Skip to content

Commit 4e86ab2

Browse files
Mab879Mab879
authored
Merge pull request #14649 from vickeybrown/CMP-3618-chrony-wait-fix
CMP-3618 added chrony-wait fix
2 parents 4d8bb13 + adfc858 commit 4e86ab2

28 files changed

Lines changed: 432 additions & 3 deletions

File tree

‎components/chrony.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ rules:
1414
- service_chronyd_enabled
1515
- chrony_set_nts
1616
- chronyd_client_only
17+
- chronyd_configure_local_socket
1718
- chronyd_no_chronyc_network
1819
- chronyd_or_ntpd_specify_multiple_servers
1920
- chronyd_sync_clock

‎components/ntp.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ packages:
55
- ntp
66
rules:
77
- chronyd_client_only
8+
- chronyd_configure_local_socket
89
- chronyd_configure_pool_and_server
910
- chronyd_no_chronyc_network
1011
- chronyd_or_ntpd_set_maxpoll

‎controls/cusp_fedora.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,7 @@ controls:
271271
# chrony
272272
- chronyd_client_only
273273
- chronyd_no_chronyc_network
274+
- chronyd_configure_local_socket
274275
- chronyd_or_ntpd_set_maxpoll
275276
- chronyd_run_as_chrony_user
276277
- chronyd_specify_remote_server

‎controls/nist_rhcos4.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5222,6 +5222,7 @@ controls:
52225222
https://issues.redhat.com/browse/CMP-274
52235223
rules:
52245224
- chronyd_no_chronyc_network
5225+
- chronyd_configure_local_socket
52255226
description: |-
52265227
The organization:
52275228
(a) Reviews the information system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

‎controls/stig_ol9.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1416,6 +1416,7 @@ controls:
14161416
title: OL 9 must disable network management of the chrony daemon.
14171417
rules:
14181418
- chronyd_no_chronyc_network
1419+
- chronyd_configure_local_socket
14191420
status: automated
14201421

14211422
- id: OL09-00-006003

‎linux_os/guide/services/ntp/chronyd_configure_local_socket/ansible/rhel8.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# platform = Oracle Linux 8,Red Hat Enterprise Linux 8
2+
# reboot = false
3+
# strategy = restrict
4+
# complexity = low
5+
# disruption = low
6+
7+
# Fix chrony-wait.service to use Unix socket instead of network socket
8+
# RHEL 8 version without additional hardening (KCS 7064388)
9+
- name: "{{{ rule_title }}} - Check if chrony-wait.service exists"
10+
ansible.builtin.stat:
11+
path: /usr/lib/systemd/system/chrony-wait.service
12+
register: chrony_wait_service
13+
14+
- name: "{{{ rule_title }}} - Replace chrony-wait.service to use Unix socket (KCS 7064388)"
15+
ansible.builtin.copy:
16+
dest: /etc/systemd/system/chrony-wait.service
17+
content: |
18+
[Unit]
19+
Description=Wait for chrony to synchronize system clock(KCS 7064388)
20+
Documentation=man:chronyc(1)
21+
After=chronyd.service
22+
Requires=chronyd.service
23+
Before=time-sync.target
24+
Wants=time-sync.target
25+
26+
[Service]
27+
Type=oneshot
28+
# Wait for chronyd to update the clock and the remaining
29+
# correction to be less than 0.1 seconds
30+
ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
31+
# Wait for at most 3 minutes
32+
TimeoutStartSec=180
33+
RemainAfterExit=yes
34+
StandardOutput=null
35+
36+
[Install]
37+
WantedBy=multi-user.target
38+
mode: '0644'
39+
when: chrony_wait_service.stat.exists
40+
41+
- name: "{{{ rule_title }}} - Reload systemd daemon and enable chrony-wait.service"
42+
ansible.builtin.systemd:
43+
name: chrony-wait.service
44+
daemon_reload: yes
45+
enabled: yes
46+
when: chrony_wait_service.stat.exists

‎linux_os/guide/services/ntp/chronyd_configure_local_socket/ansible/rhel9.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# platform = Oracle Linux 9,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10,multi_platform_almalinux,multi_platform_fedora
2+
# reboot = false
3+
# strategy = restrict
4+
# complexity = low
5+
# disruption = low
6+
7+
# Fix chrony-wait.service to use Unix socket instead of network socket
8+
# RHEL 9+ version with hardening directives (KCS 7064388)
9+
- name: "{{{ rule_title }}} - Check if chrony-wait.service exists"
10+
ansible.builtin.stat:
11+
path: /usr/lib/systemd/system/chrony-wait.service
12+
register: chrony_wait_service
13+
14+
- name: "{{{ rule_title }}} - Replace chrony-wait.service to use Unix socket (KCS 7064388)"
15+
ansible.builtin.copy:
16+
dest: /etc/systemd/system/chrony-wait.service
17+
content: |
18+
[Unit]
19+
Description=Wait for chrony to synchronize system clock(KCS 7064388)
20+
Documentation=man:chronyc(1)
21+
After=chronyd.service
22+
Requires=chronyd.service
23+
Before=time-sync.target
24+
Wants=time-sync.target
25+
26+
[Service]
27+
Type=oneshot
28+
# Wait for chronyd to update the clock and the remaining
29+
# correction to be less than 0.1 seconds
30+
ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
31+
# Wait for at most 3 minutes
32+
TimeoutStartSec=180
33+
RemainAfterExit=yes
34+
StandardOutput=null
35+
36+
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
37+
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
38+
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
39+
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
40+
CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
41+
DevicePolicy=closed
42+
#DynamicUser=yes
43+
IPAddressAllow=localhost
44+
IPAddressDeny=any
45+
LockPersonality=yes
46+
MemoryDenyWriteExecute=yes
47+
PrivateDevices=yes
48+
ProcSubset=pid
49+
ProtectClock=yes
50+
ProtectControlGroups=yes
51+
ProtectHome=yes
52+
ProtectHostname=yes
53+
ProtectKernelLogs=yes
54+
ProtectKernelModules=yes
55+
ProtectKernelTunables=yes
56+
ProtectProc=invisible
57+
ProtectSystem=strict
58+
RestrictAddressFamilies=AF_UNIX
59+
RestrictNamespaces=yes
60+
RestrictRealtime=yes
61+
SystemCallArchitectures=native
62+
SystemCallFilter=@system-service
63+
SystemCallFilter=~@privileged @resources
64+
UMask=0777
65+
66+
[Install]
67+
WantedBy=multi-user.target
68+
mode: '0644'
69+
when: chrony_wait_service.stat.exists
70+
71+
- name: "{{{ rule_title }}} - Reload systemd daemon and enable chrony-wait.service"
72+
ansible.builtin.systemd:
73+
name: chrony-wait.service
74+
daemon_reload: yes
75+
enabled: yes
76+
when: chrony_wait_service.stat.exists

‎linux_os/guide/services/ntp/chronyd_configure_local_socket/bash/rhel8.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# platform = Oracle Linux 8,Red Hat Enterprise Linux 8
2+
3+
# Fix chrony-wait.service to use Unix socket instead of network socket
4+
# The default service uses -h 127.0.0.1,::1 which fails when cmdport is 0
5+
# RHEL 8 version without additional hardening (KCS 7064388)
6+
if systemctl list-unit-files chrony-wait.service >/dev/null 2>&1; then
7+
cat > /etc/systemd/system/chrony-wait.service << 'EOF'
8+
[Unit]
9+
Description=Wait for chrony to synchronize system clock(KCS 7064388)
10+
Documentation=man:chronyc(1)
11+
After=chronyd.service
12+
Requires=chronyd.service
13+
Before=time-sync.target
14+
Wants=time-sync.target
15+
16+
[Service]
17+
Type=oneshot
18+
# Wait for chronyd to update the clock and the remaining
19+
# correction to be less than 0.1 seconds
20+
ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
21+
# Wait for at most 3 minutes
22+
TimeoutStartSec=180
23+
RemainAfterExit=yes
24+
StandardOutput=null
25+
26+
[Install]
27+
WantedBy=multi-user.target
28+
EOF
29+
systemctl daemon-reload
30+
systemctl enable chrony-wait.service
31+
fi

‎linux_os/guide/services/ntp/chronyd_configure_local_socket/bash/rhel9.sh‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# platform = Oracle Linux 9,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10,multi_platform_almalinux,multi_platform_fedora
2+
3+
# Fix chrony-wait.service to use Unix socket instead of network socket
4+
# The default service uses -h 127.0.0.1,::1 which fails when cmdport is 0
5+
# RHEL 9+ version with hardening directives (KCS 7064388)
6+
if systemctl list-unit-files chrony-wait.service >/dev/null 2>&1; then
7+
cat > /etc/systemd/system/chrony-wait.service << 'EOF'
8+
[Unit]
9+
Description=Wait for chrony to synchronize system clock(KCS 7064388)
10+
Documentation=man:chronyc(1)
11+
After=chronyd.service
12+
Requires=chronyd.service
13+
Before=time-sync.target
14+
Wants=time-sync.target
15+
16+
[Service]
17+
Type=oneshot
18+
# Wait for chronyd to update the clock and the remaining
19+
# correction to be less than 0.1 seconds
20+
ExecStart=/usr/bin/chronyc waitsync 0 0.1 0.0 1
21+
# Wait for at most 3 minutes
22+
TimeoutStartSec=180
23+
RemainAfterExit=yes
24+
StandardOutput=null
25+
26+
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
27+
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
28+
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
29+
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
30+
CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
31+
DevicePolicy=closed
32+
#DynamicUser=yes
33+
IPAddressAllow=localhost
34+
IPAddressDeny=any
35+
LockPersonality=yes
36+
MemoryDenyWriteExecute=yes
37+
PrivateDevices=yes
38+
ProcSubset=pid
39+
ProtectClock=yes
40+
ProtectControlGroups=yes
41+
ProtectHome=yes
42+
ProtectHostname=yes
43+
ProtectKernelLogs=yes
44+
ProtectKernelModules=yes
45+
ProtectKernelTunables=yes
46+
ProtectProc=invisible
47+
ProtectSystem=strict
48+
RestrictAddressFamilies=AF_UNIX
49+
RestrictNamespaces=yes
50+
RestrictRealtime=yes
51+
SystemCallArchitectures=native
52+
SystemCallFilter=@system-service
53+
SystemCallFilter=~@privileged @resources
54+
UMask=0777
55+
56+
[Install]
57+
WantedBy=multi-user.target
58+
EOF
59+
systemctl daemon-reload
60+
systemctl enable chrony-wait.service
61+
fi

‎linux_os/guide/services/ntp/chronyd_configure_local_socket/kubernetes/shared.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos
3+
# reboot = true
4+
# strategy = restrict
5+
# complexity = low
6+
# disruption = low
7+
apiVersion: machineconfiguration.openshift.io/v1
8+
kind: MachineConfig
9+
spec:
10+
config:
11+
ignition:
12+
version: 3.1.0
13+
storage:
14+
files:
15+
- contents:
16+
source: data:,%5BUnit%5D%0ADescription%3DWait%20for%20chrony%20to%20synchronize%20system%20clock%20%28KCS%207064388%29%0ADocumentation%3Dman%3Achronyc%281%29%0AAfter%3Dchronyd.service%0ARequires%3Dchronyd.service%0ABefore%3Dtime-sync.target%0AWants%3Dtime-sync.target%0A%0A%5BService%5D%0AType%3Doneshot%0AExecStart%3D%2Fusr%2Fbin%2Fchronyc%20waitsync%200%200.1%200.0%201%0ATimeoutStartSec%3D180%0ARemainAfterExit%3Dyes%0AStandardOutput%3Dnull%0A%0ACapabilityBoundingSet%3D~CAP_AUDIT_CONTROL%20CAP_AUDIT_READ%20CAP_AUDIT_WRITE%0ACapabilityBoundingSet%3D~CAP_BLOCK_SUSPEND%20CAP_KILL%20CAP_LEASE%20CAP_LINUX_IMMUTABLE%0ACapabilityBoundingSet%3D~CAP_MAC_ADMIN%20CAP_MAC_OVERRIDE%20CAP_MKNOD%20CAP_SYS_ADMIN%0ACapabilityBoundingSet%3D~CAP_SYS_BOOT%20CAP_SYS_CHROOT%20CAP_SYS_MODULE%20CAP_SYS_PACCT%0ACapabilityBoundingSet%3D~CAP_SYS_PTRACE%20CAP_SYS_RAWIO%20CAP_SYS_TTY_CONFIG%20CAP_WAKE_ALARM%0ADevicePolicy%3Dclosed%0AIPAddressAllow%3Dlocalhost%0AIPAddressDeny%3Dany%0ALockPersonality%3Dyes%0AMemoryDenyWriteExecute%3Dyes%0APrivateDevices%3Dyes%0AProcSubset%3Dpid%0AProtectClock%3Dyes%0AProtectControlGroups%3Dyes%0AProtectHome%3Dyes%0AProtectHostname%3Dyes%0AProtectKernelLogs%3Dyes%0AProtectKernelModules%3Dyes%0AProtectKernelTunables%3Dyes%0AProtectProc%3Dinvisible%0AProtectSystem%3Dstrict%0ARestrictAddressFamilies%3DAF_UNIX%0ARestrictNamespaces%3Dyes%0ARestrictRealtime%3Dyes%0ASystemCallArchitectures%3Dnative%0ASystemCallFilter%3D%40system-service%0ASystemCallFilter%3D~%40privileged%20%40resources%0AUMask%3D0777%0A%0A%5BInstall%5D%0AWantedBy%3Dmulti-user.target%0A
17+
mode: 420
18+
overwrite: true
19+
path: /etc/systemd/system/chrony-wait.service

0 commit comments

Comments
 (0)