Attachment #195345 for bug #229936

View | Details | Raw Unified | Return to bug 229936
Collapse All | Expand All




USES=		ssl

USE_RC_SUBR=	openntpd
USERS=		_ntp
GROUPS=		_ntp

GNU_CONFIGURE=	yes
CONFIGURE_ARGS=	--with-cacert=${LOCALBASE}/etc/ssl/cert.pem


.include <bsd.port.pre.mk>

.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1200075
CONFIGURE_ARGS+=--with-privsep-user=ntpd
.else
USERS=		_ntp
GROUPS=		_ntp
.endif

# Requires libtls from LibreSSL
.if ${SSL_DEFAULT:Mlibressl*}
CPPFLAGS+=		-I${OPENSSLINC}




--- src/ntp.c.orig	2018-07-21 20:35:38 UTC
+++ src/ntp.c
@@ -117,7 +117,8 @@ ntp_main(struct ntpd_conf *nconf, struct
 	if (stat(pw->pw_dir, &stb) == -1) {
 		fatal("privsep dir %s could not be opened", pw->pw_dir);
 	}
-	if (stb.st_uid != 0 || (stb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
+	if (stb.st_uid != pw->pw_uid && 
+	    stb.st_uid != 0 || (stb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
 		fatalx("bad privsep dir %s permissions: %o",
 		    pw->pw_dir, stb.st_mode);
 	}

Return to bug 229936

Lines 18-25 CONFLICTS= ntp-[0-9].* ntp-devel-* Link Here

(-)Makefile (-2 / +7 lines)
18	USES= ssl	18	USES= ssl
19		19
20	USE_RC_SUBR= openntpd	20	USE_RC_SUBR= openntpd
21	USERS= _ntp
22	GROUPS= _ntp
23		21
24	GNU_CONFIGURE= yes	22	GNU_CONFIGURE= yes
25	CONFIGURE_ARGS= --with-cacert=${LOCALBASE}/etc/ssl/cert.pem	23	CONFIGURE_ARGS= --with-cacert=${LOCALBASE}/etc/ssl/cert.pem
Lines 38-43 post-install: Link Here
38		36
39	.include <bsd.port.pre.mk>	37	.include <bsd.port.pre.mk>
40		38
		39	.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1200075
		40	CONFIGURE_ARGS+=--with-privsep-user=ntpd
		41	.else
		42	USERS= _ntp
		43	GROUPS= _ntp
		44	.endif
		45
41	# Requires libtls from LibreSSL	46	# Requires libtls from LibreSSL
42	.if ${SSL_DEFAULT:Mlibressl*}	47	.if ${SSL_DEFAULT:Mlibressl*}
43	CPPFLAGS+= -I${OPENSSLINC}	48	CPPFLAGS+= -I${OPENSSLINC}

Line 0 Link Here

(-)files/patch-src_ntp.c (+12 lines)
	1	--- src/ntp.c.orig 2018-07-21 20:35:38 UTC
	2	+++ src/ntp.c
	3	@@ -117,7 +117,8 @@ ntp_main(struct ntpd_conf *nconf, struct
	4	if (stat(pw->pw_dir, &stb) == -1) {
	5	fatal("privsep dir %s could not be opened", pw->pw_dir);
	6	}
	7	- if (stb.st_uid != 0 \|\| (stb.st_mode & (S_IWGRP\|S_IWOTH)) != 0) {
	8	+ if (stb.st_uid != pw->pw_uid &&
	9	+ stb.st_uid != 0 \|\| (stb.st_mode & (S_IWGRP\|S_IWOTH)) != 0) {
	10	fatalx("bad privsep dir %s permissions: %o",
	11	pw->pw_dir, stb.st_mode);
	12	}