -F -1 instead of -F 0 (see man chronyd)" |
86 |
+ fi |
87 |
} |