Subject: bug#31894: closed (Re: [bug#31894] Containerize openntpd service)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 26 Jun 2018 08:27:02 +0000

Your bug report

#31894: Containerize openntpd service

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
31894: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=31894
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#31894] Containerize openntpd service
From: Efraim Flashner <[email-masked]>
To: Ludovic Courtès <[email-masked]>
Cc: [email-masked]
Date: Tue, 26 Jun 2018 11:25:57 +0300
List-Id: <debbugs-submit.debbugs.gnu.org>

On Fri, Jun 22, 2018 at 09:39:01PM +0200, Ludovic Courtès wrote:
> Hello Efraim,
> 
> Efraim Flashner <[email-masked]> skribis:
> 
> > I tested this patch with the included vm image, using the following
> > script. After logging in, 'ntpctl -s all' shows openntpd connecting to
> > the ntp servers and updating the time.
> >
> > /.$(./pre-inst-env guix environment guix -- ./pre-inst-env guix system vm ~/vm-image.scm) -m 768 -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp::5555-:53
> 
> [...]
> 
> > From 064903c5a976280b95cd9bba17e958e662be605d Mon Sep 17 00:00:00 2001
> > From: Efraim Flashner <[email-masked]>
> > Date: Tue, 19 Jun 2018 12:24:47 +0300
> > Subject: [PATCH] services: openntpd: Containerize openntpd service.
> >
> > * gnu/packages/ntp.scm (openntpd)[arguments]: Add 'privsep-path' to
> > 'configure-flags and adjust the 'localstatedir' flag.
> > * gnu/services/networking.scm (openntpd-shepherd-service): Change the
> > start-service command to run in a container, expose '/var/log/openntpd'
> > and '/var/lib/openntpd' to the container.
> > (openntpd-service-activation): Adjust directories for the changes above.
> 
> Neat!  The patch LGTM, especially since you’ve confirmed that it still
> works as expected.  :-)
> 
> One thing though: could you make sure containerization isn’t redundant
> with what OpenNTPD already does?  Namely, could you grep the source for
> calls to “chroot”, “unshare”, or “seccomp”?  If it happens to be already
> doing one of these things, it may be that using a container brings
> little or nothing.
> 
> If it’s OK, please push!

From grepping the source:

./INSTALL-OpenNTPD always uses Privilege Separation (ie the majority of the
./INSTALL:processing is done as a chroot'ed, unprivileged user).

The code also supports the assertion.

it defaults to /var/empty, unless the --with-privsep-path=path flag is
set, so it looks like my patch is unnecessary after all. :)

> 
> While I’m at it, one question about this comment (which was already there):
> 
> > +                           ;; When ntpd is daemonized it repeatedly tries to respawn
> > +                           ;; while running, leading shepherd to disable it.  To
> > +                           ;; prevent spamming stderr, redirect output to logfile.
> > +                           #:log-file "/var/log/ntpd"))
> 
> What’s described here is expected: when it daemonizes, the initial
> process that shepherd spawned terminates immediately, which is why
> shepherd tries to respawn it (it cannot guess that there’s in fact a
> child process that keeps running.)
> 
> The right thing to do for things that daemonize is to use the #:pid-file
> option, which instructs shepherd to poll that file.  Should we do this
> here?  There are many examples of that, including bitlbee, which is
> containerized.
> 

I'll take a look at that and see if I can fix that.

> Thanks,
> Ludo’.

-- 
Efraim Flashner   <[email-masked]>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

Subject: Containerize openntpd service
From: Efraim Flashner <[email-masked]>
To: [email-masked]
Date: Tue, 19 Jun 2018 12:31:55 +0300
List-Id: <debbugs-submit.debbugs.gnu.org>

I tested this patch with the included vm image, using the following
script. After logging in, 'ntpctl -s all' shows openntpd connecting to
the ntp servers and updating the time.

/.$(./pre-inst-env guix environment guix -- ./pre-inst-env guix system vm ~/vm-image.scm) -m 768 -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp::5555-:53

-- 
Efraim Flashner   <[email-masked]>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
From 064903c5a976280b95cd9bba17e958e662be605d Mon Sep 17 00:00:00 2001
From: Efraim Flashner <[email-masked]>
Date: Tue, 19 Jun 2018 12:24:47 +0300
Subject: [PATCH] services: openntpd: Containerize openntpd service.

* gnu/packages/ntp.scm (openntpd)[arguments]: Add 'privsep-path' to
'configure-flags and adjust the 'localstatedir' flag.
* gnu/services/networking.scm (openntpd-shepherd-service): Change the
start-service command to run in a container, expose '/var/log/openntpd'
and '/var/lib/openntpd' to the container.
(openntpd-service-activation): Adjust directories for the changes above.
---
 gnu/packages/ntp.scm        |  3 +-
 gnu/services/networking.scm | 58 ++++++++++++++++++++++++-------------
 2 files changed, 40 insertions(+), 21 deletions(-)

diff --git a/gnu/packages/ntp.scm b/gnu/packages/ntp.scm
index e9ae9fa46..2c202b400 100644
--- a/gnu/packages/ntp.scm
+++ b/gnu/packages/ntp.scm
@@ -109,7 +109,8 @@ computers over a network.")
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--with-privsep-user=ntpd"
-                           "--localstatedir=/var")
+                           "--with-privsep-path=/var/lib/openntpd"
+                           "--localstatedir=/var/lib/openntpd")
        #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'modify-install-locations
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index d5d0cf9d1..100a18e7c 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -428,22 +428,39 @@ make an initial adjustment of more than 1,000 seconds."
       (define ntpd.conf
         (plain-file "ntpd.conf" config))
 
-      (list (shepherd-service
-              (provision '(ntpd))
-              (documentation "Run the Network Time Protocol (NTP) daemon.")
-              (requirement '(user-processes networking))
-              (start #~(make-forkexec-constructor
-                         (list (string-append #$openntpd "/sbin/ntpd")
-                               "-f" #$ntpd.conf
-                               "-d" ;; don't daemonize
-                               #$@(if allow-large-adjustment?
-                                    '("-s")
-                                    '()))
-                         ;; When ntpd is daemonized it repeatedly tries to respawn
-                         ;; while running, leading shepherd to disable it.  To
-                         ;; prevent spamming stderr, redirect output to logfile.
-                         #:log-file "/var/log/ntpd"))
-              (stop #~(make-kill-destructor)))))))
+      (with-imported-modules (source-module-closure
+                              '((gnu build shepherd)
+                                (gnu system file-systems)))
+        (list (shepherd-service
+                (provision '(ntpd))
+                (documentation "Run the Network Time Protocol (NTP) daemon.")
+                (requirement '(user-processes networking))
+                  (modules '((gnu build shepherd)
+                             (gnu system file-systems)))
+                (start #~(make-forkexec-constructor/container
+                           (list (string-append #$openntpd "/sbin/ntpd")
+                                 "-f" #$ntpd.conf
+                                 "-d" ;; don't daemonize
+                                 #$@(if allow-large-adjustment?
+                                      '("-s")
+                                      '()))
+                           #:mappings (list (file-system-mapping
+                                              (source "/var/lib/openntpd")
+                                              (target source)
+                                              (writable? #t))
+                                            (file-system-mapping
+                                              (source "/var/log/openntpd")
+                                              (target "/var/log")
+                                              (writable? #t))
+                                            ;; For the privsep ntpd user.
+                                            (file-system-mapping
+                                              (source "/var/lib/openntpd")
+                                              (target "/var/empty")))
+                           ;; When ntpd is daemonized it repeatedly tries to respawn
+                           ;; while running, leading shepherd to disable it.  To
+                           ;; prevent spamming stderr, redirect output to logfile.
+                           #:log-file "/var/log/ntpd"))
+                (stop #~(make-kill-destructor))))))))
 
 (define (openntpd-service-activation config)
   "Return the activation gexp for CONFIG."
@@ -451,10 +468,11 @@ make an initial adjustment of more than 1,000 seconds."
     #~(begin
         (use-modules (guix build utils))
 
-        (mkdir-p "/var/db")
-        (mkdir-p "/var/run")
-        (unless (file-exists? "/var/db/ntpd.drift")
-          (with-output-to-file "/var/db/ntpd.drift"
+        (mkdir-p "/var/lib/openntpd/db")
+        (mkdir-p "/var/lib/openntpd/run")
+        (mkdir-p "/var/log/openntpd")
+        (unless (file-exists? "/var/lib/openntpd/db/ntpd.drift")
+          (with-output-to-file "/var/lib/openntpd/db/ntpd.drift"
                                (lambda _
                                  (format #t "0.0")))))))
 
-- 
2.17.1