From b8ed49dca0b6495d01d0281853b2a3f3e65d5a31 Mon Sep 17 00:00:00 2001 From: deraadt <> Date: Fri, 9 Oct 2015 03:54:53 +0000 Subject: [PATCH] the ntp engine can run with "stdio inet proc". For many reasons, including fork/exec cost, it would be better if constraints were forked from the master process, which would then tell the ntp engine. That would increase accuracy and security. Lots of conversations with reyk and bcook --- src/usr.sbin/ntpd/ntp.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/usr.sbin/ntpd/ntp.c b/src/usr.sbin/ntpd/ntp.c index 70be755e..f7668e08 100644 --- a/src/usr.sbin/ntpd/ntp.c +++ b/src/usr.sbin/ntpd/ntp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ntp.c,v 1.135 2015/08/14 02:00:18 millert Exp $ */ +/* $OpenBSD: ntp.c,v 1.136 2015/10/09 03:54:53 deraadt Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer @@ -30,6 +30,7 @@ #include #include #include +#include #include #include "ntpd.h" @@ -165,6 +166,20 @@ ntp_main(int pipe_prnt[2], int fd_ctl, struct ntpd_conf *nconf, endservent(); + /* + * XXX + * Unfortunately, the "contraint" processes are forked + * below the "ntp engine". Hence the ntp engine needs + * to be able to fork -> "proc", and the "constraint" + * process will want to open sockets -> "inet". + * + * For many reasons, including fork/exec cost, it would + * be better if constraints were forked from the master + * process, which would then tell the ntp engine. + */ + if (pledge("stdio inet proc", NULL) == -1) + err(1, "pledge"); + signal(SIGTERM, ntp_sighdlr); signal(SIGINT, ntp_sighdlr); signal(SIGINFO, ntp_sighdlr);