GNU bug report logs -
#31894
Containerize openntpd service
Previous Next
To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 31894 in the body.
You can then email your comments to 31894 AT debbugs.gnu.org in the normal way.
Toggle the display of automated, internal messages from the tracker.
Report forwarded
to
guix-patches <at> gnu.org
:
bug#31894
; Package
guix-patches
.
(Tue, 19 Jun 2018 09:33:01 GMT)
Full text and
rfc822 format available.
Acknowledgement sent
to
Efraim Flashner <efraim <at> flashner.co.il>
:
New bug report received and forwarded. Copy sent to
guix-patches <at> gnu.org
.
(Tue, 19 Jun 2018 09:33:03 GMT)
Full text and
rfc822 format available.
Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
I tested this patch with the included vm image, using the following
script. After logging in, 'ntpctl -s all' shows openntpd connecting to
the ntp servers and updating the time.
/.$(./pre-inst-env guix environment guix -- ./pre-inst-env guix system vm ~/vm-image.scm) -m 768 -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp::5555-:53
--
Efraim Flashner <efraim <at> flashner.co.il> אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
[0001-services-openntpd-Containerize-openntpd-service.patch (text/plain, attachment)]
[vm-image.scm (text/plain, attachment)]
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
guix-patches <at> gnu.org
:
bug#31894
; Package
guix-patches
.
(Fri, 22 Jun 2018 19:40:02 GMT)
Full text and
rfc822 format available.
Message #8 received at 31894 <at> debbugs.gnu.org (full text, mbox):
Hello Efraim,
Efraim Flashner <efraim <at> flashner.co.il> skribis:
> I tested this patch with the included vm image, using the following
> script. After logging in, 'ntpctl -s all' shows openntpd connecting to
> the ntp servers and updating the time.
>
> /.$(./pre-inst-env guix environment guix -- ./pre-inst-env guix system vm ~/vm-image.scm) -m 768 -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp::5555-:53
[...]
> From 064903c5a976280b95cd9bba17e958e662be605d Mon Sep 17 00:00:00 2001
> From: Efraim Flashner <efraim <at> flashner.co.il>
> Date: Tue, 19 Jun 2018 12:24:47 +0300
> Subject: [PATCH] services: openntpd: Containerize openntpd service.
>
> * gnu/packages/ntp.scm (openntpd)[arguments]: Add 'privsep-path' to
> 'configure-flags and adjust the 'localstatedir' flag.
> * gnu/services/networking.scm (openntpd-shepherd-service): Change the
> start-service command to run in a container, expose '/var/log/openntpd'
> and '/var/lib/openntpd' to the container.
> (openntpd-service-activation): Adjust directories for the changes above.
Neat! The patch LGTM, especially since you’ve confirmed that it still
works as expected. :-)
One thing though: could you make sure containerization isn’t redundant
with what OpenNTPD already does? Namely, could you grep the source for
calls to “chroot”, “unshare”, or “seccomp”? If it happens to be already
doing one of these things, it may be that using a container brings
little or nothing.
If it’s OK, please push!
While I’m at it, one question about this comment (which was already there):
> + ;; When ntpd is daemonized it repeatedly tries to respawn
> + ;; while running, leading shepherd to disable it. To
> + ;; prevent spamming stderr, redirect output to logfile.
> + #:log-file "/var/log/ntpd"))
What’s described here is expected: when it daemonizes, the initial
process that shepherd spawned terminates immediately, which is why
shepherd tries to respawn it (it cannot guess that there’s in fact a
child process that keeps running.)
The right thing to do for things that daemonize is to use the #:pid-file
option, which instructs shepherd to poll that file. Should we do this
here? There are many examples of that, including bitlbee, which is
containerized.
Thanks,
Ludo’.
Reply sent
to
Efraim Flashner <efraim <at> flashner.co.il>
:
You have taken responsibility.
(Tue, 26 Jun 2018 08:27:01 GMT)
Full text and
rfc822 format available.
Notification sent
to
Efraim Flashner <efraim <at> flashner.co.il>
:
bug acknowledged by developer.
(Tue, 26 Jun 2018 08:27:02 GMT)
Full text and
rfc822 format available.
Message #13 received at 31894-done <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Fri, Jun 22, 2018 at 09:39:01PM +0200, Ludovic Courtès wrote:
> Hello Efraim,
>
> Efraim Flashner <efraim <at> flashner.co.il> skribis:
>
> > I tested this patch with the included vm image, using the following
> > script. After logging in, 'ntpctl -s all' shows openntpd connecting to
> > the ntp servers and updating the time.
> >
> > /.$(./pre-inst-env guix environment guix -- ./pre-inst-env guix system vm ~/vm-image.scm) -m 768 -device e1000,netdev=net0 -netdev user,id=net0,hostfwd=tcp::5555-:53
>
> [...]
>
> > From 064903c5a976280b95cd9bba17e958e662be605d Mon Sep 17 00:00:00 2001
> > From: Efraim Flashner <efraim <at> flashner.co.il>
> > Date: Tue, 19 Jun 2018 12:24:47 +0300
> > Subject: [PATCH] services: openntpd: Containerize openntpd service.
> >
> > * gnu/packages/ntp.scm (openntpd)[arguments]: Add 'privsep-path' to
> > 'configure-flags and adjust the 'localstatedir' flag.
> > * gnu/services/networking.scm (openntpd-shepherd-service): Change the
> > start-service command to run in a container, expose '/var/log/openntpd'
> > and '/var/lib/openntpd' to the container.
> > (openntpd-service-activation): Adjust directories for the changes above.
>
> Neat! The patch LGTM, especially since you’ve confirmed that it still
> works as expected. :-)
>
> One thing though: could you make sure containerization isn’t redundant
> with what OpenNTPD already does? Namely, could you grep the source for
> calls to “chroot”, “unshare”, or “seccomp”? If it happens to be already
> doing one of these things, it may be that using a container brings
> little or nothing.
>
> If it’s OK, please push!
From grepping the source:
./INSTALL-OpenNTPD always uses Privilege Separation (ie the majority of the
./INSTALL:processing is done as a chroot'ed, unprivileged user).
The code also supports the assertion.
it defaults to /var/empty, unless the --with-privsep-path=path flag is
set, so it looks like my patch is unnecessary after all. :)
>
> While I’m at it, one question about this comment (which was already there):
>
> > + ;; When ntpd is daemonized it repeatedly tries to respawn
> > + ;; while running, leading shepherd to disable it. To
> > + ;; prevent spamming stderr, redirect output to logfile.
> > + #:log-file "/var/log/ntpd"))
>
> What’s described here is expected: when it daemonizes, the initial
> process that shepherd spawned terminates immediately, which is why
> shepherd tries to respawn it (it cannot guess that there’s in fact a
> child process that keeps running.)
>
> The right thing to do for things that daemonize is to use the #:pid-file
> option, which instructs shepherd to poll that file. Should we do this
> here? There are many examples of that, including bitlbee, which is
> containerized.
>
I'll take a look at that and see if I can fix that.
> Thanks,
> Ludo’.
--
Efraim Flashner <efraim <at> flashner.co.il> אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
guix-patches <at> gnu.org
:
bug#31894
; Package
guix-patches
.
(Tue, 26 Jun 2018 13:49:02 GMT)
Full text and
rfc822 format available.
Message #16 received at 31894-done <at> debbugs.gnu.org (full text, mbox):
Efraim Flashner <efraim <at> flashner.co.il> skribis:
> On Fri, Jun 22, 2018 at 09:39:01PM +0200, Ludovic Courtès wrote:
[...]
>> One thing though: could you make sure containerization isn’t redundant
>> with what OpenNTPD already does? Namely, could you grep the source for
>> calls to “chroot”, “unshare”, or “seccomp”? If it happens to be already
>> doing one of these things, it may be that using a container brings
>> little or nothing.
>>
>> If it’s OK, please push!
>
> From grepping the source:
>
> ./INSTALL-OpenNTPD always uses Privilege Separation (ie the majority of the
> ./INSTALL:processing is done as a chroot'ed, unprivileged user).
>
> The code also supports the assertion.
>
> it defaults to /var/empty, unless the --with-privsep-path=path flag is
> set, so it looks like my patch is unnecessary after all. :)
Heh, alright. Perhaps you’ll find another candidate for
containerization. ;-)
Thanks,
Ludo’.
bug archived.
Request was from
Debbugs Internal Request <help-debbugs <at> gnu.org>
to
internal_control <at> debbugs.gnu.org
.
(Wed, 25 Jul 2018 11:24:07 GMT)
Full text and
rfc822 format available.
This bug report was last modified 5 years and 270 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.